December 2003 - cypherpunks-legacy

WARNING: Major Net-Abuse
by Z.B. 17 Dec '03

17 Dec '03

I don't know the full details about this, so I'll try to give as good an explanation as I can. Since sometime yesterday, someone has been posting huge binaries all over Usenet, usually to at least 20 groups at a time. The files are usually several thousand parts big at the least, and are posted to either groups in which people are likely to respond with emailbombs, or test groups that send you a reply if the message appears on them. What some $#&!@-heads are doing is changing the Reply-To headers to the addresses of people who they dislike or want to harass. See where I'm going now? 10000 posts to a test group with your address on it = 10000 emails in your inbox. I posted this because there are some people on both of these lists who might be the target of one of these spams, and you might want to get your killfiles ready, just in case. Thanks for your time, and sorry if I annoyed anyone with the off-topic post. --- Zach Babayco zachb(a)netcom.com <----- finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127

1 0

Re: The GAK Momentum is Building...
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 17 Sep 1996 21:02:03 -0700, Lucky Green wrote: >>On Tue, 17 Sep 1996, Timothy C. May wrote: >> However, making the government a _required_ part of such plans implies a >> motive that is not at all the same as what companies wish (mostly, disaster >> recovery). > >The required part will come later. Meanwhile, many big players in the >industry are volunteering to include GAK for you. It seems that in order for this to work Net consumers must be convinced/coerced into accepting the GAK security features. What if, due to a grassroots uprising, Neters refuse to use products which require GAK or Net services which will only operate via GAK? Isn't there an great opportunity being created for S/Wan, Apache and its ilk and third-party (especially off-shore, non-COCOM, produced) security plug-ins? > >When I asked the fellow from HP that proposed the CommerceNet position >paper how the "voluntary key recovery" he was proposing on his slides >could possibly aid law enforcement against criminals who obviously >wouldn't "escrow" their keys, he said, and I am not kidding: > >"There are many possible interpretations of the words voluntary and >mandatory." I was the *only* person in a room full of people working in the >industry that seemed bothered by this. > >> Furthermore, the main worry (for me, at least) is that the government hopes >> to get its Clipper IV scheme accepted (by means of export laws) at some >> large fraction of important corporate accounts, not the least of which will >> be Netscape, Microsoft, IBM, Oracle, Qualcomm, and suchlike major players >> in the "infrastructure" business. Once most of these have "bought off" on >> GAK, pressure will be intense to universalize the process, to make it a >> felony _not_ to use a "Key Authority." > >That's exactly how it will be. Enacting laws which make criminals out otherwise upstanding citizens is the surest path to civil disobedience/unrest, disrespect for duly constituted government and more serious criminal behavior. I guess I and many friends will be on posters in the Post Office. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

3 2

Re: Workers Paradise. /Political rant
by Llywarch Hen 17 Dec '03

17 Dec '03

"In July, Mr Lee [Kuan Yew, senior minister of Singapore] described an insight that came to him watching a sheepdog show in Australia. You start off with a group of young puppies, and 'weed out those who are not going to be successful . . . You either have those qualities or you don't.' It was, said Mr Lee, 'the simplest of all the lessons in life.' From _The Economist_, September 14th 1996. -- Llywarch Hen

1 0

Re: PGP in the workplace
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:20 AM 9/18/96, Rick Osborne wrote: >Upon explaining to them that I was simply trying to make sure of my own >security, I was told that I was to just assume that I was secure, and that >*any* 'poking around' was found to be "highly aggravating" and could only >only "exascerbate the situation further." > >Luckily, I had to get to class, so I cut the conversation before it could >get any more out of control. > >Now, seeing as I'm fairly new to the Corporate world, but is this something >common? I know when I was at college, poking around was expected and >encouraged, as it helped find and plug holes in the system. But this is >almost like some kind of protection racket here! Sadly, this is common. Anybody taking undo interest in security "must have something to hide." Be aware that the effects can be a lot worse than just "being noticed," or even of being dismissed. Companies have been known to call in the police. (And since you are posting with a "Grumman" account, this could trigger visits by the DIA and other such agencies.) This happened in a well-publicized case up north, and I am convinced (from reading some of the details) that the programmer was not doing anything criminal. Even many who worked with him have expressed the same views, that he was just an unusually curious and attentive security expert. Some of them tell me they--and their employer!--were surprised the case actually went to trial. But the DA decided, for whatever reason, to prosecute on felony charges. I can only speculate about the pressures, the desire for publicity in a trendy new area ("computer crime"), and about the relative importance of this employer to the local economy. So, don't get too curious. Don't change your passwords more than your neighbors do (or at least not more than 2.13 standard deviations more often than is the statistical average of all employee-units within 7 cubicles of you in all directions). And whatever you do, never, never, never point out security flaws. This is a sure sign of your guilt. Or your smarty-pants attitude, which is actually worse. (Never cast perls before swine.) (All of this is explained daily in "Dilbert," of course.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Codex Sample
by SpyKing 17 Dec '03

