December 2003 - cypherpunks-legacy

Randomness paper
by rollo＠artvark.com 17 Dec '03

17 Dec '03

Those of you interested in the notion of randomness may want to check out "On the Effective Definition of 'Random Sequence'", a paper written by Michael Levin, Marvin Minsky, and me in 1965. For a paper copy, send a SASE (78 cents worth of stamps) to me: Rollo Silver / PO Box 219 / San Cristobal, NM 87564 If anyone can tell me how to post a highly formatted file, with equations, on the Internet, so that anybody can read it, pls let me know! That would be preferable to a paper copy -- but I don't know how to do it. Rollo Silver | e-mail: rollo(a)artvark.com | Artvark | Home page: http://www.artvark.com/artvark/ | PO Box 219 | Voice: 505-586-0197 | San Cristobal, NM 87564 USA | Compuserve 71174,1453 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

1 0

Re: Crypto CD UpDate
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thoughtful comments, so I'll comment on Henry's comments: At 6:10 PM 3/27/96, Henry Huang wrote: >I'd argue that having a slightly out-of-date CD-ROM is better than nothing, >because: > >- It gives you an idea of what sorts of crypto applications are out there, True, but your later point about who the intended market is makes the point I was making: the likeliest users pretty much know what they want and snarf the most recent (and debugged) version off the Net. (I have little interest, speaking as a user, in the zillions of variants of CryptDisk and SmartCrypt and whatnot that get mentioned here....I really only want "MacPGP" in its latest version, at this time, and for this the Web is certainly fast enough for me.) And I suspect I am not that unusual. The faster access to a CD-ROM is not too useful to most, as the time to install, learn, use, etc. a new crypto program is many orders of magnitude greater than getting it by even a 14.4 modem. >- If the authors are smart they'll include URL's to an update site > in the documentation (or the CD-ROM producer can do it), Indeed. Of course, many of these URLs will be dead within a few months of the CD-ROM being cut, so search engines remain the best way to find the actual sites and latest version. >- Not everyone out there is Net-savvy, or has the time to go trudging > around looking for the latest cutting-edge versions of software. > Time *IS* money. I agree. But they should learn to use search engines....even AOL and Compuserve are now offering such access to Alta Vista and such. Not to sound elitist--just realist--but anyone who wants "AmigaCrypt" and can't find a way to retrieve it from whatever obscure site that updates it with bug fixes, is lost. (And I think we have to be careful to remember the scope of Mr. Holiday's offer. What are the odds that he will become a nearly full-time archiver of interesting crypto programs and do the scouring of the Net/Web for interesting programs? What are the odds that AmigaCrypt will even _be_ on his CD-ROM?) >I'd almost argue that Tim's emphasis on using the Web to get crypto >assumes a sort of Net-centric view of how the crypto is going to be >used -- similar to reported provisions in the Leahy bill. The idea >that people who just want to encrypt personal data might not need the >latest versions of everything out there is reasonable -- as long as >the latest versions aren't BUG FIXES. ^^^^^^^^^^^^^^^^ Well, this is really what I had in mind as the main reason for using the latest version. Bug fixes that fix the actual crypto code may be less common than bug fixes that let the program work with the latest OS and such, but in either case it is important to have the bug fix. (Imagine the frustration of a user trying to run WindowsCryptomatic and finding, eventually, that the problem that prevented it from running in Windows 3.1 was fixed in WindowsCryptomatic 1.3? And that Mr. Holiday's opus only contained an early version of WindowsCryptomatic?) My essential point is that nearly any target user I can think of is going to zoom down the directory tree to his machine, his OS, his configuration, and then look for the handful of programs that work...the other 619 megabytes on the CD-ROM don't interest him. And he's going to want a robust, recent version. For nearly all target users, the Web is the ideal solution. (At least compared to a one-off CD-ROM....I haven't seen comments from Mr. Holiday recently, but I rather doubt he'll commit to an essentially full-time job of updating the CD-ROM. And of course, will customers buy it? This I doubt.) > >In that case, Tim's argument about stale versions would carry some >merit. But this is the case for ALL non-Net distributed software; you >don't see companies refusing to cut CD-ROMs simply because they're >worried their users won't be able to get the latest bug fixes. In the >ideal case, they'd do the best they can to make sure that people did, >but you have to be realistic. Companies cut CD-ROMs for lots of reasons. Often, it is much cheaper than distributing a dozen or more floppies. And manuals are often distributed online, in Postscript or Acrobat sorts of formats, thus cutting printing costs. If the Cypherpunks folks had a similar problem--distributing hundreds or thousands of floppies and printed manuals--then a CD-ROM would be a compelling alternative. Such is not the case, as the software already exists on the Web. So, what's the compelling reason, especially given the disadvantages cited? (An interesting question is why commercial vendors don't distribute on the Web. Well, some do. Netscape, for example. "Click to download." But large, expensive packages such as FrameMaker or Photoshop have other issues at hand--security, payment, lots of manuals, etc. I eventually expect more distribution via the Web. Not a wholly original thought.) >Plus, comparing the speed of a CD-ROM to a modem is like comparing the >speed of a station wagon to a skateboard. CD-ROMs aren't exactly fast, >but they sure as hell aren't anywhere near as slow as the water-torture >speeds of your average v.42bis modem. It depends on how narrow one's focus is. As I recall, it only took me a couple of minutes to download and automatically unbinhex/unstuff the latest MacPGP. I submit that _most_ crypto users and potential users have the same focus: they have