December 2003 - cypherpunks-legacy

Re: Let's *NOT* "Raise their Awareness"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 06:07 PM 3/26/96 -5:00, Michael C. Peponis wrote: >On Tue, 26 Mar 1996 , David K. Merriman wrote: > The judge is correct in this matter, most people view it from the > rights of the parents, but what about the child who, because of > his/her parents egotism and ignorance, grows up not being able to > compete effectivly? I am sure the judge is right in this matter, but is in any of his damned business. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: (X:x)e$ 's other use
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 04:05 PM 3/26/96 EDT, E. ALLEN SMITH wrote: > The > Fed has done an actually rather admirable job of standing up to the pressure Every couple of years the politicians start leaning on Greenspan. Greenspan lets it be known they are leaning on him, the money markets mark the dollar down and the politicians stop leaning on him. The Greenspan standard is not a good as a gold standard, but its not bad. Only trouble is he is mortal, unlike gold. Come to think of it, there is actually some crypto relevance here: Internet currencies will be necessarily non physical and it will be difficult to go after the issuer in the event of default, so the best currency will have a value that depends on peoples belief that the issuer will defend the value of the currency. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

How to enter the US without a visa?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

This is somewhat off topic for cypherpunks, but alt.forgery is dead, so cypherpunks is probably the nearest group. Suppose (hypothetically) an American resident cypherpunk had a hypothetical friend who is most unlikely to obtain an American visa. Now the standard way of dealing with situation is for an American friend to get a certified birth certificate of someone born in America, concoct some photo ID, send it to the out-of-America friend, and then the out-of-America friend comes in through Montego Bay or some similar point where there is lots of tourist traffic. But the thought struck me that this might not work for some one who hypothetically has a foreign appearance and a truly terrible accent. Now a fake greencard would probably work, but greencards have age and sex etc encoded on them, and conceivably they check them against a database, in which case it would be necessary to obtain the greencard number of a real person of the right age and sex, which is not easy. Any suggestions? Surely lots of people have dealt with this problem already. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

vogon punk haiku
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

looking down his nose, Senator Exon banned it Haiku's not a crime Rights groups lobbying politicians waffl"ing Cypherpunks write code At First Virtual tense hot alien in barn encrypts no message Later releases in some communications there are signatures digicash tokens no one knows what you're buying follow the money Senator Exon! Imminent Death of the Net! GIFs at eleven! what they cannot read they don't want to let you say you must encrypt it Crypto power tools cannot be exported yet? how can they stop them? Freeh is watching you Big Brother is watching you NSA listens #ifdef crypto you cannot export this code #endif crypto if code is outlawed bhgynjf jvyy unir cevinpl talking to their friends Beating a dead horse idle thoughts typed on a train need more ideas Senator Exon And the horse he rode in on ******* indecent #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 01:59 AM 3/26/96 -0800, Timothy C. May wrote: >At 7:08 AM 3/26/96, Shabbir J. Safdar wrote: >My point is that I see no compelling legislation that is needed. If enough >people in Washington really want increased length in _exported products_ >(remember the "exported" part), the Congress and the President should find >it easy enough to get said products on to the Approved List. (I note that >the Leahy Bill really doesn't change this system anyway...some products go >on the list, some don't...the law only seems to say that when the horse has >already left the barn, i.e., when "comparable" products are already in >fairly wide use outside the U.S., then the products should be put on the >approved list. Big deal. There is, however, a slightly different way of looking at this. For centuries, there was a saying "Nature abhors a vacuum." While not scientifically correct, from the standpoint of people living below an ocean of atmosphere it seemed to be true. Likewise, the political system seems to abhor a situation where there is neither law, nor a proposed law. The best tactic might be to insist on modifications to the Leahy bill, most of which are quite justified, but cumulatively will be seen by "the enemy" as being so extreme as to be unacceptable. At that point, the enemy may actually agree with our assessment that no law is better than the corrected Leahy bill, and we'll both walk away satisified with the "no law" option. Think of it like pouring sugar into a gas tank. [stuff deleted] > >And, frankly and bluntly, while I am not as extreme (in some ways) as, say, >Jim Bell, in other ways I and many others of us are quite extreme. Hey, see, I'm useful! I make you look more, uh, "reasonable", right? Jim Bell jimbell(a)pacifier.com

1 0

Re: So, what crypto legislation (if any) is necessary?
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

