December 2003 - cypherpunks-legacy

Re: lp (134.222.35.2)?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by perry(a)piermont.com ("Perry E. Metzger") on Sun, 05 Nov 12:13 PM >Quit looking for the spooks where they aren't. You >should always assume your line is being tapped if you >are saying something you don't want heard, anway. True, it's not Smokey behind the billboard, blinked at you by oncoming headlights, it's the sensors in the roadbed that reads your tag -- when it leaves your home-ain, then at the remailer donkeystops, then at your recreational stash-house, at the pedo-filmery, at the Semtex-Pantex workhide, at the digi-wallet-copyfast, right into ananonymous Ken-Barbie's e-slot. TLA-Smokey is friendly, maybe intra-humanly let you off with a warning, not the anonymous high-techery, it responds only to its friend, the tag -- tracing, storing, mutating the whinefleshers, 0's by 1's. That's the how, maybe, but for who or what or why? Or is it just machines feeding machines incomprehensibles?

1 0

DIR_ty$
by John Young 17 Dec '03

17 Dec '03

10-30-95. In slave to Orlin Crabbe's "The Money Laundromat," The NYPaper has a Page One lead story: "Cali Drug Cartel Using U.S. Business to Launder Cash. 105 Firms Suspected. Trade Related Schemes Said to Have Moved $3 Billion Through Companies." DIR_ty$

1 0

Meeting: Nov. 4 in Austin, TX
by Jim Choate 17 Dec '03

17 Dec '03

Hi, A reminder to those in the central Texas area on Saturday (Nov. 4, 1995) from 6-8pm. The Austin chapter will be meeting at Ted's Greek Restaraunt on the 400 block of Congress (next to Oscar Snowden's). We will be trying to wrest control of the last couple of tables in the rear. Issues we will be discussing: * Further interests of the members and forming working groups. * Make further arrangements to start doing PGP key signing services at the end of the monthly EFF meeting. * Discuss doing a 1-hour video on the basic ideas and issues of cryptography and current society. * Invitation from CT-LUG to come to their next build-up which is scheduled for Nov. 18 but is tentative for now. If all works well this may be an opportunity to play with some re-mailer software under Linux. Hope to see some of you there! Jim Choate ravage(a)einstein.ssz.com

1 0

whose watchin the watchers
by Stephen Whitaker 17 Dec '03

17 Dec '03

The following is an exerpt is from Jim Warren's listserv, GovAccess 183. Are there folks on this list who have insights or definitive information on this topic? Are there ways for someone with access to modify router tables to constantly create alternate paths at other routers which would serve to end-around any such snoops? ***********begin_included_text************************* &&&&&&&&&&&&&&&&&&&& Is Someone Already Watching All International Net Traffic? The following is the transcript of an actual communications trace that a friend ran, while I was sitting next to him, watching -- reprinted here with his permission. He did a "traceroute" of two messages that he sent from his machine in Switzerland (he'd telneted into it while we were at a computer conference in California). Traceroute automatically reports each Internet node through which a message passes, as it proceeds from origin to destination. He did two traceroutes. The first was from Switzerland to an addressee at Netcom in San Jose, California. The second was from Switzerland to an addressee in Israel. Date: Fri, 21 Apr 95 02:54:58 +0200 From: kelvin(a)fourmilab.ch (John Walker) To: jwarren(a)well.com Subject: Traceroute > /usr2/kelvin> traceroute netcom11.netcom.com traceroute to netcom11.netcom.com (192.100.81.121), 30 hops max, 40 byte packets 1 eunet-router (193.8.230.64) 2 ms 2 ms 2 ms 2 146.228.231.1 (146.228.231.1) 326 ms 345 ms 307 ms 3 Bern5.CH.EU.NET (146.228.14.5) 447 ms 408 ms 364 ms 4 146.228.107.1 (146.228.107.1) 127 ms 37 ms 36 ms 5 Zuerich1.CH.EU.NET (146.228.10.80) 37 ms 38 ms 175 ms 6 (134.222.9.1) 65 ms 109 ms 252 ms 7 lp (134.222.35.2) 196 ms 179 ms 405 ms 8 Vienna1.VA.ALTER.NET (137.39.11.1) 191 ms 179 ms 313 ms 9 fddi.mae-east.netcom.net (192.41.177.210) 336 ms 204 ms 303 ms 10 t3-2.dc-gw4-2.netcom.net (163.179.220.181) 182 ms 251 ms 187 ms 11 t3-2.chw-il-gw1.netcom.net (163.179.220.186) 305 ms 586 ms 518 ms 12 t3-2.scl-gw1.netcom.net (163.179.220.190) 537 ms 693 ms 797 ms 13 t3-1.netcomgw.netcom.net (163.179.220.193) 698 ms 549 ms 754 ms 14 netcom11.netcom.com (192.100.81.121) 890 ms 1922 ms 1696 ms > /usr2/kelvin> traceroute jerusalem1.datasrv.co.il traceroute to jerusalem1.datasrv.co.il (192.114.21.101), 30 hops max, 40 byte packets 1 eunet-router (193.8.230.64) 2 ms 3 ms 2 ms 2 146.228.231.1 (146.228.231.1) 933 ms 853 ms 874 ms 3 Bern5.CH.EU.NET (146.228.14.5) 1040 ms 450 ms 525 ms 4 146.228.107.1 (146.228.107.1) 453 ms 424 ms 188 ms 5 Zuerich1.CH.EU.NET (146.228.10.80) 64 ms 61 ms 47 ms 6 (134.222.9.1) 80 ms 312 ms 84 ms 7 lp (134.222.35.2) 270 ms 400 ms 216 ms 8 Vienna2.VA.ALTER.NET (137.39.11.2) 660 ms 1509 ms 886 ms 9 dataserv-gw.ALTER.NET (137.39.155.38) 1829 ms 1094 ms 1306 ms 10 orion.datasrv.co.il (192.114.20.22) 1756 ms 1280 ms 1309 ms 11 ... Notice that both messages went through an unnamed site -- 134.222.9.1 and then a strangely-named site, "lp (134.222.35.2)" -- then through the same Vienna, Virginia (USA) site ... and thereafter, on to their destination. I.e., the second message went through Virginia to get from Switzerland to Israel. The whois servers at the InterNIC and at nic.ddn.mil for MILNET Information report, ``No match for "134.222.9.1". '' and `` No match for "134.222.35.2".'' Now let me see ... which spy agencies are located in or near Virginia? --jim &&&&&&&&&&&&&&&&&&&& ***********end_included_text*************************

1 0

Re: Escrow system design query
by geeman＠best.com 17 Dec '03

17 Dec '03

There is no one "key escrow backbone network" There's a link on my page @ www.best.com/~geeman to the Key Recovery Demostration Program, and the infrastructure study task group ... have a look there at what's going on. At 08:03 PM 9/14/97 -0400, Michael Wilson wrote: > >Does anyone know of a solid document out there in the web that actually >describes the proposed key escrow backbone network? After wading through >considerable junk in the search engines (my, but the net is wordy on the >topic), I didn't turn up anything that looked like architecture. >MW > > >