little need to download tens of megabytes of programs, so the speed issue fades out. ... >I don't buy this. Many of the well-known/widely-used Net-distributed >crypto apps haven't put out updates for a LONG time. Even if it was the >case that they were throwing out bug fixes every two weeks, my previous >comments still hold. (And anyhow, you probably wouldn't WANT to have >software THAT unstable in your collection anyway. ;) I wouldn't. To answer this question we (or Mr. Holiday) need to look at some numbers: -- the frequency of "significant" updates for products -- the frequency of updates of Mr. Holiday's proposed CD-ROM I could give anecdotal experiences, but why bother. (I'll give one: I downloaded PGPhone, for the Mac only initially, the day it became available at the MIT Web site. For various reasons, I couldn't get it to work. This was last fall. I understand a new version that fixes some problems now exists, several months later. So, a CD-ROM that had the version of last fall would not be too interesting.) My guestimate is that a CD-ROM of crypto programs would have to be updated TWICE a year, consistently, to be useful. While I know nothing about Mr. Holiday (itself a reputation issue, not meaning any disrespect to Mr. Holiday), I do know that most "volunteer" projects follow a characteristic lifecycle: initial excitement, a "let's put on a show!" attitude, hard work to get thet first release out, a period of recuperation, and then, often, abandonment. (I plead guilty to this on my Cyphernomicon. There is no way in hell I'm going to devote months of my life to trying to keep it current, especially when it's so much easier now to just use Alta Vista to search Web pages and Usenet articles for keywords and concepts.) >I'm starting to think that the question of whether this CD-ROM is useful ^^^^^^^^^^^^^^^^^ This is where I started from! >depends on who you're selling it to. People who hang out on Coderpunks, >or are "in the loop" as to version updates and crypto sites won't want >this. People who want to buy the CD just to be "cool" aren't an issue. Indeed on both of these points. >The SOHO market (i.e. people who don't normally use the Net, and who >ordinarily wouldn't care too much about crypto) seems to be the ideal >target. But how do you sell a piece of software to an audience that >doesn't know it needs it? Indeed. Plus, the whole idea of "selling" this CD-ROM will trigger resistance. (I'm not saying Mr. Holiday doesn't have a right to try to sell it--though he may find that he'll have to be _very_ careful and diligent on getting appropriate releases, else he could find himself in hot water if even a _single_ author objects to having his program on such a CD-ROM!) >Perhaps this could be a chance to spread the gospel, so to speak. However, >that would mean the CD would have to be designed around these people -- >i.e. for ease of use, etc. These issues have probably been beaten to >death a long time ago (e.g. PGP shells), and shouldn't be too difficult >to resolve. The multi-platform stuff (DOS/Mac/**IX on one disc) will >be harder; you'll need to code a different interface to the CD for each >platform. Now this project is turning into a Big Project. Good luck! > >Hmm, do I hear a volunteer for writing that Crypto Software Web page? ;) > Actually, I've found there is no need for a specific page. There are hundreds of pages that have links to thousands of other pages. Maybe I've just gotten "searchcentric," but I rarely go to specific pages anymore to find information. Instead, I keep Alta Vista always ready to go and use it to zoom in quickly. These "metapages" are better than pages! --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:27 AM 3/27/96, Herb Sutter wrote: >If you'll excuse a European joke: "Q: What does a European call someone who >speaks four languages? A: Gifted. Q: Three languages? A: Bright. Q: Two >languages? A: Normal. Q: One language? A: American." :-) (No, this isn't >a snub, it's just meant in good humour; it applies to a lot of us Canucks >too even though we do have two official languages. Heck, I apply it to >myself; my French is rusty, I haven't used it in over 12 years.) A girlfriend of mine was born in Denmark and spoke four languages (Danish, English, German, and French) before immigrating here at the age of 19. Danish was of course her native language, English is taught in all countries of Europe as a _lingua franca_ (ironically), German because the Danes have the Germans as neighbors, and French as her "elective." For Europeans, knowing the language of one's immediate neighbors (probably only a hundred kilometers away), and knowing English, accounts for much of their language facility. Americans are typically thousands of miles away from those speaking Japanese, Mandarin, Tagalog, Polish, Italian, Dutch, Spanish, Hindi, Talegu, and the hundreds of other languages. It is not at all clear what language Americans should pick as a "second language" to study. (Myself, I studied some German in high school, largely because in the 60s this is what science folks were expected to take. Artsy craftsy folks took French, and the slackers took Spanish. The real wonks took Latin, mainly to help them on their verbal SATs. Russian was offered as a trendy addition, later replaced by Mandarin and Japanese, the supposedly "essential business languages of the future," which have turned out not to be essential at all.) Europeans who look down on Americans for not studying the language of their neigbors simply aren't familiar with a map. The one language that a neighbor of ours differs on is Spanish, and this language is, for various reasons, useful mainly in infrequent vacations in Mexico, for speaking to gardeners and maids, and for giving instructions to day laborers and factory workers. Inasmuch as all Mexican hotels and restaurants understand English, and inasmuch as not many Americans travel to Mexico for other than vacations by the sea, etc., things become clearer. There is not a single foreign language I can think of it that would help me in my goals or help anyone I know. This is the reality of a world dominated by English-speaking persons and in which all technical people learn English. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 7