I think this is a very important area to consider, and I thank Tim for putting his thoughts into this very organized form. My replies: Timothy C. May writes: >>If the Leahy bill is unacceptable, what legistlation is necessary? I >>can't see how the use of cryptography in the commission of a crime needs >>to be a separate offence, but I could see how it could be treated as a >>special circumstance - that doesn't really needed a new law though. > >I don't see any compelling need for U.S. legislation. And given the >pressures to attach all sorts of language to bills, I think it best that no >legislation happen. Unfortunately, this is not an option. Legislation will happen, with our endorsement or without it. One good example is the Grassley computer crime bill earlier in 1995. Nobody advised him on this, as far as I can tell, he just went out and drafted it. Lo and behold, he drafted a provision that basically criminalized all crypto, including rot13. We have to wake up and learn from the fight against the net censorship legislation. This is realpolitik. Congress will legislate crypto, whether we want them to or not. This is not news anyone wants to hear, but we have to face up to it. >* DOMESTIC USE OF ENCRYPTION: Currently, no restrictions whatsoever. No >laws saying messages can't be encrypted, no laws saying keys must be >escrowed, no laws about permissable strength of ciphers, no special laws >covering disclosure of keys. Just silence, blessed silence. The >Constitution says there shall be no laws about permissable speech (what >language one speaks in, or writes in), and other provisions about compelled >testimony seem adequate. Congress has discovered the net, and partly though the widespread fame of this list, they have also discovered crypto. Simply saying, "we don't want any laws that address crypto" may be the ideal solution, but that won't stop them from passing laws that govern the domestic use of crypto. >* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. >companies, but is not _per se_ an issue I worry about. So long as I have >strong crypto, I don't really care too much about export. It would be nice >to get the ITARs modified, but not at the risk of adding language (such as >Leahy did) making use of encryption a possible crime (we've debated this, >so I won't elaborate here). Besides, I think the best way to overturn the >ITARs is through a court challenge; as I have noted, even the NSA's lawyers >felt that the ITARs would not withstand court scrutiny. Unfortunately, many U.S. software companies don't agree with you. While I agree with you (I've got PGP, what's the problem?), several of these companies are working through their trade organizations to introduce and push crypto legislation to allow them to raise the key length in their products. Put ourselves in their shoes for a minute. They're sitting there, with their 40 bit products, knowing that it blows chunks. They want to produce stronger crypto, but know they won't be able to export it. They talk to the company's attorneys, who speak to speak to the lobbyists, and poof, a crypto bill. >* KEY ESCROW: A matter of contract law, nothing more. If I want to give a >copy of my key to my lawyer, fine. If I want to give a copy to Vince's >Offshore Key Repository, no current U.S. laws stops me from doing so, and I >can even get it to him securely without violating any ITARs by using the >cipher that _he_ uses and then importing it here! > >IMPORTANT NOTE: It is often said, in a correct interpretation I think, that >a third party holding a key (Joe's Key Warehouse) is _not_ covered by the >5th Amendment's protections against self-incrimination, and so must honor a >subpoena. Sounds accurate to me. However, what if Joe is _also_ one's >lawyer? Does attorney-client privilege apply here? Perhaps. A better >solution is also fully legal at this time: use only offshore key storage. A >U.S. subpoena to Vince's Offshore Key Repository will carry no weight in >Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince >and I could have a stipulation that such "duress requests" will not be >honored, no matter how loudly I squawk.) This is actually very important. The Leahy bill forces Joe's Key Warehouse to only divulge your key when they've been presented with a warrant that's on par with whatever they used to get your original communication. That means that Louis Freeh can't issue an administrative subpoena to get your key, after he's got a judge to allow the FBI to search your house. They have to get a judge involved for both parts. It's better than where we are today, where Joe's Key Warehouse is vulnerable to every law enforcement joker that can write an administrative subpoena. We haven't yet had an incident that demonstrates this, but we will. Of course, if you're the sort of person who thinks that the FBI and the Department of Justice are involved in a big criminal conspiracy to begin with, we shouldn't even be talking about due process, as you don't believe it exists... >In conclusion, things are fine as they are. I see no compelling need to >write a special law confirming the rights we already are enjoying. If the >Congress wants to relax the ITARs (fat chance), they can direct that the >language of specific sections be redrafted. (I'm not even sure when and how >the original language was crafted, though it is part, I believe, of the >ancient Munitions Act and/or Trading with the Enemy Act. The enabling >legislation for the ITARs, and especially for the specific items actually >ON the "Munitions List" could be trivially changed. Were this Leahy's >intent, an easy thing to write a bill for. I doubt this was his intent, >however. I think this indeed is what Leahy was aiming for. A quick glance at the bill will prove this out. The approach that "things are fine as they are" is like saying "I'm on a freight train, heading for a cliff, but they're still serving me caviar so it's OK". Sure, it feels ok, but the train's still moving, no matter how far you are into your denial. I can't say this enough: the net has moved into realpolitik. Congress has found us, and their first step is to regulate us. Then, they'll outlaw us. Let's hope we convert enough legislators to netizens before they outlaw us. -Shabbir J. Safdar co-founder, Voters Telecommunications Watch