17 Dec '03

Attached... This communication is copyrighted by the author. 1996, All Rights Reserved. Interception, forwarding, posting/re-posting of all /or any part of of this message is a violation of U.S. Copyright laws and may result in civil or criminal action against violators. The Codex Surveillance & Privacy Newsletter - http://www.thecodex.com

1 0

Re: Quantum Computers
by Rick Osborne 17 Dec '03

17 Dec '03

I rather enjoyed this article, especially the part about: >It gets even wilder, because the quantum mechanical state of the >matter in the machine's memory determines the output, Seth Lloyd >of MIT thinks you could run the machine in reverse and the result >would be a quantum mechanical micromanipulator. This was great! So where do we plug in the nice hot cup of tea? ;^) I'm sorry if I seem to be making light of a very serious topic, but, last time I checked, computers don't have a reverse. Spam me, flame me, whatever, but as far as I know, the universe only goes in one direction. It's just a rehash of the old sci-fi dramas about building a computer that goes on and builds a smarter computer, ad infinitum. That's one of the problems of non-sentient things: they can't grasp anything beyond their scope. But, for argument's sake, let's assume: 1. This quantum computer, which looks startlingly like my HP48, has a slider labeled: FORWARD -- STOP -- REVERSE And the slider actually works. 2. We are working with a finite-state quantum computer (say 32 qbits worth). 3. There is NO error introduced into the system from any source, including itself. Okay, so I turn my little QC48 on, just to set a state, and then slam the slider into REVERSE. AT this point, it fizzles and dies. Why? Because of the same reason you can't just put the DES algorithm 'in reverse': the quantum equivalent of s/p-boxes. What am I talking about? I'm talking about a QUANTUM COMPUTER here. Remember it's greatest asset? It does every calculation at once. This is exactly why you can't go backwards. You have nowhere to go, because you have EVERYWHERE to go. Because at each 'quantum tick' of the 'quantum clock' EVERY possible operation is going on, each state has the possibility of leading to every other state. Now, let's throw out assumption #3, and deal with a slightly more realistic version of my QC48, the QC48SX. Because we're dealing with a computer that produces error in it's own system, the error is going to be relatively hard to keep track of. Notice that the error-correction schemes listed don't eliminate error, they just help thin it out. So you've got your result to the operation you just performed: OP1 + OP2 + OPERR = RESULT The error-correction protocol makes OPERR small, but it doesn't eliminate it. So this is when I throw it into reverse. (Sure, I could have kept track of all my operations up to that point and trace back along them with no problem, but I can only do that until the point at which I turned on my QC48SX, so let's just assume I didn't keep track.) I've got RESULT now, and with a reasonable degree of accuracy, I can statistically figure out what two states led up to that point, with a margin of error STATERR. This is made even tougher by the fact that there was an error (OPERR) in the system to begin with. Remember now, every state can lead to every other state, but let's assume we've got NSA-level statisticians here, and STATERR is relatively small. You now have STATERR*OPERR working against you. This is where working in a finite-state machine is good, as it keeps these values relatively small. But they are still there. These errors, in combination with the quantum-s/p-box factor, precludes you from going backwards with any degree of reliability. Like I said, I'm not trying to tear down anyone hopes and ideas, I just want to introduce a little *reality* into our system. ____________________________________________________________ Rick Osborne osborne(a)gateway.grumman.com "Yes, evil comes in many forms, whether it be a man-eating cow or Joseph Stalin, but you can't let the package hide the pudding! Evil is just plain bad! You don't cotton to it. You gotta smack it in the nose with the rolled-up newspaper of goodness! Bad dog! Bad dog!" - The Tick