ITAR double standards?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I think there's been ample evidence that the ITARs are often used to harass U.S. companies that "won't play ball," that refuse to go along with certain governmental policies. (Part of the think we libertarians hate about Big Government and Lots of Laws is that government can use selective enforcement an another lever of power. As a felon, I am acutely aware of this power.) Something Black Unicorn/Uni/Dirsec/whatever said reminded me of something interesting: At 8:45 PM 3/25/96, Black Unicorn wrote: >Further, a entirely foreign production, say for chip manufacture, would >probably make things easier. I had specifically contemplated hardware >applications. Indeed, there are problems with both, but they don't stem >from ITAR. Now when I was with Intel, we made many of our chips in plants in Ireland, Israel, and other locales outside the U.S. Some of these chips were forbidden for export by the ITARs. And certainly the knowledge of the engineers sent overseas was comparable to the knowledge of RSA programmers.... (Before anyone points out that Intel presumably was not skirting the ITARs by drop-shipping chips from Ireland directly to non-U.S. countries. This is indeed the case. My point is a slightly different one. Read on.) So, did Intel have to apply to the State Department's office on munitions exports in order to send engineers to Malaysia, Israel, Germany, Ireland, etc., to do development work? Not that I ever heard. Engineers simply hopped on planes and that was that. (I suspect the same is the case with programmers at RSADSI, Microsoft, etc. That is, people ignore the Munitions Act laws which--it is argued by some--forbid the export of "expertise.") Where am I going with this? It seems to me that crypto companies could point out to the ITARs/Munitions Office/etc. folks that vast amounts of "sensitive technologies" are being developed and built by U.S. companies in offshore locations without so much as a ripple of publicity or concern. (I should note that in several examples I can think of, the engineers I mentioned who were relocated to these offshore locales for chip development later left the companies that moved them offshore and started or joined competing companies. Sounds like an exact parallel to the dreaded "RSA moves development to Switzerland" scenario that so many of us have urged.) And yet mention that a crypto company is considering a move of its key development folks to Switzerland or Austria or Zambia and watch the sparks fly. Sounds like a double standard to me, meant to exert pressure on the crypto companies (whom the U.S. government, it is clear now, would just as soon see put out of business or strictly controlled). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: HP & Export of DCE
by Dana W. Albrecht 17 Dec '03