1 0

Re: Bad news from Judge Richey
by jim bell 17 Dec '03

17 Dec '03

At 11:33 PM 3/25/96 -0800, Timothy C. May wrote: >At 3:28 AM 3/26/96, jim bell wrote: > >>I realize that this may appear to be a rather disrespectful tactic, but have >>you considered reminding the judge that if you are not allowed to profit by >>exporting encryption that the government doesn't want to see exported, >>you'll just have to make money in some other way, and this may lead you to >>talk to Jim Bell about implementing a program using encryption that doesn't >>_need_ to be exported...legally anyway. > >Whoahh! Hold on there, Jimbo! You're crossing the line. > >You're coming perilously close to actually calling for the killing of a >federal judge. My recollection is that a couple of folks have been arrested >and charged for calling for the killing of judges. Now now, Tim. You know me better than that. You know that I would never be so restrained as to call for the killing of ONLY ONE federal judge. Seriously, however, I think you slightly mis-read my letter. The implied "threat", if you are inclined to call it that, would simply be that if domestic software writers are prohibited from exporting encryption software, they might be inclined (and have time for) writing the entire AsPol system into software. Once that happens, we won't have to worry about ITARs or any other governmental impediment. At that point, the danger is not to one specific federal judge, and not even just to all of them, but every government employee at every level, working for every jurisdiction. Judges, I presume, are quite familiar with accepting a sense of personal danger for the consequences of their bad decisions. It would be an entirely different situation, I suggest, if it were made clear to them that the fallout from their misbehavior would ultimately be visited on a few million people. And it would shock them to the core if it were explained that this could be done entirely legally, with the obvious exception of a few unidentifiable people who actually do the anonymous work. Jim Bell jimbell(a)pacifier.com

1 0

Re: WSJ on Big Java Flaw
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <199603261814.KAA23974(a)netcom5.netcom.com>, frantz(a)netcom.com (Bill Frantz) wrote: # At 10:58 AM 3/26/96 -0500, John Young wrote: # > Java was originally touted by Sun as a secure language. But # > at least two other flaws have already been discovered in # > the technology, including a less-serious problem uncovered # > by the Princeton team last month. Sun's Ms. Mueller said # > the problems have been correctable details in the way the # > Java code is written, not problems with its basic design. Actually, I suspected and reported the same bug some weeks before the group at Princeton. <URL: http://www.aztech.net/~steve/java/~>. That said... # Having worked on a secure OS, with a small security kernel etc. etc. etc. I # realize that even those systems have bugs. The Java people will work out # their bugs. Others will read their code and find more bugs. (It is to # Sun's GREAT credit that they are releasing their source under a not very # restrictive license.) Eventually, in several years, Java security will be # ready for prime time. This is exactly what I would say. Sun has released source code for what that they label as "Beta Software." I agree with their labeling, and don't fault them for having buglets in beta software. I commend them for releasing souce code. My biggest gripe is with other companies (no names mentioned) who are shipping Java, integrated and "turned on" by default in their "production-level" products. # Of course, for really valuable things, or the really paranoid, you # shouldn't connect your computer to a network. The top dog certificate key # in SET is handled this way. Generally good advice. (SET is an "Alpha Specification" and has its own problems, that I won't go into here, but again, I commend the principals involved for allowing "outsiders" to view and comment.) I'd also add that running uncertified (by the local CA) applications is bad voodoo, and should be avoided, but that's an issue that most admins don't have much real control over in most environments. -- Steve(a)AZTech.Net [ I thought about adding a P.S., but most of you probably don't care what I do for a living, who I work for, nor what I work on, and why. Send email if you're curious. ]

1 0

Re: Crypto CD UpDate (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > It pains me to often be the one who throws cold water on what seems to be a > good idea, and what comes from a well-intentioned person. But I have to > call 'em as I see 'em. And maybe I'm wrong. But here are my thoughts. You know you love it...;) > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. I do soho consulting and I help provide several of my customers with software of various nature. One thing I have come to realize is that they are not interested in being in the fast lane. They are secure in knowing that the software behaves in a predicible way (not necessarily designed that way either). A large part of this attitude is based in their not being computer anything sorts. I find CD's a great way to keep libraries of old software that sometimes comes in handy. > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. (And > fractions of a second is too charitable: in actuality, I'd have to locate > the CD-ROM, dismount anything already mounted, mount the CD-ROM, search it > for "PGP," etc. Probably not even faster than using Alta Vista and > downloading.) Yes, except it is much easier to track my access to the web than my CD-Rom. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. CD's are great advertising.