1 0

e$: The Movie
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Announcing e$: The Movie 11/6/95 Almost a year ago, I noticed that traffic was tapering off on one of the digital commerce e-mail lists I'm subscribed to, www-buyinfo, which is run by Dave Kristol at ATT. So, every once in a while, I started zinging relevant crossposts over there from cypherpunks, a famous crypto list with about 20-25% e$ content. I started getting actual fan mail for this, so I kept doing it. Now, it seems that, say, 85% of all of the traffic on www-buyinfo is my cross-posting from cypherpunks. Dave says there are 500-600 people worldwide who have stayed on www-buyinfo during all this time, so it seems like I can claim at least some of them as an audience for what I'm doing, with no promotion of the list at all, except word of mouth. We've even had several discussions on the list about whether I should continue doing it, and every time we've done so, the answer has been a resounding "yes". However, www-buyinfo does have a charter, and even though what I'm doing drifts the charter substantially, I'm restricted in what I can put there. It's not fair to Dave or the subscribers for me to turn their list into my private spam channel. Also, Dave has said repeatedly that he's interested in re-tooling www-buyinfo into something more technical, so, at some point, the party's going to be over, and we'll have to pack up our tents and move on. Meanwhile, I've also taken to writing on the net, and more recently, speaking to professional groups, on the topic of e$, and I have gotten very good response to that as well. An edited version of one of my longer net.rants is in this week's InfoWorld, for instance. That one got me fan mail from all sorts of people (like Guy Kawasaki, Stewart Alsop, and Adam Engst, for instance) when the original version appeared first in the apple-internet-users list a while back. I've managed to have a lot of fun with this stuff. One of my suggestions on cypherpunks started ecm, the secondary market for Digicash's beta-test digital cash certificates. I had so much fun talking about digital commerce with Peter Cassidy, a freelance writer for Forbes ASAP, Wired, and the Economist, that the two of us started the Boston Society for Digital Commerce, a luncheon group that meets once a month to talk about this stuff. BSDC has about 40 members now, and our second meeting is on Tuesday. So, I've decided I'd jump into this with both feet. A friend of mine at Apple Computer, Vinnie Moscaritolo, has volunteered his time to put up a web site about e$. It's pretty much live, though still under construction, at its temporary home of http://www.webstuff.apple.com/~vinnie/rah/ . Vinnie is now in the process of hooking up a small stand-alone machine, to live somewhere else on the net besides in Apple's domain, which will house this web-site along with three mailing lists, all of which will be archived and eventually web-searchable. Over the next few weeks, we'll be starting up these lists and announcing them here. They are: * _e$_: A discussion list on digital commerce and financial cryptography and their consequences. This list will be for people who have a strong understanding of markets of all kinds, who understand the consequences of strong cryptography and digital certificate technology on public networks, and who want to make money in this environment. We welcome Entrepreneurs, Analysts, Cryptographers (Amateur and Otherwise), Free Marketeers, small-"l" libertarians, and, even (horrors!) a crypto-anarchist or two. * _e$pam_: My personal spam-channel to the universe. ;-). Pretty much what I do now with www-buyinfo from cypherpunks, only with all the net.sources I can find. It will have the same content touchstone as e$ will, but it will consist entirely of filtered information from secondary sources. In other words, it won't say "e$spam" until I say it says "e$spam". At some point, e$spam will have filter-fodder in it -- or some other method will be set up -- so that people who are already subscribed to one of the lists I'm filtering won't have to see things twice. We're still working on that. * _Ne$ws_, a newsletter with original content from myself and various other authors, in the same vein as Adam Engst's TidBITS, but focused on the subject of e$. I figure that there are enough different ways to pay for both my time and the resources necessary to make this work that it's now worth spending a little of my own time and resources in order to get all this started. Certainly the market for information and commentary on e$ isn't getting any smaller. I'm looking at a sort of "creep, crawl, walk, run" scenario for funding all of this. The first stage will be to solicit sponsorships, both in-kind and in plain old money. The second will probably be to determine whether subscriptions to any or all of the e$ lists or archives would ever make sense. Finally, with the advent of real digital cash on the net, and with First Virtual proving e$ trades can be done by anyone, it may be possible to do some kind of e$ micropayment-as-you-go system for things like subscriptions, web-archive access, and the like, so I'm looking at that also. Obviously, I'm don't want to price myself out of the market with all of this, because, like anything else on the net, anyone can come along and do exactly the same thing for less money, and then I'm out of business. I do think, however, that what I propose to do is worth money to the people who want it, and so I'm going to figure out how to get paid to do it. Well, that's about it. Watch this space for details, and wish me luck! Cheers, Bob Hettinga, impre$ario-to-be -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJ04K/gyLN8bw6ZVAQG+2QQAowzLfmH5paNaZgrAdlEeSH9YcKysW07A B7QxbQhP9WIat2rMIA4HoIioQr+Xo5RZ3oOO+btSksHNnV1P3Q2Ca49BJxdMsQd7 GhdGoUv2/C150mH13crc3cZuOCChfisjYHM8So2XsuVjKex4ETZecDLfSn+b4yzl mtfJvZQ3e1o= =2vLb -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