17 Dec '03

> Adam Shostack writes: > > Well, if Leahy passes, DCE is exportable. Anyone know if the > > 'SecureRPC' in DCE is the one BAL broke years back? > > No, they broke Sun's Secure RPC, which is different. > > I must admit that I've never done a serious security analysis of DCE > RPC, though... > > Perry Where can one find detailed information regarding the (in)security of Sun's "Secure" RPC? Specifically, pointers to actual papers by those who have compromised it (both in theory and practice as relevant) would be appreciated. Thanks! Dana W. Albrecht dwa(a)corsair.com

1 0

Re: What backs up digital money?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:39 PM 3/27/96 -0800, Mike Duvos wrote: >Real electronic currency could be invented, but would have to >live its life within a population of tamper-proof smart cards >communicating with each other through secure protocols. Whether >anyone will bother to implement such a system remains to be seen. Sounds like the Mondex system, so I guess someone already has. I think the url is www.mondex.com, but I could be wrong. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: unsubscrive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:13 PM 3/27/96, Maurizio wrote: >unsubscrive cypherpunks Ah, a new spelling to be added to the archives. So far, we've got: undescribe unscribe unsubbscribe The penalty for not paying attention being continued receipt of 50 mail messages a day! --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

unsubscrive
by Maurizio 17 Dec '03

17 Dec '03

unsubscrive cypherpunks

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 3/27/96, Alan Bostick wrote: >In article <ad7e4b691902100484d7(a)[205.199.118.202]>, >tcmay(a)got.net (Timothy C. May) wrote: > >> Americans are typically thousands of miles away from those speaking >> Japanese, Mandarin, Tagalog, Polish, Italian, Dutch, Spanish, Hindi, >> Talegu, and the hundreds of other languages. It is not at all clear what >> language Americans should pick as a "second language" to study. > >What continent do you live on? As I write this my next-door neighbor's >stereo is blaring out music in Yoruba. When I took my mother to the Your point being? My point was not that America is monolingual but that, in fact, the polyglot nature makes no particular language or small group of languages stand out as a compelling candidate for study. You want to study Yoruba, fine. It might be interesting. It might help you to follow the lyrics of your neighbor's music. But I don't find it compelling to study in the same way that English is important to study. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Let's *NOT* "Raise their Awareness"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:23 AM 3/27/96, Charles Bell wrote: >Yes, and some years ago a State legislature (I forget which) passed a >resolution setting the value of pi at exactly 3. I'm not sure how they >planned to enforce their will. Do you know how the Texas judge means to >enforce his? By the way, this is a wonderful story to tell about the stupidity of government, but, alas, most of it is urban legend. The Tennessee or Kentucky (I forget which) state legislature did not actually pass such a law....it was merely _proposed_ by some particular legislator, and then never acted upon. (I suspect an Alta Vista search might turn something up on this.) As to the Texas court order...all sorts of restrictions are often imposed in divorce custody cases (which this is). Sometimes it's that a child shall not be exposed to second-hand smoke from one of the spouses (this has happened here in California, such restrictions, that is), sometimes it's other things. Enforcement is by testimony of the child and reporting of violations to the court. Child Protective Services probably has no involvement. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: <languages>
by Asgaard 17 Dec '03