1 0

Random Number Testing (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Fred, Forwarded message: > Subject: Random Number Testing > Date: Tue, 26 Mar 1996 18:00:26 -0800 (PST) > From: Fred <admin(a)dcwill.com> > > The limitation seems to be in the testing process. > > An inviolable rule of test and measurement is that the testing process > must have a higher degree of accuracy and precision than is expected from > the item under test. If all you have is a non-graduated stick one meter > long, you can't measure increments of less than one meter unless you add > some additional resolution to the system (such as a human's judgment > that the object is four sticks, plus about another third of a stick, > long). Not if I am allowed geometry. I believe such situations are a test of lateral thinking more than any fundamental insite into nature. > > Our ability to synthesize pseudo-random data, and the degree to which > it approaches true random data, is limited by our ability to discern > between the two. If the best testing process available yields the > same results for the output of a true RNG and a particular PRNG, what > can be done to improve the randomness of the PRNG? How could we tell > the difference based on the data itself? What are you defining as random? The definition I use in practice is basicly that if I am given 100% intelligence on a stream of numbers the odds of my succesfully choosing the next number is never higher than chance. All data is random (by definition) until the pattern(s) can be discerned. In this context pseudo-random has a definite meaning, namely that it takes a long time to amass enough information about the data stream to break the chance boundary. The question quickly becomes, how do you test various sequences against one another for robustness? It seems to me that it has to be done statisticaly. One aspect of this is what I call the 'ghost' pattern. In short, in the process of analyzing some random data a pattern is found. Is it possible that there could be more than one pattern (ie interpretation) of the data? Is it possible for a data stream to contain two (or more) messages coherently? If a message does contain two or more coherent messages, how does this affect the size of the data? Can this occur only on messages above a certain size?

1 0

Re:
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:42 AM 03/28/96 -0800, Anonymous wrote: >At 12:21 AM 3/28/96, Syed Yusuf wrote: >>If a person who speaks three languages is tri-lingual >>If a person who speaks two languages is bi-lingual >> >>What do you call a person who only speaks one language? >> >>---------------------answer follows: >> >>An American. > >Or our version: > >What do you call a person who has to learn English as a second language in order to compete in the world? > >A foreigner. > >(Sorry for the insult, but it seems that this thread is bringing out insults from foreigners of all sorts.) > >--Tim > > >Dont be sorry! > >Foreigner can atleast speak broken English. Can American speak broken foreign language? As a matter of fact, I speak broken Tagalog, broken Japanese, pidgin Korean, and and can generally make myself understood in Chinese, Thai, Vietnamese, Spanish, and French. Oh, yes, I'm also fluent in Aussie :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVoK/8VrTvyYOzAZAQHrXAP/ZMOgx+VkqHXCQHBFXIdVVHzlCcJIo3L6 2LyqMnY0cJ5ZFD8mCNsBTTe2DAXFpN1WV03JFym/JIxAuL0TQuN0WKZ2HFSuk997 AZPo21whZbXVQlRGrr6JjiR8p2nqHMMBpNC2bfr2r/rny7UmnGGp8C1e6crPtrQF PiyDbd20zbM= =Swae -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

DES or RSA on a PIC
by MeRC 17 Dec '03

17 Dec '03

Does anyone have ANY code for DES or RSA encryption for use on a PIC microcontroler? A friend and I are developing an ASCII terminal (dumb term) that encrypts data going to the serial port and decrypts data coming from the serial port, so you could successfully send a message over a modem and have it automatically encrypted\decrypted. We have all the hardware almost done, but we are having a hell of a time writing the code for the encryption... Thanx in advance... l8r, -MeRC merc(a)redrose.net -or- merc(a)success.net -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQCVAwUAMUC05tnn3Dsf47p5AQE6AAP9E/JebLn1UtkOk41IGw/i4XHKckVcI6RH ptBMucqx01sSTxaR8tXPmmkKjz5f3xndxepbbs6nKfoNuSaODWSirOlNvt3i1DWL iUmB9+rUYmwwlpD7t6qyy2XzsAxO/M/nFT4ZxO8wi96nR/Rmp00LvCoK+YcjgQnj HReyQrIl4X+ZAI0DMUCzOgAAAQQAv6IH+OnLeP+chsgwymSVKqsXHO1xwJLxs657 Cf3miDM3mNBB/qmRziQ1zHeC/nXgaGhR7eAdidL6MngDXl6+cw4Z5xXvenu5MpEW zpZpwDK5/XwuvCIexQP2eHIb2Ms6vna7fUoaHGrrV4844KIVg+E36ZgWT1ZP2efc Ox/junkABRGwAYe0I01pY2hhZWwgRC4gV2hpdGUgPG1lcmNAc3VjY2Vzcy5uZXQ+ sAED =ZbPJ -----END PGP MESSAGE-----

1 0

Re: So, what crypto legislation (if any) is necessary?
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