FC98 Call for Participants
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- C A L L F O R P A R T I C I P A N T S Financial Cryptography 1998 (FC98): The world's only financial cryptography conference, exhibition, and workshop. FC98 Conference February 23-26, 1998 FC98 Exhibition February 23-27, 1998 FC98 Financial Cryptography Workshop March 2-6, 1998 The Inter-Island Hotel Anguilla, BWI Conference Reservations: <http://www.fc98.ai/> FC98 is currently sponsored by: - --------------------- Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com> Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> C2NET <http://www.c2.net> If your firm would like to sponsor FC98, please see below, and contact Julie Rackliffe, the sponsorship manager, at <mailto: rackliffe(a)tcm.org> for further information. What is FC98? - ------------- FC98, the world's only peer-reviewed conference on financial cryptography, will be held Monday through Thursday, February 23-26, 1997, at the Inter-Island Hotel on the Caribbean island of Anguilla. In conjunction with the conference, the Inter-Island Hotel will also be the site of an intensive 40-hour workshop for senior managers and IS professionals the week after the conference (March 2-6), and a concurrent exhibition of financial cryptography products and services during the entire week of the conference itself, February 23-27. The goals of the combined conference, workshop, and exhibition are: - -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, - -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, and, - -- to showcase the newest products in financial cryptography. In addition, time has been reserved in the afternoon and evening for sponsored corporate presentations, functions and activities, and for business networking. Conference participants are encouraged to bring their families. The Conference - -------------- Ray Hirschfeld, the conference chair, has picked an outstanding group of professionals and researchers in financial cryptography and in related fields to review the papers for this conference. They are: Chair: Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Co-Chair: Matthew Franklin, AT&T Laboratories--Research, Florham Park, NJ, USA Matt Blaze, AT&T Laboratories--Research, Florham Park, NJ, USA Antoon Bosselaers, Katholieke Universiteit Leuven, Leuven, Belgium Yves Carlier, Bank for International Settlements, Basel, Switzerland Walter Effross, Washington College of Law, American U., Washington DC, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Alain Mayer, Bell Laboratories/Lucent Technologies, Murray Hill, NJ, USA Moni Naor, Weizmann Institute of Science, Rehovot, Israel Frank Trotter, Mark Twain Ecash/Mercantile Bank, St. Louis, MO, USA Doug Tygar, Carnegie Mellon University, Pittsburgh, PA, USA Moti Yung, CertCo LLC (formerly: Bankers Trust E-Commerce), New York, NY, USA The actual agenda of the conference will be determined by the papers the program committee selects. The conference committee is selecting papers in what it considers the union, rather than a strict intersection, of the fields of finance and cryptography. For last year's program please see <http://www.offshore.com.ai/fc97/>. Original papers are being solicited on all aspects of financial data security and digital commerce in general, including: Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Proceedings of Financial Cryptography 1998 will be published by Springer Verlag in their Lecture Notes in Computer Science (LNCS) series. For further information on the submission process, please see the program committee's web-page at <http://www.cwi.nl/conferences/FC98>. Last year, the conference was been covered by The New York Times, Institutional Investor, the Financial Times, Wired Magazine, NHK Japan, and other media. In addition, financial cryptograpy and several of last year's conference participants and sponsors were the subject of a cover story in a September issue of Forbes Magazine. If last year's interest in this conference is any indication, it is probably a good idea to register for FC98 and make your plane and hotel reservations as soon as possible, as conference, workshop, and exhibit space is extremely limited, and we anticipate selling out all three events. The price of a pass to the conference sessions and exhibits is US$1,000, with discounted rates for full-time academics and students of $250 and $100 respectively. You can pay for your FC98 conference ticket with Visa or MasterCard, or any of a number of other internet commerce payment protocols, at the regstration site, <http://www.fc98.ai/>. The price includes breakfast and lunch. Internet connectivity will also be provided at the conference site. The Exhibition - -------------- The FC98 Exhibition is an exclusive trade show for financial cryptography products and services. The trade show floor will be open from 9:00 am to 5 pm the entire week of the conference Monday through Friday, February 23-27. In addition, the conference facility will be open for commercial presentations and demonstrations in the afternoons Tuesday through Thursday, and all day on Friday. Each booth will have high bandwidth access to the internet, and will get 3 conference passes. Booth prices start at $5,000 US. Please contact Julie Rackliffe at <mailto:rackliffe@tcm.org> for further information. As space is limited, please reserve your space as soon as possible. The Workshop - ------------ We are again honored to have Ian Goldberg as the leader of the FC98 Financial Cryptography Workshop, which will run one week after the conference, March 2-6, 1998. Ian, the cryptographer at Berkeley who is now famous (in articles in the Wall Street Journal, the New York Times, and Forbes) for breaking several financial cryptography transaction protocols, will be running an intensive, 5-day workshop for senior managers and technology professionals. While the workshop is still being developed, and will depend on the skills of the planned participants, Workshop topics will include, but not be limited to: Overview and background of cryptography Survey of existing and proposed Internet payment systems Details on some specific payment systems Issues involved in setting up a secure Internet site A step-by-step walkthrough of setting up a digital bearer certificate mint. Ian has recruited a strong roster of instructors with credentials similar to his own, and, as he plans to maintain a 5-1 student/teacher ratio, the size of the Workshop will be restricted and advance registration will be required. Further information about the Workshop can be found at: <http://www.cs.berkeley.edu/~iang/fc98/workshop.html> The planned price for the workshop is $5,000. This covers lab space, hardware, network access, software, meals, and, of course, 40 hours of instruction and structured lab activity. The lab itself will be open 24 hours a day. Sponsorship Opportunities - ------------------------- FC98 offers sponsorship opportunities at all levels. Businesses are encouraged to be an exclusive sponsor for lunch or dinner in conjunction with a networking/recreational activity of some kind. Sponsorship provides corporations with a unique opportunity to get their message heard by the best people in the field of financial cryptography, and to gain unprecedented exposure for their business. Sponsorships start at $10,000, and include one booth, discounts on additional booth space, 5 conference passes, mention of your company in all FC98 communications (like this one), and a sponsored lunch or dinner and networking/recreational activity for the conference participants. In-kind sponsorship is also available, with opportunities for companies to provide networking, bandwidth, software, hardware, radio packet modems and equipment, as well as web-design and print services, and transportation. The sponsorship contact is Julie Rackliffe <mailto: rackliffe(a)tcm.org>. Air Transportation and Hotels - ----------------------------- Air travel to Anguilla is typically done via San Juan, Puerto Rico, or St. Maarten. There are several non-stop flights a day from various US and European locations to St. Maarten. Connection through to Anguilla can be made through American Eagle, or through LIAT, not to mention a short, inexpensive ferry service from St. Martin to Anguilla. See your travel agent for details. American Eagle Airlines has agreed to increase their flights as needed to accomodate any extra traffic the conference brings to the island. There is also discussion of a "crypto-plane" charter making a transcontinental run from San Jose to St. Maarten by way of Las Vegas, Minneapolis, and JFK/New York. We're still working on it. Let Robert Hettinga <mailto: rah(a)shipwright.com> know if you're interested in this idea. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties on the things you bring. Hotels range from spartan to luxurious, and more information about hotels on Anquilla can be obtained from your travel agent, or at <http://www.fc98.ai/>. Registration for FC98 - --------------------- Again, to register and pay for your ticket to FC98 see: <http://www.fc98.ai/> For information the selection of papers for FC98 see: <http://www.cwi.nl/conferences/FC98> If you're interested in exhibit space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC98, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in the FC98 Workshop for Senior Managers and IS Professionals, see: <http://www.cs.berkeley.edu/~iang/fc98/workshop.html> See you in Anguilla! The FC98 Organizing Committee - ----------------------------- Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld and Matt Franklin, Program Chair and Co-Chair Ian Goldberg, Workshop Director Lynwood Bell, Exhibition Steering Committee Chair Julie Rackliffe, Exhibition and Sponsorship Manager FC98 Sponsors - ------------- Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com> Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> C2NET <http://www.c2.net> See Your Name Here: <mailto: rackliffe(a)tcm.org> -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNCGBf8UCGwxmWcHhAQEoYgf/eP6QCIlmcMWQBYTu5i55frK/rsCTNDlX ipirMoHRHDmFdvJaGaxST6t5VebImTnArLJ3he+52aBNqVaq+v+kUSKS50ebe0G6 fN27/LpIqiGCFgswnjW7AcHAfosJTSRWhdZHvUVCgMi22gq2GVkQD6tPCK/1TueI +t4XAax1IOr1IlKpJkTA6XxUUTt8zn/byzS2IMQAhERFaSeqH1ngTrX0xottMRS0 7dKQ2aL/IHbcYRFad3thLFlzWCz4CwO9YsX94gc5kLkxdenZWMv+k+FsynIJPdRB S1+dtqiGIdfiehp3cxptD1H1QCPqvygS88pXGb5Q6zTs8y634vzjoA== =K3Bb -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: whose watchin the watchers -- I GOT THE EXPLANATIONS OKAY
by jwarren＠well.com 17 Dec '03