1 0

Re: Redundancy in XOR encryption
by Brian Durham 17 Dec '03

17 Dec '03

1 0

Re: Fear of Flying -- from HotWired
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 17 Sep 1996, Adamsc wrote: > >> On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >> >> >>... former CIA director James Woolsey: responded with some seemingly >> >> gratuitous anti-Net >> >> rhetoric. Terrorists may use biological weapons like anthrax, he said. >> >> "Anthrax is colorless, odorless, and has a 90 percent lethality. One >> >> gram has 100 million lethal doses." Then Woolsey delivered the zinger: >> >> "The knowledge of how to make anthrax is widely available, including >> >> on the Internet." >> >> >Gee, biotech has come a long way. Now I can download the Anthrax DNA >> >sequence from the net and insert it in some carrier bacteria and start >> >making Anthrax bacteria. Neat! > >Culturing and growing anthrax is painfully simple. No DNA required. > >> >BTW - My dictionary says that Anthrax is primarily an animal disease which >> >only occasionally infects humans. It sounds like a poor choice for bio-war >> >terror. > >Incorrect. It is highly problematic and very nasty when it is properly >delivered. The hardest thing about anthrax is to get an areosol fine >enough to present an inhalation risk. (This is why it does not >generally cause problems in humans- it's rare for it to get this fine). > Why not learn from the pros: IRAQI BIOLOGICAL WARFARE [BW) DEVELOPMENTS Filename:0119pgv.00p [ (b)(2) ] [ (b)(2) ] SUBJ: IRAQI BIOLOGICAL WARFARE [BW) DEVELOPMENTS 1. [ (b)(1) sec 1.3(a)(4) ] IRAQ ACQUIRED FORTY HIGH PERFORMANCE AEROSOL GENERATORS IN THE SPRING OF' 1990 OSTENSIBLY FOR SPRAYING CROPS WITH PESTICIDES. THE GENERATORS WERE CUSTOM BUILT TO DELIVER EITHER LIQUID OR DRY MATERIAL EITHER SIGNLY OR SIMULTANEOUSLY. THE GENERATORS CAN DISTRIBUTE FIFTY LITERS PER MINUTE [3-,0O0 LITERS PER HOUR OR APPROXIMATELY 800 GALLONS PER HOUR) THROUGH A CUSTOM DESIGNED NOZZLE[S] WHICH PERMITS THE AEROSOL TO BE ADJUSTED TO TEN DIFFERENT PARTICLE SIZES. THE DISSEMINATION OUTLET CAN BE ROTATED ONE HUNDRED AND EIGHTY DEGREES THEREBY ENABLING DISSEMINATION HORIZONTAL TO GROUND OR WATER SURFACES, OR UPWARDS AT AN ANGLE PERMITTING PREVAILING WINDS TO CARRY THE AEROSOL. THE IRAQI ENTITY WHICH ACQUIRED THE AEROSOL GENERATORS IS NOT KNOWN AT THIS TIME BUT COULD VERY WELL BE CONNECTED TO THE IRAQI BIOLOGICAL [ (b)(2) ] WARFARE BW PROGRAM. 2. THE AEROSOL GENERATORS ARE OF SUCH--SIZE TO FIT ON THE BACK OF A PICKUP TRUCK OR A SMALL ALL-TERRAIN VEHICLE, A SMALL BOAT, OR SMALL AIRCRAFT. THESE UNITS WOULD BE SUITABLE FOR THE DISPERSAL OF BW AGENTS IN EITHER LIQUID OR DRY FORM. THE ABILITY TO DISPENSE SIMULTANEOUSLY TWO BW AGENTS AT THE SAME TIME. SUCH UNITS, HOWEVER, WOULD THEMSELVES BECOME HEAVILY CONTAMINATED DURING USE AND WOULD REQUIRE DECONTAMINATION TO RENDER THEM SAFE. PERSONNEL OPERATING SUCH UNITS WOULD AT A MINIMUM NEED TO WEAR A PROTECTIVE OVERGARMENT A CHEMICAL AND BIOLOGICAL WARFARE MASK, AND UNDERGO THOROUGH DECONTAMINATION AFTER DISPENSING THE AGENT(S) . DECONTAMINATION OF THE AEROSOL GENERATORS AND TRANSPORT VEHICLES WOULD LIKELY HAVE TO ACCUR NEAR THE AREA OF OPERATION AT REMOTE LOCATIONS SO AS TO MININIZE INCIDENTAL CONTAMINATION OF IRAQI FORCES. 3. THE IRAQIS HAVE TWO CONFIRMED BW AGENTS--ANTHRAX AND BOTULINUM TOXIN. ANTHRAX CAN BE4 DISSEMINATED BY AEROSOL GENRATORS EITHER AS A FREEZE-DRIED POWDER OR AS A LIQUID SUSPENSION. THEORETICALLY BOTULINIUM TOXIN CAN BE DISPENSED AS EITHER A FREZE-DRIED POWDER, PROBABLY IN COMBINATION WITH A FILLER, OR AS A LIQUID. THE MORE LIKELY OF THE TWO CHOICES FOR BOTULINUM TOXIN IS DISSEMINATION AS A POWDER. POWDERS ARE EASILY MIXED WITH FILLERS, POSE A CONSIDERABLY GREATER THREAT THROUGH INHALATION, AND ARE BETTER ABLE TO WITHSTAND THE SHEAR FORCES EXPERIENCED WHEN DISSEMINATED THROUGH NOZZLES WITH A RELATIVELY SMALL ORIFICE. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