17 Dec '03

I agree that for a native English/American speaker to learn other languages is mostly a waste of time (if you are not a spy; or businessman having to deal with constipated French etc). Only if you permanently move to another country the situation gradually becomes different. Americans who move to Sweden (we had a lot of Vietnam war 'deserters' coming way back) can keep on speaking American for a year or so without anyone taking notice (actually if the American tries to speek Swedish the Swedes may deny him to do so, they love to train themselves in speaking English), but then when years pass bye and the American still loves the special attention he receives as an American-speaker and refuses to learn Swedish, the situation will become awkward. I studied German, French, Italian and Russian and am still moderately fluent in German, but I care less and less to keep these languages up since English is more and more becoming the World Language. Asgaard

1 0

RE: ITAR double standards?
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May >You're a felon? For real? > Yes. ................................................................. Ah, yes - Tim the Indecent, vis-a-vis X-onomous signatures. Sheut. I thought maybe you'd done something really interesting. .. Blanc

1 0

HP & Export of DCE
by Adam Shostack 17 Dec '03

17 Dec '03

Well, if Leahy passes, DCE is exportable. Anyone know if the 'SecureRPC' in DCE is the one BAL broke years back? I asked a few DCE supporters this, and never got an answer, so I suspect they're still shipping bogus crypto. Adam ----- Forwarded message from Anonymous ----- As I sit, somewhere not in North America, I can see a CD-Rom from Hewlett-Packard, which I've had since last year. Recently I received the following letter. I've attempted to retype its contents accurately. ---------8<--------8<--------8<--------8<--------8<--------8<--------8< [HP Logo] Hewlett-Packard Company Software and Information Delivery Operation, SST 690 East Middlefield Road Mountain View, California 94043 415/968-9200 Dear HP-UX Support Customer, Hewlett-Packard has uncovered a bundling problem in the DCE-Core fileset that is on the October HP-UX Application Release 10.0 s700/800 Application CDs. These products were bundled such that they are not compliant with U.S. Government export regulations. The part numbers for the affected CDs and products are listed below.

7 11

Re: So, what crypto legislation (if any) is necessary? (Was List O' , shame)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:32 PM 3/25/96 -0500, Black Unicorn wrote: >All it would take is one anti-trust case with encryption as a concealing >method and people would be busting down doors at night looking for PGP. Back in the dark ages, IBM built an audio messaging system. It was quite popular in "cave of the winds" (IBM headquarters) because it allowed busy executives to leave audio memos for each other without needing a secretary to type them. Since storage was limited, and old messages were purged from the system it also had the effect that anti-trust discovery would have nothing to discover. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Sun patch pulled
by Mark 17 Dec '03

17 Dec '03

>I noticed that Sun's latest libc patch (101759-04) is empty. Previous >versions contained the complete U.S. version of libc, including the >tres-dangerous DES and crypt functions. In the current rev only the >README remains, presumably because: > EXPORT INFORMATION: This patch includes code which performs > cryptographic functions, which are subject to U.S. export > control, and must not be exported outside the U.S. without > prior approval of the U.S. government. Prior export approval > must be obtained by the user of this patch. The 101759-?? patch is missing from the Feb 1996 SunSolve Patches CD. However if one pops in the November 1995 Patches CD there is a nice little copy of the 101759-03 patch which also comes with the above warning and the DES enabled libraries. The Patches CD's are openly sent around the world by Sun Support, one CD for all the world. Cheers, Mark