17 Dec '03

At 04:19 PM 11/05/95, Stephen Whitaker wrote: >The following is an exerpt is from Jim Warren's listserv, GovAccess 183. > >Are there folks on this list who have insights or definitive information on >this topic? > >Are there ways for someone with access to modify router tables to constantly >create alternate paths at other routers which would serve to end-around any >such snoops? > >***********begin_included_text************************* > >&&&&&&&&&&&&&&&&&&&& > > >Is Someone Already Watching All International Net Traffic? > >The following is the transcript of an actual communications trace that a >friend ran, while I was sitting next to him, watching -- reprinted here >with his permission. > >He did a "traceroute" of two messages that he sent from his machine in >Switzerland ... Folks, I've received ample explanations/corrections to my naive paranoia. The following will be posted in GovAccess.184, within an hour or two. Many thanks. --blushing-jim Jim Warren, GovAccess list-owner/editor (jwarren(a)well.com) Advocate & columnist, MicroTimes, Government Technology, BoardWatch, etc. 345 Swett Rd., Woodside CA 94062; voice/415-851-7075; fax/<# upon request> [puffery: John Dvorak Lifetime Achievement Award (1995); James Madison Freedom-of-Information Award, Soc. of Professional Journalists - Nor.Cal. (1994); Hugh Hefner First-Amendment Award, Playboy Foundation (1994); Pioneer Award, Electronic Frontier Foundation (its first year, 1992); founded the Computers, Freedom & Privacy confs, InfoWorld; blah blah blah :-).] === EXPLANATION OF WHAT GOVACCESS IS & WHERE TO FIND ITS ARCHIVES === GovAccess is a list distributing irregular info & advocacy regarding technology and civil liberties, citizen access to government - and government access to citizens, covert and overt. To add or drop GovAccess, email to Majordomo(a)well.com ('Subject' ignored) with message: [un]subscribe GovAccess YourEmailAddress (insert your eaddr) For brief description of GovAccess, send the message: info GovAccess ===this will be posted in GovAccess.184=== Enlightenment Regarding European Net Traffic Flowing Through Numbered Sites If I'm gonna let my net-surveillance paranoias burn brightly, I better learn more about the technology. Which is to say, I goofed: In #183, yesterday eve, I flamed forth about how a friend traced his messages from Switzerland to San Jose CA and to Israel -- and discovered that they "went through an unnamed site -- 134.222.9.1 and then a strangely-named site, "lp (134.222.35.2)" -- then through the same Vienna, Virginia (USA) site ... and thereafter, on to their destination." With beady eye and suspicious mind, I then entoned, "Now let me see ... which spy agencies are located in or near Virginia?" Well, half a dozen net-*literate* technoids quickly corrected the errors of my ways: >Date: Sun, 5 Nov 1995 08:25:17 +0100 >Subject: GA183 booboo >To: jwarren(a)well.com >From: nobody(a)REPLAY.COM (Anonymous) [apparently an anonymous remailer --jim] >Organization: RePLaY aND CoMPaNY UnLimited >XComm: Replay may or may not approve of the content of this posting >XComm: Report misuse of this automated service to <postmaster(a)REPLAY.COM> > >Jim-- > Great work, but you've got to be more careful. ... > >I ran it by Cypherpunks and, within a half-hour, got ... [among others] ... > >From: Richard Huddleston <reh(a)wam.umd.edu> >Date: Sun, 5 Nov 1995 01:55:09 -0500 >To: cypherpunks(a)toad.com, nobody(a)REPLAY.COM >Subject: Re: lp (134.222.35.2)? >Sender: owner-cypherpunks(a)toad.com > >134.222.0.0 is a Class B network, so if you do 'whois' on 134.222.0.0 >(instead of the individual IP addresses) you find: > >European Unix Users Group (NET-EUNET-X25) > Kruislaan 413 > NL-1098 SJ Amsterdam > NETHERLANDS >... and >X-Pgp-Fingerprint: 01107BAB1C85F1B49358D98FEAD4339E >Date: Sat, 4 Nov 1995 23:01:42 -0800 >To: cypherpunks(a)toad.com >From: Stephan Somogyi <somogyi(a)digmedia.com> >... >>> Now let me see ... which spy agencies are located in or near Virginia? > >Oh please. > >The probable reason that the InterNIC doesn't know about the >132.222.0.0 networks is because they're in Europe. If you search for >either of the network numbers of the IP addresses mentioned above in >the RIPE database <http://www.ripe.net/>, you will find that they >belong to the EUnet backbone. > >After pinging 134.222.9.1 successfully, I telnetted to it and it >claimed, quite plausibly, that it's a device (presumably a router) in >Amsterdam. I am currently unable to ping 134.222.35.2; this, however, >fills me with no dread whatsoever. > >Stephan Somogyi Senior Editor Digital Media and >Date: Sun, 05 Nov 1995 13:42:55 -0800 >From: John Fricker <jfricker(a)vertexgrp.com> >Subject: Return of Paranoia and Vienna > >Using nslookup to reverse resolve 134.222.15.2 reveals it to be >"Oslo1.NO.EU.net" and 134.222.9.1 to be "Amsterdam4.NL.EU.net". > >Now this doesn't mean they are not nefarious, packet sniffing spy-boxes >since I doubt the spooks would name their routers >"cloak-and-dagger1.cia.gov". > >It still is strange that it is cheaper for UUnet/EUnet to route traffic >across the Atlantic to get to Isreal instead of developping a continental >backbone. In many ways the architecture of the Internet is still rather >primitive. > >john fricker >dir research and development >The Vertex Group, Inc. followed by >Date: Sun, 05 Nov 1995 13:23:06 -0800 >From: John Fricker <jfricker(a)vertexgrp.com> >Subject: Paranoia and Vienna > >Now, Jim I think you're a touch paranoid here. And after reading the >latest about the FBI wire tap bill I don't blame you ;) > >134.222.0.0 is in the EU domain so most likely both of those routers are >European. The packets then went into UU Net Technologies Vienna hub. I did >a traceroute from me to 193.8.230.64 and went through two EU.net routers >in Vienna, VA. Vienna must be one fiberous town! Sure would make for a >nice little listening post for nosy ears. I don't know off hand the >relationship between EUnet and UUnet but I would guess that they are more >than just friendly. Microsoft bought a minority interest in UUnet which >inspired UUnet to grow rapidly. (Now there's another tidbit for paranoia!) === Oh ... sez I <blusing>. So the remaining question was -- why would a msg from Switzerland go through Alternet in Virginia on its way to Israel? I asked several of the [many] folks who enlightened me re the numbered sites, and within minutes, got back: >From: Tim Pozar <pozar(a)kumr.lns.com> >Date: Sun, 5 Nov 1995 11:28:44 -0800 (PST) > >... >> So the only remaining question is ... why should a Swizz msg go thru >> Alternet in Virginia in order to get to Israel? > >A number of links go through there. Most of this is tied up with >politics and policies with the links that go over to Europe and >little to do with the NSA. ... Which leaves me without any inflamatory paranoia at all ... except to wonder about those "politics and policies" that cause traffic from and to European sites to flow through a site near the NSA and CIA. === To which, I just received this additional response -- email traffic's hot 'n' heavy (sender prefers to be anon :-): Almost certainly just a matter of available capacity or administrative issues. There may be higher bandwidth routes available from both of those points to the U.S., rather than directly to each other, so the traffic is routed that way. There are often administrative issues too--that is, sometimes the direct routes are controlled by some company or group to which a different net doesn't subscribe, and they have to route differently, through entities that they both subscribe to or have agreements with (e.g. Alternet). This happens a bunch in Europe (and here for that matter--it's part of the reason that some traffic from L.A. to S.F. used to route through Atlanta or NY or similar places--and still can (depending on the service providers). The topology of the net is "logically" sensible, but not necessarily geographically so... --spooky jim, who can't tell a carburator from a crankshaft, net-wise &&&&&&&&&&&&&&&&&&&& Net Police, Take Note: Net is the Fastest Self-Correcting Human System I Know On the upside of the above notes is that they [again] illustrate how quickly the net corrects erroneous postings -- which is my answer to all those who howl for censorship or content-control of the net, "because it distributes incorrect information." It does -- but it also distributes, uh, "vigorous" corrections to any iota of intended or naive imperfection in a posting, at least to the extent that such postings receive significant circulation on the net. (And if they don't, then they are little different than the erroneous information that people exchange by voice and phone, every day.) And woe be unto the reputation of anyone who appears to have posted *intentionally* incorrect or biased-incomplete information -- who get vigorously torched in the process of getting corrected. :-) I think it was John Perry Barlow who observed that, the best way to get a question answered on the net, was to post it in the form of an erroneous statement. --jim

1 0

Re: lp (134.222.35.2)?
by wiltship＠iccu6.ipswich.gil.com.au 17 Dec '03

17 Dec '03

> >Anonymous writes: >> > Notice that both messages went through an unnamed site -- 134.222.9.1 and >> > then a strangely-named site, "lp (134.222.35.2)" >[...] >> > Now let me see ... which spy agencies are located in or near Virginia? > A hopcheck from here puts these sites in amsterdam nl. cheers peter Flight to Quality Wiltshire Productions Pty Ltd Brisbane, Queensland, Australia Intl Voice 61 7 3376 3535 Intl Fax 61 7 3279 4027 Email wiltship(a)gil.com.au PGP Key ID 3E584C7D PGP Fingerprint 01 03 FB F4 BE F8 2B F3 5D 84 6B 69 37 80 FE 10

1 0

"The Life And Times Of One Average Man"
by D.S.McLean 17 Dec '03

17 Dec '03

Dear Friend : I appreciate your taking the time to look at what I have to offer. This mail message is for the sole purpose of showing people how I can can help them; NOT with money, fame, or building their front deck. I am an average person like many of you, I have no special powers and I don`t claim to have the answers for some of the more philosophical riddles of life. I will be straight forward and quite frank with you. I have written a book about many issues people face when they have experienced some sort of tragedy in their lives. I offer the reader to see and share in the experiences that I myself faced as both a young man and an adult. For me life began as it would for many other children growing up in what seemed to be the innocent world we live in. I had a wonderful family with loving parents as well as an older brother and two older sisters who loved to torture me. As time grew on my wonderful family began showing signs of trouble. It was not long before I encountered a life shattering injury that change my life, as well as the lives of those around me forever. In this autobiography and self-help book I will bring you down the road of my experiences; share with you the decisions I chose to make and how I was fortunate enough to overcome certain issues such as drug and alcool abuse, as well as provide you with solutions to common problems a family faces when confronted with separation and divorce. Most importantly I will share with you the heart ache and pain of a cataclysmic event faced on a construction job sight when I was confronted with a FIFTEEN TON front end loader and lost the battle. In this book are common problems associated with a tragedy such as personal injury as well as personal and proffesional opinions on ways to deal with and overcome the aftemath of these circumstances. If you are interested in helping yourself or helping a friend overcome the hardships life can offer and would like to attain a copy of my book please feel free to visit my sight at : http://www.mnsi.net/~ranger90/index.htm - Just copy and paste that URL in the address bar of your browser and hit return, or type it in manually. Also see how you will receive your copy of my book twice as fast as the other shipping companies ! Again, thatnk you for taking the time to read what I have to offer, and feel free to visit at : http://www.mnsi.net/~ranger90/index.htm Sincerely, D.S.McLean, contact me for more information at: ranger90(a)mnsi.net