1 0

Re: Redundancy in XOR encryption
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > > > Compress P to get perfect compression (ie. 0 redundancy) > > Encrypt F (the compressed text) using a repeated key XOR > > > > of course this is all rather theoretical as there is no such thing as > > perfect compression, but I just thought it might be interesting to > > see if this is indeed strong, superficially it appears so to me... > > > > Paul: > I think that if the cryptanalyst knows that F has zero redundancy > that he can run searches from 0 to n bits for the key and have > the computer flag solutions that have zero redundancy. I never though of that. > I also think that a perfectly compressed file would have a relative > entropy value close to one also, hence the computer could flag possibles > that have both characteristics. yeah, these two are reasonably unlikely to occur together (only a reasoned guess, anyone got any comments on this?) so we really have a weakish system. > Hence, instead of searching for plaintext by counting coincidences, > we are searching the decrypts for solutions that have zero redundancy > and a relative entropy value close to one. How many solutions will > have both these qualities? I don't know. But if the compression method > is known, brute force will be tried, and only having to try to > decompress (read) data that has the resultant characteristics > of compressed information will speed things up by quite a bit. Yeah, this is still a form of brute force but I was thinking of this in terms of a smallish (sub 200 bit) key, so brute force against solutions with 0 entropy is a realistic possibility. anyone else got a faster way to attack this highly theoretical, will-never-be-implemented, type system?? I`d imagine there is some sort of way to measure the entropy "mixed in" by the XOR thus giving a foothold in the key, but I can`t think of anything right now, anyone got any ideas? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

1 0

Eudora 3.0 supports multiple tentacles
by Greg Broiles 17 Dec '03

17 Dec '03

Those of you who have or are tentacles (hee, hee) might take a look at the new Eudora 3.0 beta; it's got nice built-in support for multiple POP mailboxes/usernames, and keeps track of which identity received a messages, and sends replies from that identity (using the appropriate outbound SMTP server) so as not to confuse correspondents. It seems to be ideally set up for people who want to adopt an alternate nym for whatever reason. The filtering is also allegedly improved but I haven't fussed with that much yet. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: The GAK Momentum is Building...
by Greg Broiles 17 Dec '03

17 Dec '03

>>However, making the government a _required_ part of such plans implies a >>motive that is not at all the same as what companies wish (mostly, >>disaster recovery). > >the distinction lies in the terminology. what does it mean, "required >part of the plan". if it essentially amounts to nothing more than >the government saying, "you must give us keys when we present you >with a subpoena/warrant", then that's no different than the system >we have today. Hmm. The government sure is putting a lot of effort into moving us to a system that you say is "no different than the system we have today." As far as I can tell, you're the only one who thinks that. The government thinks that GAK is a big change, civil libertarians think GAK is a big change .. but you're welcome to call it "status quo" if it suits you. There's a world of difference between the government subpoena-ing something from me, where I can delay disclosure until I've exhausted my legal avenues to challenge disclosure, and the government demanding data from an at best disinterested third party who cares not at all if I get my day in court before they disclose. With the second scenario, I'm forced to try to "unring the bell", and somehow limit the spread of otherwise private/confidential data in a community (law enforcement) which is organized to collect and retain information. Ha, ha. Given today's Congress and Supreme Court, there's probably precious little chance that keys disclosed prematurely or erroneously won't be used to collect evidence which will be admissible despite the lack of meaningful opportunity to challenge the "recovery" of a key. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