Lucky Green writes: >At 2:08 3/26/96, Shabbir J. Safdar wrote: > >It is a widespread myth that wiretaps require warrants. Court ordered >warrants are not required for a wiretap. They have not been required since >the Digital Telephony Bill passed. (see below) >That the net, the media, and even >attorneys are so blissfully unaware of this, even years after the provision >doing away with requiring warrants became law, is one of the finest >examples of cognitive dissonance you are ever likely to find. It is too >disturbing to believe it, so the mind ignores the facts. When everyone in the world seems to disagree with you, isn't it a good idea to check the facts? >Excerpt from the Digital Telephony Bill (deleted) [..] >"My supervisor approved it" may well suffice. Your misunderstanding of how interceptions are done is dangerous to what is otherwise a rational, intelligent argument. Indeed, there are ways to conduct a wiretap without a judge. They require dispensations from people like the Attorney General, for example. And this is certainly not a normal practice. There are a lot of reasons to object to DT, but this is not one of them. -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace

1 0

Re: Let's *NOT* "Raise their Awareness"
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:23 AM 03/27/96 -0800, Charles Bell wrote: >On Tue, 26 Mar 1996, David K. Merriman wrote: > > >Yes, and some years ago a State legislature (I forget which) passed a >resolution setting the value of pi at exactly 3. I'm not sure how they >planned to enforce their will. Do you know how the Texas judge means to >enforce his? Frankly, no. I would suspect some kind of visits from Child Welfare, or somesuch - fruitless though it may be. Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVjxCsVrTvyYOzAZAQFWfAP7BQTesPRwoK+ubvFxLg36tq634FdFAlue 5sMZO1D2yBfHEHsHyfpR7RBB2DrP8vqTjrcZjz9ctxg7ph5/sqYUWf37xkKbyLu2 byJMWfZhZDXIwDyhWU3RmJOUL+loisDzP7uNZtjoodJLro/QceSR4sqdgWa4xl59 eiPapVoaXdU= =1+fS -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: ITAR double standards?
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

3/26/96, Timothy C. May wrote: >So, did Intel have to apply to the State Department's office on munitions >exports in order to send engineers to Malaysia, Israel, Germany, Ireland, >etc., to do development work? Not that I ever heard. Engineers simply >hopped on planes and that was that. So true. When I worked in Silicon Valley firms, I noticed how International Air Courier services were used entirely like Interdepartmental Mail, with no concern for export laws or import duties, etc. If we travelled overseas, _of course_ we took our laptop with all it's software (including encryption), and _of course_ we'd leave software copies on colleagues hard disks, after doing demos and such. All with a sense of total righteousness -- we were tax-paying wage-earners just doing our job. There's a real irony here, if you think about the Barlow-expressed sentiment that cyberspace is a new free domain, having achieved escape velocity from terrestial anachronisms. While Barlow's critics, it seems, demolished _that_ thesis as wishful thinking, there's a parallel thesis that may actually be true: that _corporate environments_ have achieved escape velocity from civil jurisdiction, and now live in a world where rules & ethics are relative only to corporate culture, and "parochial" national laws are to be quietly ignored, knowing there's a highly-paid legal staff to deal with occasional embarrasments. We dream and they implement. Cheers, Richard rkmoore(a)iol.ie (not on cypherpunks) ~=-=-=-=-=-=-=-=~=-=-=-=-=-=-=-=-=~--~=-=-=-=-=-=-=-=-=~=-=-=-=-=-=-=-=-=~ Posted by Richard K. Moore - rkmoore(a)iol.ie - Wexford, Ireland Cyberlib: www | ftp --> ftp://ftp.iol.ie/users/rkmoore/cyberlib ~=-=-=-=-=-=-=-=~=-=-=-=-=-=-=-=-=~--~=-=-=-=-=-=-=-=-=~=-=-=-=-=-=-=-=-=~

2 1

Re: Bad news from Judge Richey
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

At 11:33 PM 3/25/96 tcmay wrote: ------------------- jim bell: >talk to Jim Bell about implementing a program using encryption that doesn't >_need_ to be exported...legally anyway. tcmay: You're coming perilously close to actually calling for the killing of a federal judge. My recollection is that a couple of folks have been arrested and charged for calling for the killing of judges. ------------------- Any half-wit falling for Bell's agent provocateur setup will do hard time, or maybe get popped by his twitchy TLA watchers. The son-of-a-bitch's baiting with pigeons, no question. He's too myopic to see he's setting up falcons for gutting by high-circling eagles, who'll claw him too. Bell's going down blind-sided with his gulls, all easy prey.