1 0

whose watchin Cypherpunks: nym question
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Stephen Whitaker-nym's resubmission ("whose watchin the watchers" 4:19 PM 11/5/95) of the very same material that I had posted last night suggest some questions about some aspects of nym theory. I hope the following isn't too naive, and I apologize if it is. When I saw issue 183 of GovAccess, Jim Warren-nym's remarks seemed suspect, but I didn't have a thorough enough understanding of the issues to judge them myself -- so I decided to vet the question with the Cypherpunks. I'm glad I did: the quick and knowledgeable responses clarified the error, and I forwarded them to Warren-nym so that he could correct himself promptly. The end result, as Warren rightly suggests I think, is that a better understanding of the issues has been propagated to his subscriber base. AFAIK, Warren-nym has an excellent reputation -- and that fact certainly encouraged me to provide him with the info he would need to correct himself quickly. OTOH, my actions garner no reputation for me -- neither for my True Name nor for nobody(a)REPLAY.COM. Of course, whether such actions merit any reputational shift is debatable: I contributed no knowledge of my own, just merely acted as a go-between. Still, the fact that GovAccess 184 quotes my response might suggest that I beat others to the punch; and were I able to act in such a capacity on a regular and consistent basis, and were I to do so in a field with higher stakes, I would surely garner a reputation. Granted, this is a lot of "woulda, coulda" -- but it leads me to conclude that it is not the shortcomings of my *action* that are the cause of the fact that I garner no reputational improvement in this instance. Stephen Whitaker-nym's resubmission of this material, OTOH, lowers his reputation in my eyes -- which is strange, because the only real distinction between what he did and what I did has to do with the fact that he sent mail to Cypherpunks without reading the Cypherpunks traffic. So his reputational shift is purely contextual. So why don't I, then? Well, for starters, the nym that the Replay remailer assigned to me is publicly accessible: anyone who uses this remailer in the way that I did will be assigned the same quasi-nym, nobody(a)REPLAY.COM. yet if, through some statistical improbability, I were the *only* person *ever* to use this remailer in this way, and I *only* ever used it to perform actions that would improve the reputation of a stable nym, then the public knowledge of Replay's functionality would neverthless serve to hinder any reputational shift that my actions had earned: people might say, "Every message I know of that has passed through Replay has been accurate, timely, and significant" -- but that would improve the reputation of the Replay remailer rather than of its sole user, myself, even though it was my actions -- *including* the use of the Replay remailer -- that brought about this reputational shift. So what is a nym if not a "True Name"? I distinguish "True Name" (in quotes) from True Name: a True Name is tied to a matrix of information extrinsic to the entity it refers to (a SS# has no *intrinsic* relation to the entity it designates), whereas a "True Name", though free of this info matrix, neverthless operates according to the same logic that a True Name does -- in terms of being tied to actions that garner reputational shifts. The point being -- I'm probably being pretty unclear -- that if the major distinction between a "True Name" and a True Name are links (or the lack thereof) to arbitary and external information (and maybe the disposability that the lack of links implies), then a lot of nym theory seems like it pretty much reproduces True Name logic and operations. Anyway, a lot of you understand this all better than I do, so I hope to learn from any responses I receive. Thanks.

1 0

Re: 800_ape
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:23 AM 11/4/95 -0500, you wrote: > 11-5-95. NYPaper Sunday Magazine: > > "Making Microsoft Safe For Capitalism. How do you restrain > an 800-pound gorilla?" Cover story. By James Gleick. > It's time to draw the line. But where? > > 'Anything not a direct lie or clearly illegal is O.K. to > do if it advances Microsoft's tribal cause,' Mitchell > Kapor says. 'This licenses the worst sort of > manipulations, lies, tortured self-justification and so > on.' So Gleick wants to unleash the Justice Department to protect his ISP from Microsoft's competition. Can't cut it without Big Brother's help, eh? All I've got to say about this piece of commie trash is GM, ATT, IBM, USSR, CIA, & KGB. It took me all of 10 seconds to figure out how to delete the icons for the MSN and MS' Internet Browser from my WIN95 desktop. The help message that popped up when I did this also told me how I could delete the actual programs from my hard drive. (Hint James try clicking the *right* mouse button.) DCF "Worrying about a large institution especially when it has computers is like worrying about a large gorilla especially when it's on fire." Bruce Serling. CFP95.

1 0

New Computer Security Act
by John Young 17 Dec '03

17 Dec '03

The Computer Security Enhancement Act of 1997 (HR1903) is intended to replace the Computer Security Act of 1987. It redefines the role of NIST in meeting federal computer security and encryption requirements through cooperation of industry. Public use of encryption is also addressed in the bill. Two lengthy reports on the bill have been issued recently, both of which provide overviews of the current encryption debate. House Report 105-243, published on September 3, provides a detailed analysis of the bill, hearings held, floor remarks and mark-ups since introduction: http://jya.com/hr105-243.txt (115K) And one published today includes recent floor remarks on encryption, mostly supportive of public use: http://jya.com/hr1903-floor.htm (44K) One point of contention is the evaluation of foreign encryption. The original bill put that responsibility on NIST, but the latest version deleted that and leaves the task to BXA (and unnamed others). Moreover, there's dispute over committee jurisdiction for other provisions. Information security now attracts the swarm, with encryption the moths' beacon.

8 9

Re: "The Policeman Inside"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:54 AM 11/5/95 -0800, you wrote: >My point, originally, to Rich Graves' mention of Chris Hibbert's excellent >FAQ on Social Security Numbers and person numbers, is that it is no longer >relevant to fight against a "single index number." Modern data base methods >are so well-suited to cross-indexing that it hardly matters whether there's >a single point of entry to the data base or not. However, modern life is also well-adapted to the counter strategy of fuzzying up any focus on your "cluster of transactions." Thus it is trivial to use multiple names and addresses for multiple transactions. Particularly if you "go bare" in the insurance arena, many tracking opportunities are denied your opponents. This will also save you big bucks in premiums foregone. You also have to watch the stuff most people don't think about like magazine subscriptions which can easily be had in any name (and should be). The current possibility of getting multiple secured credit cards in multiple names will become even more fun as the temporary Visa and Mastercards (travelers's checks on a card) are issued. Plenty of entrepreneurs will be buying and selling those. Just like the phone card market today. >THE KEY POINT IS THIS: Are voluntary economic transactions between persons >to be subject to approval and regulation by the State? They will no doubt try but closed systems have a hard time competing with open systems. A good way to track the future control possibilities is to track how easy it is to get an internet account. If it remains as easy to get an internet account in the future as it does today, then it will be very hard to indulge in central transaction controls. I am predicting that there will be a convergence between the ease of communicating over the nets (institutional ease not interface ease) and the ease of completing transactions. I think the convergence will be one sided in the direction of easier and easier transactions. Again, I'm not talking about technical ease here but the structural or institutional ease of completing transactions. "Frictionless Capitalism" is frictionless across the board. The belief that it is possible to "press down upon the brow of labor this Crown of Thorns, to crucify mankind upon a Cross of Red Tape" (to mangle a phrase) is worthy of ridicule. I happened to catch "Funeral in Berlin" today. The Commies didn't manage it with a lot more going for them than Slick Willie has. They got their clocks cleaned by MarketEarth. The Securities and Exchange Commission doesn't stand a chance. >If babysitting and >lawnmowing, not to mention hiring someone to write some C code, requires >submitting tax and Social Security forms, requires checking the J-1 vs. >Permanent Resident vs. Approved Citizen Unit status, then the die is cast. I thought the guy was in Zamboanga (where the monkeys have no tails). At least that's what he told me in his email. The gardener was an independent contractor. The babysitter worked for a temp agency (at least that's what she said). I know I paid a company. At least the digicash went to something with a company name. >Well, the State is becoming more efficient in tracking such things, and tax >penalties are increasing. Not sure if that's true. Are there fewer illegal aliens, fewer people driving without licenses, fewer people practicing medicine without a license, etc than in 1960, 1970, 1980? I seriously doubt it. >In closing, we must beware "the policeman inside," to use the William >Burroughs term. A surveillance state that arises because modern computers >and data bases allow all economic transactions to be monitored, taxed, and >approved or disapproved is a horror we should fight with all of our >resources. Whether right-, left-, or libertarian-leaning, the implications >of this state power to control our lives are horrible. No argument there. DCF "Freedom isn't Freeh freedom isn't Freeh you've got to pay the price you've got to sacrifice for your liberty" -- Here's hoping you're all morally rearmed.