2 1

Re: Why Americans feel no compulsion to learn foreign languages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:13 AM 3/27/96 -0800, Timothy C. May wrote: >There is not a single foreign language I can think of it that would help me >in my goals or help anyone I know. This is the reality of a world dominated >by English-speaking persons and in which all technical people learn >English. I would agree with you, except I started International Caving. When in Hungery, I heard, "Peter will guide you thru the rest of the cave. Don't worry, he speaks good German." Fortunatly, my German was good enough. While in China as a normal tourist, a travel agency in Yichang tried to extort $600 from our group. My wife's (very poor) knowledge of Manderin probably scared the preps enough to get them to lay off. BTW - There are also French speakers on the US border. They don't want to speak english either. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: unsubscrive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:20 PM 3/27/96, David K. Merriman wrote: >Well, at least this one is *vaguely* forgiveable - the 'b' and 'v' keys >*are* next to each other on a keyboard.... A nice theory, but he uses the misspelling in the thread title ("unsubscrive") and in his body message of "unsubscrive cypherpunks." If he mistyped, it happened twice in the same way. (And I try to always check my spelling carefully when I am sending commands to a majordomo-type automatic processor!) "Measure twice, cut once." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:05 PM 3/27/96, Rich Graves wrote: >Undeniably true. I think Tim's point was more, "Who cares? Everyone *I* >want to talk to speaks English." > >One may quibble with the wisdom or morality of such a statement, but if >the second statement is true in your case, then there is no reason you >should have to learn another language. Most upper-income Americans have no >need for esoteric languages. Almost all upper-income Americans have a need >for English. Yes, this is mostly my point. And it is not just me I'm talking about--I don't see a compelling need for 95% of Americans to learn a second language...in fact, I'd rather they learned to speak and read English properly. (All of the America-bashers who were chiming in earlier today with their anti-American jokes...well, here's one for you: "What do you call someone who knows how to speak and write English properly? A European.") I don't deny that Alan Bostick needs to take a class in Yoruba so he can communicate with his neighbor, nor do I deny Michael Helm's point that by not studying Talegu we are denying ourselves access to the world's culture. In my next 25 lifetimes, with the advent of Nanocryonic Revitalization, I certainly will try to learn several of these obscure languages. Father Guido Sarducci has a nice routine in which he describes what happens to our high school Spanish in the several years after taking it. After the fourth or fifth year, all we remember is "Como esta?" (I took German, not Spanish, so my spelling is phonetic, from his dialog.) The point being that very few Americans have any _continuing_ way to use the languages we learn. Which is a major reason they are being dropped by many schools. Even in areas with lots of Mexicans and other Latinos, few opportunities. (Your mileage may vary, but I think this is generally so.) My sister lives near Miami and finds no need to brush up on her Spanish. The educated Cubans and ohter Latinos all speak English fluently, and the uneducated Mexicans and the like she has no need to communicate with. (No doubt some of the politically correct will once again denounce me as a racist. This is not racism, just reality. And to some, the truth hurts.) There is an "information theory" interpretation of learning foreign languages. Where I live, the issue is not that there are not native speakers of foreign languages...the issue is that no single foreign language stands out as being desirable to learn, except for one's personal edification or circumstances. So what languages should schools offer? French and German are not common in California, or the U.S. in general, and the languages of the immigrant communities (Spanish, Vietnamese, Tagalog, Laotian, Korean, etc.) have little use except in communicating with these communities. And they are all busy learning English.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: NSA/ITAR
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:43 PM 3/25/96, Vladimir Z. Nuri wrote: >TCM: > >>* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. >>companies, but is not _per se_ an issue I worry about. So long as I have >>strong crypto, I don't really care too much about export. It would be nice >>to get the ITARs modified, but not at the risk of adding language (such as >>Leahy did) making use of encryption a possible crime (we've debated this, >>so I won't elaborate here). Besides, I think the best way to overturn the >>ITARs is through a court challenge; as I have noted, even the NSA's lawyers >>felt that the ITARs would not withstand court scrutiny. > >hmmmm, I don't recall you saying that. would love to hear more about >"NSA's lawyers feeling the ITAR cannot withstand court scrutiny". My most recent mention of this was a few days ago, where I cited Carl Nicolai, inventor of the suppressed "PhasorPhone," as my source. He and his lawyer got access to papers inside the NSA building, though they could not make copies. They found memos from NSA staffers saying that the ITARs had never been tested in court and would not likely survive a full Consitutional test and that it would thus be best if court cases were avoided. I passed this information along to the Lee Tien, representing Gilmore in various cases, and to Phil Karn. --Medusa