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:17 PM 3/27/96, Michael Helm wrote: >On Mar 27, 3:13am, Timothy C. May wrote: >> Americans are typically thousands of miles away from those speaking >> Japanese, Mandarin, Tagalog, Polish, Italian, Dutch, Spanish, Hindi, >> Talegu, and the hundreds of other languages. It is not at all clear what >> language Americans should pick as a "second language" to study. > >I don't really disagree with the conclusions drawn by this poster, or >with the quasi-economics argument he makes. However, I must say that >the above is completely wrong. MOST Americans live in large urban >areas, & as such are within seconds/footsteps of people whose native >languages are not English (or who don't have a single "native language", >but several!). There are probably _hundreds_ of languages spoken in the >San Francisco Bay Area. The school districts here routinely report double >digit languages in the school age population. And? Your point being? "All learning is economics," to paraphrase our noted saying about security. Because there are diverse groups within 100 miles away speaking a babel of languages, including a per cent or so each of Thai, Talegu, Mandarin, Vietnamese, and so on, do I understand your point that I should pick one of these languages and spend a year or so learning it well enough to say to one of these groups, "Hello, can you tell me which way to the train station?" My point is not against the learning of a foreign language, just that economic considerations _must_ play a role. (Of course, people are free to ignore economics and "follow their bliss." A friend of mine studied Sanskrit for several years, and I even spent some time studying some Old Icelandic a few decades ago.) My European friends usually study the language of their direct neighbors and important trading/scientific partners. English, German, French, typically. >There are 3 Spanish language channels (& another 2 ... "multiple >choice") on my tv cable system. That anglophones choose to tune them >out, or to not even notice the Noah's ark around them, says something >about this culture. "Says something about this culture." Insults aside, you are right. I will sign up with the local JC for a study of Vietnamese, just so I won't be ignoring this cornucopia of polyglotism. (One person communicated with me in private about this, saying that the international nature of the Internet is an ironic counterpoint to my point. So I promised this guy I would learn Hindi and Polish to better be able to use the Internet. Of course, this'll take me a few years, and then I'll no doubt find that I don't have any interest in talking to the people on the Net who speak in Hindi or Polish, but, what the hell, I will have reduced my "anglophone chauvinism quotient.") --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Tim's friend's mildly retarded son
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 22-MAR-1996 00:47:25.47 >At 11:17 PM 3/21/96, E. ALLEN SMITH wrote: >> This topic's relevance to Cypherpunks, aside from the confirmations >>that you mentioned, is low... aside from that it's of interest to Extropians >>such as myself and Tim May. >In recent months, a self-appointed group of list members have taken upon >themselves to argue that _anything_ that does not have to do with certain >topics they find appropriate is "not related to crypto, so take it >elsewhere." Regrettably, most reasonable people have grown quiet about >anything that smacks of politics or ideology, leaving the field clear for >certain ranting lunatics. Umm... I was referring to the discussion in regards to whether "smart drugs" work or not, not the discussion on the FDA. Sorry if I wasn't clear. Admittedly, some of my comments with regards to the FDA's ultraconservative/better-safe-than-sorry (depending on whose side you take) policy can be extended to an analysis of the NSA's behavior - putting the brakes on cryptography even after it becomes useless to do so, and after it becomes _necessary_ for America's future (commerce et al). -Allen