1 0

IPO ALERT: Radcom Ltd. Available through Wit Capital
by dustin＠witcapital.com 17 Dec '03

17 Dec '03

Wit Capital Corporation is pleased to announce that we are able to provide first-come first-serve participation in the following initial public offering as described below: Issuer: Radcom Ltd., which develops, manufactures, markets and supports internetworking test and analysis equipment for data communications networks. Security: Ordinary Shares Expected Size of Offering: 2,250,000 shares Expected Price Range: $7.50 to $9.50 Lead Underwriter: Unterberg Harris If you think you may be interested in this Initial Public Offering available through Wit Capital, please visit http://www.witcapital.com or call (888) 4wit-cap. You can view, print or download the Preliminary Prospectus from the New Issues Section of our website. To purchase shares, you must first open an account, which you can do online. Investing in public offerings is speculative and may not be appropriate for every investor. As with all of your investments with Wit Capital, you must make your own determination of whether an investment in this offering is consistent with your investment objectives and risk tolerance. To learn more about the risks of investing in initial public offerings please visit the New Issues Section of our website. A REGISTRATION STATEMENT RELATING TO THESE SECURITIES HAS BEEN FILED WITH THE SECURITIES AND EXCHANGE COMMISSION BUT HAS NOT YET BECOME EFFECTIVE. THESE SECURITIES MAY NOT BE SOLD NOR MAY OFFERS TO BUY BE ACCEPTED PRIOR TO THE TIME THE REGISTRATION STATEMENT BECOMES EFFECTIVE. THIS COMMUNICATION SHALL NOT CONSTITUTE AN OFFER TO SELL OR THE SOLICITATION OF AN OFFER TO BUY, NOR SHALL THERE BE ANY SALE OF THESE SECURITIES IN ANY JURISDICTION IN WHICH SUCH OFFER, SOLICITATION OR SALE WOULD BE UNLAWFUL PRIOR TO REGISTRATION OR QUALIFICATION UNDER THE SECURITIES LAWS OF SUCH JURISDICTION. Wit Capital Corporation Member NASD SIPC

1 0

Re: Keyed-MD5, and HTTP-NG
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 1 Nov 1995 hallam(a)w3.org wrote: > > There were two names on the MD5 document -- mine and Bill > > Simpson's. Bill didn't tell me that he was called (I suspect he > > would have), and I wasn't called, either. We were the only two > > editors of that portion of the specification. > > This appears to have been a problem from both ends. A number of > people arround here only heard about the IPsec work when it had > reached the final call phase. Hmmm, I guess (as usual) people weren't keeping up with the drafts. It really makes some of us outsiders wonder what the IETF actually does in its gilded white towers. > I think this highlights one of the problems with the IETF we need a > much broader infrastructure for understanding what progress other > groups have made. The time when we can expect to do everything through > email alone is past. I wish I could persuade more people in the IETF > that the Web infrastructure could provide a valuable assistance > as a collaboration tool for their needs. Unfortunately the approach seems > to be that because there are is a person living at the end of a 2400 > baud modem in vermont who cannot configure his PPP we should all continue > in the stone age. I guess that's certainly an _elitist_ attitude. Let's leave Vermont alone for a second and maybe talk about including the developing world in the process. That might explain some of the resistance. In many parts of the world, the basic telecommunications infrastructure simply won't support a 2400 baud connection. Does this then mean that there should be no advocate, no voice for citizens from those regions because they are limited to 300 baud? Hopefully we all agree that developing nations are equally entitled to a voice in establishing standards which will define the foundations of the next century. I can't imagine anyone arguing for a pre-emptive silencing. of voices which strive to be heard through setting technical standards as a floor -- minimum standards which are designed *purposefully* to exclude. Next thing someone will advocate is EBCDIC, or something equally lame idea, I guess ... > We could improve readability of RFCs through using HTML and reduce > the flamage on mailing lists through collaboration tools like the > open meeting. But we don't because it hasn't been done that way in the > past. Well, I think that it is possible to read a mailing list through HTML if that is what you would like to do. You have that option and choice. But this does not mean that you should dictate that everyone should follow your choices and preferences. While some would argue, that the attempted imposition of your personal preferences is demonstrative of a monstrous ego that does not recognize inherent individual jurisdiction, I won't expose myself to the accusation that I would advance such a specious argument, I will simply ask what you would suggest is the solution to including alternate views and voices, if it isn't a mailing list. Will the standards track follow a policy of inclusion or historic policies of exclusion? > I would like to see a collaboration system where I can present an expert > with the context of a proposal very rapidly without expecting them to > read the archives of an entire mailing list. It really doesn't take all that long to get up to speed. A couple of months, tops. > Phill > Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Magic Money
by EWilhem＠aol.com 17 Dec '03

17 Dec '03

Where do I get the software, Please E-mail me at roger12(a)cam.org. I'd like the evaluation software.

2 1

Crypto-law etc
by Chuck McManis 17 Dec '03

17 Dec '03

The longer I follow the crypto "debate" the more I begin to understand what must have been the real intent behind the 2nd amendment of the constitution. If the White House can get crypto code defined in the true legal sense (that is backed up by case law) as a munition, do US citizens then have a constitutional right to "bear" it? Just curious, --Chuck

3 2

on topic!!
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

PM and TCM frequently debate about what is relevant on this list. I have sometimes commented on this. in fact PM's conservative stance to relevance, and TCM's more liberal one, and the tension between the two goes back to list origins. this is a highly inflammable topic, and I am surely going to get my eyebrows toasted for saying *anything*, however I would like to say a few things: if there were two key elements here, these conversations would probably largely go away (instead of continually reappear) - an unambiguous charter - an active moderator unfortunately I suspect that a moderator does exist but he "prefers to remain anonymous" ("pseudonymous"?). imho that is precisely how *not* to succeed as a moderator. PM and TCM are indeed filling a genuine vacuum. when the moderator is AWOL, pseudomoderators fight each other. (oops, the whole idea of a moderator is just not anarchic enough. well, then I suggest everyone just enjoy these repeated, endless displays of public bile and hostility as the basic modus operandii of people who embrace the glory of anarchy. anarchy in action!! but it is more fun to deny them as total delusions and effects entirely attributable to one's enemies..) -- also, another frequent split on this list is of politics vs. coding. frankly I think just having two lists, one dedicated to "cypherpunk politics", the other dedicated to "cypherpunk technicality", would solve most problems. and finally again I suggest as I have in the past that no one other than the moderator really has any authority to say what is or is not relevant. and if you see someone say what is, take it with a grain of salt, or ignore it if you like. a major problem is people defending themselves when they are attacked by someone who says "that's not relevant!!". the problem is the perception of the loss of face. otherwise, what's the point? this is an interesting psychological effect that I have observed even when people use pseudonyms. it seems it is deeply ingrained into human behavior. this list is in fact imho a hotbed of psychological displays. the machismo factor is pretty thick and deep at times too. to all this I suggest one consider the idea that "criticism by a bonehead is as flattering as praise from a genius". (hee, hee) for those who absolutely cannot refrain from trying to yell at other people about relevant postings (judging by the mail, a rather significant percentage) I suggest you quote the *charter* whenever you do so, to demostrate whatever authority it is you think you have. -- anyone who needs moderator lessons should take them from S.Sandfort, an ex teacher who runs cypherpunk meetings involving a lot of childhood psychologies as effectively as humanly possible, IMHO. -- p.s. it appears to me the entrance requirements for cypherpunk membership are to have a 150 IQ and a 75 *EQ*. and that all the arguing and hostility comes from the more uninhibited pathological cases of these people. -- one could in fact have great fun impersonating someone with a grotesquely low EQ on this list and create a tremendous reaction among all the people with equally low EQs, responding to the bait with the same intelligence a fish attacks a wiggling worm. it would be "evolution in action", imho. (hee, hee.)