SSN database scam?
by Gary Howland 17 Dec '03

17 Dec '03

Forwarded from www-security mailing list. Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 To: www-security(a)ns2.rutgers.edu Subject: Can you say "fraud"? (fwd) From: Mary Irene Wise <auntyem(a)umich.edu> Date: Tue, 17 Sep 1996 08:44:39 -0400 (EDT) Sender: owner-www-security(a)ns2.rutgers.edu This is probably a bit off-topic; if so I apologize. Can anybody comment on the item forwarded below my sig file? It claims there's a database w/ people's credit card no's etc on it and you have to give your name and social security number to get off of it. This strikes me as being a scam to get your ssn, but this went around at work and people are actually calling and giving it out. I know ssn's aren't really as secure as they're supposed to be, but still... So, does anybody know if this database is for real or if it's just a scam? TIA, Mary Wise --------------------------------- *** ------------------------------------ Mary Wise | Computer Systems Specialist * auntyem(a)umich.edu LSA Information Technology | homepage not availabe at this time 3557 LSA Bldg 1382 * University of Michigan | (313) 647-6230 * | --------------------------------- *** ------------------------------------ ---------- Forwarded message ---------- > > > Your name, social security number, current address, previous addresses, > mother's maiden name, birth date and other personal information > are now available to anyone with a credit card through a new Lexis database > called P-Trax. As I am sure you are aware, this information > could be used to commit credit card fraud or otherwise allow someone else to > use your identity. > > You can have your name and information removed from this list by making a > telephone request. Call (800)543-6862, select option 4 and > then option 3 ("all other questions") and tell the representative answering > that you wish to remove your name from the P-trax database. You > may also send a fax to (513) 865-7360 or 865-1930. Include your full name and >ssn in the fax. You can also send physical mail to > > LEXIS-NEXIS > P.O. Box 933 > Dayton, Ohio 45401-0933. > > Sending physical mail to confirm your name has been removed is always > a good idea. > > As word of the existence of this database has spread on the net, Lexis-Nexis > has been inundated with calls, and has set up a special set of > operators to handle the volume. In addition, Andrew Bleh (rhymes with > "Play") is a manager responsible for this product, and is the person > to whom complaints about the service could be directed. He can be reached at > the above 800 number. Ask for extension 3385. According to > Lexis, the manager responsible is Bill Fister at extension 1364. > > I called this morning and had my name removed. The representative will > need your name and social security number to remove you from the list. > I suggest that we inundate these people with requests to remove our > info from the list and forward this e-mail to everyone we know. > > >----- End Included Message ----- > > > >Cheers . . . > >"The backup procedure works fine, but the restore is tricky!" >_____________________________________________________________________________ > | _ \ Amanul Haque > | | \ \ Pencom System Administration > | |_/__/__ __ 9050 Capital of Texas Highway North, Austin, TX 78759 > | _/ ___/| \ Email: ahaque(a)pencom.com > | | \___ \| \ \ Pager: (708) 643-7331 > |__| /____/|_|__\___________________________________________________________ > Pencom Web Page : http://www.pencom.com > > > >------------- End Forwarded Message ------------- > > > > > -=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- Nancy L. Cassidy University of Michigan LS&A Budget & Finance Team 2557 LSA Bldg. 1382 Tel: (313) 764-6465 Fax: (313) 764-2697 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: A daily warning regarding Timothy C. May
by DMiskell＠envirolink.org 17 Dec '03

17 Dec '03

>Timothy C. May is a lying sack of shit. Right. And you had to insult him through use of anonymous mail. Boy, you're real brave, shedding the light to the rest of the cypherworld in such a manner. Apologies for the spam, but there was no address, obviously. -- If in fact we are the only intelligent life on this planet, why the fuck are we in this goddamn mess? -- Find my public key on the World Wide Web -- point your browser at: http://bs.mit.edu:8001/pks-toplev.html

2 1

The daily warning about Timmy May, the lying sack of shit
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Timmy May proves that the Midwestern gene pool needs some chlorine in it.