1 0

[NOISE] Employers need pseudonymous off-shore remailers
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Today, I tried to find out what it takes to hire someone who is in the US on a student visa (F-1) as a consultant or part-time employee. The person is an expert in his field. I don't know anyone available with a similar proven track record. I thought, no problem, there are INS exceptions for foreign experts. So I set on a quest to find out what it takes to get the INS to grant that person a work permit. The process is simple. All I have to do is ask the California Employment Development Department for a labor certificate, give that to the INS together with an application and the required fees, after which they'll issue the permit. Getting the certificate takes usually eight months, processing the application about four months. So the whole process takes about *a year*. I was stunned. Here I am willing to hire someone to work on a product that will generate taxes in the US, and the bureaucrats are asking me to wait a year. These people have lost any touch with reality. Not that *I* would do such a thing, but an off-shore pseudonymous remailer, with payment in ecash might go a long way... [Disclaimer: Speaking only for myself, not for my employer] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Why NSA is afraid that ITARs will be thrown out in court
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:45 AM 3/26/96, jamesd(a)echeque.com wrote: >At 12:23 PM 3/25/96 -0800, Timothy C. May wrote: >> Besides, I think the best way to overturn the >> ITARs is through a court challenge; as I have noted, even the NSA's lawyers >> felt that the ITARs would not withstand court scrutiny. > >Note that the spooks have carefully avoided a full bore court >showdown. They harassed Phil until the statute of limitations >caught up with them, but never brought it to trial. If we had >no further legislation, and the courts broke ITAR, we would >be home free. No plausible legislation could give us that. Someone said he had missed my reference to this, and wanted to know more. So, I'll also pass it on here again. In the summer of 1994 I got a call from Carl Nicolai, the inventor of the "PhasorPhone," an audio-scrambling phone that was suppressed with a Patent Secrecy Order (ordered by the NSA). This was around 1980-81, and is covered in Bamford. He told me a bunch of things, including this: Carl and his lawyer got access to papers inside the NSA building, though they could not make copies. They found memos from NSA staffers saying that the ITARs had never been tested in court and would not likely survive a full Constitutional test and that it would thus be best if court cases were avoided. I passed this information along (if memory serves) to Lee Tien, representing Gilmore in various cases, and to Phil Karn. (One of them, I don't recall which, posted a message a while later saying that such documents had been found....I don't recall the details, but this was probably around fall of 1994.) Whether this NSA paranoia has anything to do with the final decision on the Zimmermann et. al. matter is unclear, but it is likely that a very strong challenge to the ITARs--maybe the appeal by Phil Karn is such a challenge, maybe the Bernstein case--will result in big chunks of the ITARs being thrown out. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Edited Edupage, 24 March 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 26-MAR-1996 19:24:26.78 To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" CC: Subj: Edupage, 24 March 1996 ***************************************************************** Edupage, 24 March 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** >ONLINE TRADING >Lombard International Brokerage in San Francisco and Pawws Financial Network >in New Jersey are two brokerage houses that have opened Internet trading >services, allowing customers to monitor their portfolios and retrieve >corporate and financial information from brokerage databases or through >links to other Web sites. "You're seeing the culmination of the information >brokerage -- with customer service, advanced analytical tools, and news >available at one place and one time on the most incredibly productive medium >that ever existed, the Internet," says Lombard's CEO. By incorporating a >Java applet into their Web design, Lombard's Web site refreshes its >information every 30 seconds so that intra-day trading charts are >automatically updated. The Pawws trading system, a tailored version of the >Security APL cash-management system, is used by several other investment >houses to display their wares. "Why should we spend time and money to tell >people how to get a modem to work? We provide brokerage -- not technical -- >services," says one user. (Information Week 11 Mar 96 p64) And discount >broker Charles Schwab & Co. will begin this May to allow its customers to >trade listed and over-the-counter stocks, get real-time quotes, and access >account information using the Schwab site on the World Wide Web. (Atlanta >Journal-Constitution 22 Mar 96 F3) They're using _Java_ to do this? >PORN IS A GOLD MINE FOR IDT >Tiny IDT Corp. has found a way to differentiate itself from the >run-of-the-mill Internet access provider. It pitches its service to porn >aficionados, with ads like: "With IDT, I access *all* Internet services. I >said *all* Internet services -- get that smirk off your face." In fact, its >service and pricing are similar to everyone else's, but its subscriber base >has grown six-fold to 65,000 in the past six months using this approach. >"IDT is looking for a marketing niche, and given how we think the primary >Internet audience is -- lonely 20-something and 30-something males -- why >not aim that niche at them?" says Gary Arlen, an Internet consultant. (Wall >Street Journal 22 Mar 96 B4) An interesting way to differentiate oneself. I would suggest that anonymnity (i.e., C2) would be a logical add-on. >NETSCAPE TO GET IN ON THE PHONE-BY-INTERNET ACTION >Netscape co-founder Mark Andreessen says that within six months the company >will build into its Navigator program voice software (which it calls Insoft) >for making low-cost long distance calls via the Internet into its Navigator >program and that long-distance phone companies increasingly won't be able to >justify their rates for telephone service. (Sydney Morning Herald 13 Mar 96 >via Individual Inc.) Any possibility that Netscape might build in some form of cryptography? I realize ITAR rules would make this problematic, but perhaps some sort of out-of-country deal for putting in the hooks for PGPhone could be done. -Allen >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage Graham Greene (assuming that your name is Graham Greene; >if it's not, substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu and in the body of the message type: unsubscribe >edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.)

9 13

Sun patch pulled (was Re: HP & Export of DCE)
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I noticed that Sun's latest libc patch (101759-04) is empty. Previous versions contained the complete U.S. version of libc, including the tres-dangerous DES and crypt functions. In the current rev only the README remains, presumably because: EXPORT INFORMATION: This patch includes code which performs cryptographic functions, which are subject to U.S. export control, and must not be exported outside the U.S. without prior approval of the U.S. government. Prior export approval must be obtained by the user of this patch. So, you might ask, what fixes is Sun not distributing??? (Rev 04) 1190985 gethostbyname() can trash an existing open file descriptor. 1182835 portmapper silently fails with version mismatch by PC-NFS client 1219835 Syslog(3) can be abused to gain root access on 4.X systems. Yup, that's right. The syslog hole that was so well publicized by CERT will remain open indefinitely because the ITAR makes it illegal for Sun to distribute the fix! So did HP and Sun spontaneously, simultaneously develop crypto awareness, or is some gummint dweeb whispering threats in their ear?