1 0

Re: WSJ on Big Java Flaw
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 11:07 PM 3/26/96, Steve Gibbons wrote: .... >Actually, I suspected and reported the same bug some weeks before the group at >Princeton. <URL: http://www.aztech.net/~steve/java/~>. That said... .... Thanks for the pointer. I found it most interesting. I suppose that I am glad that I am not the only one who doesn't know how DNS works.

1 0

RE: Weapons & Hope
by Eric Anderson 17 Dec '03

17 Dec '03

---------- From: Duncan Frissell[SMTP:frissell@panix.com] Sent: Tuesday, March 26, 1996 8:42 AM To: cypherpunks(a)toad.com Subject: Weapons & Hope While it might be barely possible in the mass production age to control weapons by blocking the flow of these specific products (a Streetsweeper, say) into the marketplace, it will clearly not be possible in the age of custom production. General machines will be available to produce specialized products (often under the direct control of the customer, himself). Some of this custom production will be weapons. I took machine tool operations @ my local community college. suffice it to say, good, high-quality firearms are **EASY** to fabricate (Believe me!) So my point is this: Just as the Gov't CANNOT prevent me from making a gun in my basement, whats to stop some high-school juinor from writing a strong crypto program? I can just see Chuckie Schumer introducing (W/ Sen. Fine-Swine as co-sponor) a bill to ban "Cyberwar Software" i.e. mandatory registration of compilers, mandatory GAK, etc... What an asshole. Take care, Eric

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

The syslog problem is fixed in baseline SunOS 5.5. Sun and HP are apparently doing what the stupid law mandates - and they should do so, whether someone at NSA (or whatever) is on their case or not. :) They should also have someone in their respective legal departments bucking ITAR very hard. "tres-dangerous" must have been typed with a snear, no? ECafe Anonymous Remailer wrote: > > I noticed that Sun's latest libc patch (101759-04) is empty. Previous > versions contained the complete U.S. version of libc, including the > tres-dangerous DES and crypt functions. In the current rev only the > README remains, presumably because: > EXPORT INFORMATION: This patch includes code which performs > cryptographic functions, which are subject to U.S. export > control, and must not be exported outside the U.S. without > prior approval of the U.S. government. Prior export approval > must be obtained by the user of this patch. > > So, you might ask, what fixes is Sun not distributing??? > (Rev 04) > 1190985 gethostbyname() can trash an existing open file descriptor. > 1182835 portmapper silently fails with version mismatch by PC-NFS > client > 1219835 Syslog(3) can be abused to gain root access on 4.X systems. > > Yup, that's right. The syslog hole that was so well publicized by > CERT will remain open indefinitely because the ITAR makes it illegal > for Sun to distribute the fix! > > So did HP and Sun spontaneously, simultaneously develop crypto awareness, > or is some gummint dweeb whispering threats in their ear?