1 0

Re: Fear of Flying -- from HotWired
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:21 AM 9/18/96 -0400, Black Unicorn wrote: >> On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >> >Gee, biotech has come a long way. Now I can download the Anthrax DNA >> >sequence from the net and insert it in some carrier bacteria and start >> >making Anthrax bacteria. Neat! > >Culturing and growing anthrax is painfully simple. No DNA required. Sorry Unicorn, you missed my point. (1) You need DNA to grow bacteria. You can get the DNA two ways. (A) You get a sample of the beast, or (B) You get a DNA sequence and then regenerate the DNA. (I don't think B is technically feasable yet.) (2) You can't send samples of the beast thru the net. ------------------------------------------------------------------------- Bill Frantz | "Cave softly, cave safely, | Periwinkle -- Consulting (408)356-8506 | and cave with duct tape." | 16345 Englewood Ave. frantz(a)netcom.com | - Marianne Russo | Los Gatos, CA 95032, USA

2 1

Re: 56 kbps modems
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

if nothing else, the availability of 56kbps on an analog line might get the telcos to bring the isdn prices down to some reasonable level, which at the moment, it is not, at least not in nyc. -paul > From cypherpunks-errors(a)toad.com Tue Sep 17 18:21:03 1996 > From: Adamsc(a)io-online.com (Adamsc) > To: "Bill Stewart" <stewarts(a)ix.netcom.com>, > "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> > Cc: "Asgaard" <asgaard(a)Cor.sos.sll.se>, "Enzo Michelangeli" <enzo(a)ima.com> > Date: Tue, 17 Sep 96 12:22:15 -0800 > Reply-To: "Chris Adams" <adamsc(a)io-online.com> > Priority: Normal > X-Mailer: Chris Adams's Registered PMMail 1.52 For OS/2 > Mime-Version: 1.0 > Content-Type> : > text/plain> ; > charset="us-ascii"> > Content-Transfer-Encoding: 7bit > Subject: Re: 56 kbps modems > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1107 > > On Sun, 15 Sep 1996 01:31:19 -0700, Bill Stewart wrote: > > >and still get the original 56kbps back out. But if they can, well, > >yee-hah, ISDN is nearly dead :-) (Not totally dead; the signalling is > >still useful for some applications, the convenience of two channels on > >one wire pair is nice, and the fact that people can get 56kbps without > Also, can't you add ISDN b-channels ? (I.e. get another 64kps channel) > >the phone company's help will pressure them into offering ISDN for > >a lower price in areas where the Phone Company's idea of "all the market > >will bear" is substantially higher than voice pricing.) > > ISDN is more elegant; this sounds like a 'kludge' of sorts. OTOH, we've all > seen how well a cheap kludge can do, right? > > # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp > # cadams(a)acucobol.com | V.M. (619)515-4894 > "I have never been able to figure out why anyone would want to play games on > a computer in any case when the whole system is a game. Word processing, > spreadsheets, telecoms -- it's all a game. And they pay you to play it." > -- Duncan Frissell > > >

2 1

Re: The GAK Momentum is Building...
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Sep 18 08:48:43 1996 Tim May wrote: <...> > (BTW, I predict that the tainted term "key escrow" is now gone from the > official lexicon. I haven't seen the Clipper IV proposal, but I surmise > that the baggage the term "key escrow" carries means that some more > benign-sounding term will be used in the final proposal. Something like > "Key Recovery System." You heard it here.) I agree, and hope so. "Key Recovery," while not as Orwellian-sounding as "GAK," is a step on the path to honesty WRT the English language, though it's important to continually point out, as Tim did in his post, that *access* -- rather than just recovery -- is obviously what Mr. Freeh wants. I'd count this likely change in terminology as a "cypherpunk victory," albeit a very small and certainly a very hard-fought one. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj/vsG1lp8bpvW01AQFkhwP/XEkJkdXwYsdSM8kn+B3bR/bCDXaKgkIE p63RgjQ5C60byufXqlqitvuJPMuS19MRxlF7UXsXJXKY6Jm92Q45sQtLICsMqXhP /iJwDVYaEuDj24cFycsZjZMeT+xxnuy+OCuhKIEgKF6gjh2uEZxbCellCqJ86TPF XfPiQiTPBDo= =B2hR -----END PGP SIGNATURE-----