3 2

Re: National speed limits and expansion of federal power...
by Chevelle 17 Dec '03

17 Dec '03

It was only months ago that they passed a bill raising alot of speed limits to the 75mph range. Chevelle At 06:06 PM 3/27/96 -0500, Deven T. Corzine wrote: >At 11:47 PM 3/26/96, Jim Bell wrote: >>They just recently repealed the national 55 MPH speed limit. Even though it >>was repealed by law, in the same way it was passed, plenty of people have >>argued that the Federal government has no jurisdiction in this area. Those >>arguments are absolutely valid, even if they were ignored. The danger in >>giving the government implicit authority in areas not mentioned in the >>Constitution is that it is not clear how far such justification extends. > >Actually, the national government didn't even *pretend* it had jurisdiction >here. Instead, they used an indirect approach -- they passed laws which >denied some of the existing highway funding to states with higher speed >limits than 55 MPH. (Later this limit was raised to 65 MPH, given some >additional restrictions such as proximity to population centers.) > >Any and all states were perfectly free (in theory) to ignore this "national >speed limit" and set any limit or no limit at all. In practice, no states >exercised this hypothetical freedom, because they had already grown dependent >on highway funds provided by the national government. Thus, through indirect >pressure exerted through the funding mechanisms, the national government was >able to usurp perogatives which were clearly in the domain of the states. > >The national government has expanded greatly in size and powers in times of >war and national crisis. In particular, FDR spearheaded the massive growth >of the national government in response to the Great Depression, and it has >continued to grow ever since. More and more often, the national government >usurps traditional state's roles, even in situations of unquestionable state >jurisdiction such as national speed limits. The elastic clause was one key >tool used for this expansion. > >Another key tool is the commerce clause, which has been seriously abused to >secure new powers for the national government. I don't think I'll go into it >right now... > >>If the government can limit us to 55, then why can't they limit us to 40-bit >>keys? > >The national government didn't impose 55 MPH speed limits on us, the states >did it under national pressure. As for whether they can legitimately limit >cryptography use and technology, we don't have any clear answer yet, in any >legal precedent. Of course, most of us hold the opinion that cryptography >should be considered Constitutionally protected as free speech, but politics >get involved when these things get decided... > >Deven > >

2 1

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

:: Subject: HP ships full DCE internationally As I sit, somewhere not in North America, I can see a CD-Rom from Hewlett-Packard, which I've had since last year. Recently I received the following letter. I've attempted to retype its contents accurately. ---------8<--------8<--------8<--------8<--------8<--------8<--------8< [HP Logo] Hewlett-Packard Company Software and Information Delivery Operation, SST 690 East Middlefield Road Mountain View, California 94043 415/968-9200 Dear HP-UX Support Customer, Hewlett-Packard has uncovered a bundling problem in the DCE-Core fileset that is on the October HP-UX Application Release 10.0 s700/800 Application CDs. These products were bundled such that they are not compliant with U.S. Government export regulations. The part numbers for the affected CDs and products are listed below. If you have updated your systems using these CDs or for the products listed on the October HP-UX Application Release Media, please update your system with the enclosed January HP-UX Application Release 10.0 s700/800 Application media, and destroy the October media. If you have not updated your systems with this media, please just destroy the October Application Release media and use the new enclosed Application media. If you require a replacement for the October HP-UX 10.0 s700/800 Application CD that has this bundling problem corrected, please contact your local support office to request shipment of the new CD. Hewlett-Packard apologises for any inconvenience you may experience due to this bundling issue. Sincerely [signed] Charles Henderson Software Information and Delivery Operations CD PART NUMBERS --------------- 24998-11710 SE application s700 10/95 24998-11711 SE application s800 10/95 B3782-10054 Trade application s700 10/95 B3920-13614 Trade application s800 10/95 PRODUCT NUMBERS --------------- 10.01 800 B3191A DCE CORE SRV MEDIA/DOCU INTL 10.01 800 B5162AA DCE 9000 Executive Client 10.01 800 B3519AA DCE QUICK START KIT INTL S800 10.01 800 B3923AA CICS/9000 Bundle Media & Manuals, Int'l 10.01 700 B2921A DCE Core Services International 10.01 700 B5162AA DCE 9000 Executive Client S700 10.01 700 B3519AA DCE Quickstart 700 Bndl Int'l Document P/N: 5964-5231 ---------8<--------8<--------8<--------8<--------8<--------8<--------8< Excuse me, I just have to go and destroy that CD :-)

1 0

Re: (X:x)e$ 's other use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 22-MAR-1996 05:45:53.77 >Digital cash, if people can be convinced to trust it, will be a wonderful >thing because of its security, convenience, and anonymity features. I'm >sorry, but I just don't buy this "corrupt currency" schtick. While corrupt isn't quite the right word, the dollar is a politically-influencable currency. And the politicians tend to press for higher inflation and lower unemployment, because that gets them elected. The Fed has done an actually rather admirable job of standing up to the pressure (compared to how they might have behaved), but that we've got real inflation testifies to that they haven't been completely successful. Moreover, the banks that are in the Federal Reserve network have a motivation to have low interest rates for what _they_ get charged, despite this inflating the currency... thus, they've got some motivations to mismanage things. -Allen

1 0