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:22 AM 3/28/96 -0800, Timothy C. May wrote: >... In any case, the issue is not the >classes taken by _some_ (the few percent who study Russian, Japanese, >Mandarin, etc.), but the topic of this thread: "Why Americans feel no >compulsion to learn foreign languages." I, at least, want to know something of the language of the countries I travel in. Being able to get a meal or a room for the night is useful. As a rock bottom minimum, I want to know the phrases: Hello, Good by, Please, Thank You, More beer please, and Where's the bathroom. The look of pleased surprise on the face of the Budapest resident when I said "Thank you" to in Hungarian as he gave up his seat to me because I was loaded down with caving equipment is something I still treasure. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Blanc Weber writes: > Perry, here's a question for you, and I am seriously interested in your > answer: [...] > what, then, would you yourself consider proper for discussion here? > [in the context of digital cash discussion] I'd say that anything directly dealing with digital cash, its implications, deployment, and technical issues associated with it. General discussions of whether the Federal Reserve is a bunch of evil old men and the like are what are out of bounds. This means: "How does blinding work" and "Do you think that digital cash systems will hurt bank regulatory supervision" are fine things to talk about but "Do you think the Federal Reserve issues counterfeit money" are not. Perry

1 0

Re: firewalls and CKE (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

Marcus Ranum posted this to firewalls. Contains some interesting technical arguments against key escrow at the firewall level. ----- Forwarded message from Marcus J. Ranum ----- >From firewalls-owner(a)GreatCircle.COM Mon Mar 25 21:26:27 1996 From: "Marcus J. Ranum" <mjr(a)clark.net> Message-Id: <199603252204.RAA01115(a)clark.net> Subject: Re: firewalls and CKE To: mckenney(a)smiley.mitre.org (Brian W. McKenney) Date: Mon, 25 Mar 1996 17:04:41 -0500 (EST) Brian W. McKenney writes: >I missed the jist of the original message The gist of the first message was that software key escrow is here, and it is the greatest thing since the discovery of fire. :) Granted, it's nice that someone has found a way of convincing the government to let them export good crypto, but in this particular application it makes no sense. >For the firewall-to-firewall encryption >scenario, the data recovery component (DRC) may be a machine that >intercepts (in real-time) the traffic and then decrypts the data (recovers >the data). The interception of encrypted data makes sense for this type of >communication since the data is not really stored on the firewall (it is >wrapped/unwrapped quickly). [the intercepted packet may be copied and then >decrypted] That's completely brain-damaged if you think about it for a second. Let's suppose I have a file and it is unencrypted. I FTP it through my SKE-equipped firewall to the Paris office. My file gets transparently encrypted as it is broken into packets and sent across the 'net. Then - what - someday I need the file back so I get the escrowed key and reassemble the file from raw packets? That's dumb! I dunno about you but I'd just recover the clear file from a backup tape. :) Firewall-to-firewall encryption is a link-layer security technology. It encrypts data in transit: before it leaves and after it arrives you *already* have a clear-text un-escrowed version of the data. If I have a corporate requirement to "escrow" my telnet sessions then I'll use a version of telnet that logs keystrokes. But I can't see any reason (unless I'm a spook) to de-archive, de-escrow, and reassemble a telnet session for archival purposes. It gets worse since all the "escrowed" packets will be mishmoshed in with DNS queries (all "escrowed") and NFS packets and lordy knows what else. If it came to having packet records, why not simply log all packets *before* they get encrypted at the firewall, while they are still in the clear? Easier, no? At least LOTUS' "key escrow" approach is openly designed for the spooks and doesn't pretend to add value to the end user. I appreciate that TIS has made a successful deal with the devil to export some strong encryption, but it's unfortunate that they're showcasing it in a way which makes absolutely no sense at all. It's a shame, because basically we're seeing smart people doing technically goofy things in order to comply with some ridiculous laws. mjr. ----- End of forwarded message from Marcus J. Ranum -----

1 0