1 0

Re: DejaNews all over again--a URL for Usenet Searching
by tcmay＠got.net 17 Dec '03

17 Dec '03

[Please don't copy Eugene Volokh <VOLOKH(a)law.ucla.edu> on your follow-ups; I copied him on my original because I had quoted him.] At 10:04 PM 11/6/95, s1113645(a)tesla.cc.uottawa.ca wrote: >Judging by the amount of posting you do here, I was surprised that I only >got 36 listings on your new address (1/3 of which quoted you but not >directly written by you). Either you post more to alt, soc and talk (which >they >don't have) or you use a third address (the second thing I tried was >tcmay(a)netcom.com, even less, though the archive's pretty recent, so that's >expected). I do little posting these days on Usenet. There is almost no sense of "community" there, in the sense of persistent, memorable posters, and in the sense of even _slightly_ having similar goals and aspirations. A vast number of the posts on any topic come from people who just rolled off the turnip truck and who have no interest in learning. >I figured I'd send this to you as a private note, but then I figured >this thing really is scary and has a lot to do with anonymity. >Watch out folks. Litte Brother is saving everything you've ever said on >usenet. Your old posts just won't go away. I've assumed this for many years. One used to be able to buy "Usenet on CD-ROM"...before the volume got to be too high. I've always assumed that archives would be increasingly available, eventually covering the entire history of Usenet, going back to the early 80s, and with tools for tracking the changes in login names over time (so that, for example, Perry's 1984 postings could be easily retrieved). Dossier services are coming, of course. If not legal to operate in the U.S., trivial to locate offshore. ("Employers, we will provide a scan of prospective employers. We can let you know if potential employees have ever posted to alt.drugs, alt.homosexual, alt.deviancy, or alt.cypherpunks. Avoid needless risks.") >(Not that someone who is so open in his views and true name as yourself >would mind, Tim, but I'm certainly happy for my sake, that alt isn't archived >yet. It's bad enough they have rec.) Huh? What makes you think "alt" is not archived? Just because DejaNews doesn't index it doesn't mean it is isn't archived in various places. Paul Robichaux pointed me to another searcher, http://www.excite.com/, which _does_ index the alt groups. I'm sure more are coming, reaching further and further back in time. (At the rate the Net has been expanding, by the time they can archive-and-index the last year of Usenet, they can get the entire history for not much more. I'll bet this happens by the end of 1997.) >Ps. I will of course run searches on every other address that the who >command on majordomo(a)toad.com supplies me with, so watch what you say >ladies, gents and otherwise. ;-> >Get those 'nyms ready. I offered the "Blacknet Dossier Service" a couple of years ago to the Extropians list subscribers. Nick Szabo helped me out by claiming to the list that he had purchased his dossier contents, and was "shocked" by what he found. A number of the Extropian list subscribers were quite perturbed before I told them it was a joke. Then I pointed out to them that there is absolutely nothing which stops such things. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

MOONLIGHTING BECOMES YOU.... Instan
by rewards＠t-1net.com 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// Were sure you will agree this FREE report will reveal money manking secrets so powerful, it could change your life forever !!!! Its never been easier to generate profits. Take this important FIRST STEP For FREE DETAILS send e-mail to: cash(a)answerme.com

1 0

House Report on SAFE
by John Young 17 Dec '03

17 Dec '03

The National Security Committee report on SAFE is available: http://jya.com/hr105-108-pt3.htm (48K) This provides discussion of the Weldon-Dellums amendment and other matters. The Intel Committee report is due out shortly, which is designated Part 4.

1 0

Java insecurity - long - argumentative - you are warned.
by fc＠all.net 17 Dec '03

17 Dec '03

WARNING - THIS MESSAGE CONTAINS INFORMATION THAT MIGHT BE CONSIDERED AS A FLAME BY SOME READERS - IT IS LONG AND TEDIOUS - YOU ARE WARNED! >From the Java Web pages (as combined in Firewalls/BoS): > The language's security features (not just applets): > > (http://java.sun.com/whitePaper/javawhitepaper_6.html#HEADING15) > > 4.2 Security in the Java Environment > > Security commands a high premium in the growing use of the Internet > for products and services ranging from electronic distribution of > software and multimedia content, to "digital cash". The area of > security with which we're concerned here is how the Java compiler and > run-time system restrict application programmers from creating > subversive code. But not non-subversive code? Sounds like a value judgement to me. Subversive code is not otherwise defined in these documents. > The Java language compiler and run-time system implement several > layers of defense against potentially incorrect code. Is incorrect code subversive? Vica versa? Does Java provide defenses against my code not properly calculating numbers? > One of the Java > compiler's primary lines of defense is its memory allocation and > reference model. Simply put, Java does not have "pointers" in the > traditional C and C++ sense--memory cells that contain the addresses > of other memory cells. > > Memory layout decisions are not made by the compiler, as they are in C > and C++. Rather, memory layout is deferred to run-time, and will > potentially differ depending on the characteristics of the hardware > and software platforms on which the Java language system is > executing. The Java interpreter references memory via symbolic > "handles" that are resolved to real memory addresses at run time. Java > programmers can't forge pointers to memory, because the memory > allocation and referencing model is completely opaque to the > programmer and controlled entirely by the underlying run-time system. Just because it is opaque, doesn't mean you can't happen across a valid (but perhaps undesirable) handle. Sounds like a good issue for attack by crypto-types. How do we guess the handle of the disk IO routines? > Very late binding of structures to memory means that programmers can't > infer the physical memory layout of a class by looking at its > declaration. By removing the C/C++ memory layout and pointer models, > the Java language has eliminated the programmer's ability to get > behind the scenes and manufacture pointers to memory. These features > must be viewed as positive benefits rather than a restriction on the > programmer, because they ultimately lead to more reliable and secure > applications. Is the language un-predictable? The same program executes differently each time? A pseudo-random allocation? What is the technique used to implement this, and why should we believe it is in fact secure in some sense. And if so, in what sense? > The Byte Code Verification Process > > What about the concept of a "hostile compiler"? Although the Java > compiler ensures that Java source code doesn't violate the safety > rules, What are these "safety rules"? No reference to them in this document! > when an application such as the HotJava web browser imports a > code fragment from anywhere, it doesn't actually know if code > fragments follow the Java language rules for safety--the code may not > have been produced by a known-to-be trustworthy Java compiler. In such > a case, how is the Java run-time system on your machine to trust the > incoming byte code stream? The answer is simple--it doesn't trust the > incoming code, but subjects it to byte code verification. > > The tests range from simple verification that the format of a code > fragment is correct, to passing through a simple theorem prover to > establish that the code fragment plays by the rules--that it doesn't > forge pointers, it doesn't violate access restrictions, and it > accesses objects as what they are (for example, that "InputStream" > objects are always used as "InputStreams" and never as anything > else). A language that is safe, plus run-time verification of > generated code, establishes a base set of guarantees that interfaces > cannot be violated. Wait a minute. If it's so safe, what code can possibly be sent in that would cause a violation? If the prover is so simple, how can it show things (e.g., program correctness) in real-time on a PC that the rest of the world can't show with supercomputers over extended periods? What EXACTLY are these things doing, and why should we believe they are safe? > The Byte Code Verifier > > The last phase of the byte code loader is the verifier. It traverses > the byte codes, constructs the type state information, and verifies > the types of the parameters to all the byte code instructions. > The illustration [see the HTML] shows the flow of data and control > from Java language source code through the Java compiler, to the byte > code verifier and hence on to the Java interpreter. The important > issue is that the Java class loader and the byte code verifier make no > assumptions about the primary source of the byte code stream--the code > may have come from the local system, or it may have travelled halfway > around the planet. The byte code verifier acts as a sort of > gatekeeper. The byte code verifier ensures that the code passed to the > Java interpreter is in a fit state to be executed and can run without > fear of breaking the Java interpreter. So there are byte code sequences that can break the interpreter! > Imported code is not allowed to > execute by any means until after it has passed the verifier's > tests. Once the verifier is done, a number of important properties are > known: > > There are no operand stack overflows or underflows Not so easily proven, is it? > The types of the parameters of all byte code instructions are > known to always be correct Huh? I thought you couldn't have incorrect types. Do they mean that you can have incorrect types but that they are detected by the verifier at load time? > No illegal data conversions are done, like converting integers > to pointers How about legal ones - like converting integers to pointers via case statements? > Object field accesses are known to be legal--private or public > or protected What exactly does this mean? > While all this checking appears excruciatingly detailed, by the time > the byte code verifier has done its work, the Java interpreter can > proceed knowing that the code will run securely. Knowing these > properties makes the Java interpreter much faster, because it doesn't > have to check anything. There are no operand type checks and no stack > overflow checks. The interpreter can thus function at full speed > without compromising reliability. Can computers actually "know" anything? No runtime checking whatsoever. Get past the supposed verifier, and you have free run of the machine. A single verifier bug or inadequacy, and the world is unsafe for electronic commerce. And has the Java code been verified to prove the claimed properties? Against what criteria? Where's the beef? > Security Checks in the Class Loader > > After incoming code has been vetted and determined clean by the byte > code verifier, the next line of defense is the Java class loader. The > environment seen by a thread of execution running Java byte codes can > be visualized as a set of classes partitioned into separate name > spaces. There is one name space for classes that come from the local > file system, and a separate name space for each network source. > > When a class is imported from across the network it is placed into the > private name space associated with its origin. When a class references > another class, it is first looked for in the name space for the local > system (built-in classes), then in the name space of the referencing > class. There is no way that an imported class can "spoof" a built-in > class. Built-in classes can never accidentally reference classes in > imported name spaces--they can only reference such classes > explicitly. Similarly, classes imported from different places are > separated from each other. But they can explicitly reference each other? I can only explicitly open a file called command.com on your PC? > Security in the Java Networking Package > > Java's networking package provides the interfaces to handle the > various network protocols (FTP, HTTP, Telnet, and so on). This is your > front line of defense at the network interface level. The networking > package can be set up with configurable levels of paranoia. You can: > > Disallow all network accesses > > Allow all network accesses > > Allow network accesses to only the hosts from which the code was > imported > > Allow network accesses only outside the firewall if the code > came from outside Who wants to bet that 99+% of all users configure "Allow all network accesses". Hot Java today is defaulted to this state. > Applet-specific security: (written for the 1.0a3 release of > HotJava(tm)... there will be a rewrite for the 1.0b release when that > occurs. I'm assuming, perhaps incorrectly, that the Netscape > implementation is similar. As I understand it, they licensed the HJ > code from Sun, so I think it's all very close to the truth.) > > (http://java.sun.com/1.0alpha3/doc/security/security.html) > > [ A rehash of the above text, snipped ] > > Security level four: protecting the file system and network access > > HotJava enforces security policies confident that its security > interfaces are secure. In other words, it assumes the other three levels worked properly. If they don't, you're screwed. > The three lower levels of security guarantee > that all local classes, e.g., the file access primitives, are > themselves protected from being supplanted, replaced, or extended by > imported code. You're screwed. > The file access primitives implement an access control list that > controls read and write access to files by imported code (or code > invoked by imported code). The defaults for these access control lists > are very restrictive[*]. If an attempt is made by a piece of imported > code to access a file to which access has not been granted, a dialog > box pops up to allow the user to decide whether or not to allow that > specific access. These security policies err on the conservative side > in order to ensure maximum security. This conservative approach may > make writing some applets more difficult or awkward. By default - ask the user. That's restrictive? Please press the OK button to have our free Lotus update loaded into your computer. > For network security, HotJava provides a variety of mechanisms that > can provide information about the trustworthiness of imported > code. These mechanisms cover a wide range of possibilities. At the > simple end the system can check on the origin of a code fragment to > determine if it came from inside or outside a firewall. At the > sophisticated end of the range a mechanism exists whereby public keys > and cryptographic message digests can be securely attached to code > fragments that not only identify who originated the code, but > guarantee its integrity as well. This latter mechanism will be > implemented in future releases. So today, if the admin specifies the proper IP address ranges when loading Java into each computer in the network, and if no user ever installs Java on their own, "code" downloads from external machines may be stopped - unless the user says OK. > The security policies implemented by the runtime system can be > dynamically adjusted based on the information available concerning the > origin of a code fragment. The Socket class provides such an example. > > The Socket class implements security policies that are adjusted to > reflect the trustworthiness of the code that invoked it, and > transitively, the code that invoked the invoker. The information about > what code began the chain of execution is available to the class in > the form of which namespace contains the invoking code and what > parameters are associated with that class. The class loader puts the > classes it has loaded in a specific namespace, allowing the Socket > class to determine the network host from which a class is loaded. > > Knowing the network host allows the HotJava security mechanism to > determine whether the class originated inside or outside a > firewall. Knowledgable users of HotJava can decide which category of > hosts to trust when loading executable code. How about the more than 99.99% of users who are not knowledgable of HotJava? > For example, the Socket > class can implement the policy of only allowing new connections to be > created that terminate at the host from whence the code was > loaded. This restriction means that code loaded from outside a > firewall cannot connect to other machines on the net behind the > firewall. Unless that machine acts as a gateway for further processing. > Code that comes from more trusted sources can be allowed > more freedom to make connections to other machines. As an additional > defense against untrusted sources HotJava's security can be set to > prevent any code from being loaded. The level of security is > configurable by HotJava users. The user dictates the security policy. Any user in your site can potentially, through error or omission or intent, open up a hole to your entire network by accidentally pressing the OK button one time or by setting a configuration parameter incorrectly. And your firewall will not save you. ASBESTOS SUITS MAY NOW BE REMOVED - FLAME OFF. P.S. When: Tuesday, November 7, 8AM Where: The Hilton, Washington D.C. (the CSI conference) The talk: 50 Ways to Attack Your World Wide Web Systems If you want a chance to heckle - be there. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 2

Re: Crypto++, Cpunk Icons, list noise
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 4 Nov 1995 don(a)cs.byu.edu wrote: > An anonymous complainer writes: > > >Well, Perry, my opinion is that there is far too much noise on this list > >as it is. I have already seen my words drowned out by bellyaching over > >next to nothing. > > POT-KETTLE-BLACK. > > Also, since nothing you've written (in your commentary, as opposed to > anonymous announcements or releases that most people use anonymity for > here) indicates that you're using anonymity for any particular reason, Hmmm, I'm not sure that anyone has an inherent right to question WHY a person seeks moments of anonymity or privacy. I don't believe that anyone should be placed on the defensive, for *choosing* to maintain some semblance of a personal life, or wishing to maintain some illusions that they might still have some shred of personal privacy left. Hopefully, we can still leave a man with his dignity. I should not have to defend my right to present my ideas as I believe are appropriate to the circumstances. My choice to present the idea, that an entire economic sector needs to carefully reevaluate their strategic choices, and their discovered hidden security attitudes -- will stand or fall strictly on its merits. The debate is not advanced in any way by attaching a reputation to the question. Like any other person, I have my skeletons, and I have my regrets. I certainly have unfinished, unresolved, issues that I need to tend to. In that sense, I am no different than any other man. I also realize that ultimately, I'll have to come forward from behind the veil of secrecy which is provided to me. This I will do, after I have reconciled my own security considerations. Please allow me the boundary and dignity to choose when, where, and in what form I choose to reveal myself. That inherent right, should be extended to any man, and no man should be called to account for his desire to maintain his personal privacy, no matter how arbitrary his reasons. Especially when he comes forward to challenge Goliath. > please stop so people can killfile you. Or send it from a nym at > alpha.c2.org. I mean, the NSA has your real name anyway, what's the > point... At this time, I don't feel that a bi-directional private communications channel is needed. I have no need for a "nym". People who need to contact me, can. People who would like to know a bit about me, can. Netscape has my address. So does AT&T. And reputations aren't pertinent. (Although, I will say, that the disappearing here-again, gone again, internet draft at ds.internic.net is simply childish, and I'm certain that it was just routine "file maintenance" that caused the flicker.) The ball isn't in my court, it's in theirs. Netscape and AT&T are some of the primary parties who will have to take the hit for the fiasco that they find themselves in. For now, I'll leave my communication channels with them open, rather than letting my mail queue fill more than it already has. Email that is already overqueued. I don't really envy the two companies' position. No one expects to find as significant a security flaw as my anonymous email to this list detailed at this stage of code Burn-In, and I don't take any pleasure in facing the unenviable task of informing ANY party that a Trojan Horse has been engineered into the fabric of an existing globally installed code base. No one does. And as the messenger, I (hope) I don't have anything to fear, from the NSA or any other foreign group that would seek to pursue its own agenda within the borders of sovereign Canada. I really don't think that the NSA is "evil incarnate", as some list subscribers do. They have their intelligence and know how to use it. Usually, they use it prudently. If I did have any worries about the NSA, then I might take some elementary precautions. I certainly wouldn't have my terminal screen pointing towards the twelve odd feet of open glazing that sits behind me, as I currently do. Privacy can't simply be reduced to "a desire to hide from the NSA", just as security isn't something which is simply provided by licensing from RSA. Look to the message rather than the messenger. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 5

SSZ status test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

SSZ Status Test No Reply No Repeat

1 0