5 4

SPAMS
by Stephan Schmidt 17 Dec '03

17 Dec '03

Hi, please focus on the UPPER written text at the bottom. I think they take it _much_ to easy. -stephan ---------- Forwarded message ---------- Date: Sun, 15 Sep 1996 17:55:57 +0000 From: Mailer <Mailer(a)aol.com> To: LISCIFI(a)AOL.COM Subject: Hi! Pardon the intrusion. Market study shows this may be of interest to you. If you have received this message in error, please hit delete. *********************************************************** A Personal Invitation Stop working for someone else! Put yourself in a position to leave the 9-5 grind behind!!! We invite you to listen to the most extraordinary and most powerful wealth building opportunity in the world and within a few minutes you will actually hear: * How you can make profits of $10,000 within the next 30 days! * You never have to leave your home! * A financial strategy 100 times more powerful than MLM or ANY OTHER BUSINESS! * Where you are paid directly and daily! (Don't wait for a company to pay you!) This is not MLM! This is not a pipe dream! This is a real business venture! 800-995-0796 Ext 9263. ************************************************************** ANY EMAIL ADDRESS PUBLISHED ON THE INTERNET THAT INVITES COMMERCIAL SOLICITATIONS IS DEEMED AS A COMMERCIAL ADDRESS, AND AS SUCH IS ELIGABLE FOR ETHICAL AND LEGAL EMAIL SOLICITATIONS FROM DIRECT ELECTRONIC MAIL MARKETERS. IF FOR ANY REASON YOU OBJECT TO RECEIVING THIS MESSAGE PLEASE POLITELY REQUEST REMOVAL FROM MY LIST BY CLICKING ON THE REPLY BUTTON AND ENTERING "REMOVE" IN THE SUBJECT LINE. IF YOU DO NOT DO SO, I MUST ASSUME YOU WISH TO RECEIVE FURTHER MAILINGS.

1 0

Cognitive Bias and Software Development
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

This reference was chopped from the bottom of a previous message. Communications of the ACM issue on Cognition and Software Development "Developers' thought processes are a fundamental area of concern. Cognitive scientists have discovered that people's intuitive inferences and probability judgments do not strictly conform to the laws of logic or mathematics, and that people are willing to provide plausible explanations for random events. This article examines the role these phenomenon might have in software development, ultimately concluding that what are cast as one-sided software development guidelines can be recast beneficially as two-sided trade-offs" Cognitive Bias in Software Engineering Webb Stacy and Jean MacMillian Communications of the ACM June 1995/Vol 38, No. 6 The article contains several good example of various classes of bias, including the representativeness, availability and confirmatory bias. While the article specifically adresses issues within the context of software development, all of these biases are general in nature and have correlates in other fields. Ciao, James Great minds think alike. Fools seldom differ. - Anonymous

1 0

Re: Spam blacklist project
by Duncan Frissell 17 Dec '03

17 Dec '03

hallam(a)ai.mit.edu writes: > Well if some people find it amazing that there are people out there > who agree with the 98.8% of people who did not vote Libertarian at the > last election then so be it. Course half the eligible population didn't vote at all obviously favoring market and personal approaches over political methods of governance. DCF

2 1

Mercenaries
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:40 PM 9/17/96, William Knowles wrote: >On Tue, 17 Sep 1996, Michelle Thompson wrote: > >> Interesting information from a friend of mine- >> >> >An american can not serve for pay for a position in another military >> >that could be filled by local populace. I may have my jurisdiction >> >wrong tho, this could be an international law not a US law. >> >Basically, you can't go be a grunt or an assasin in another country, >> >because they can find their own, As to Michelle's point that Americans cannot serve for pay in other militaries, there are all sorts of waivers and "look the other way"s involved. For example, the retired American officer who became the top military man in Estonia (or one of the Baltic States)--while still retaining his U.S. citizenship. >What about the French Foreign Legion? or the Volunteers for Israel, >which isn't really a fighting force, but Americans can help keep >the Israeli army at a ready state. Israel is one of several states which the U.S. allows dual citizenship with. For political reasons, because of America's extermination of the Jews in WW II (Whoops, we were on the other side...so why do we have such a cozy deal with Israel, but not with, say, France? Beats me. Politics.) Brian Davis, our former Prosecutor, can tell us how likely it is that any person would be charged and brought to trial for being a paid mercenary for some small country in the Third World. The CIA is often behind such mercenaries, so national security issues could make the issue murky. But the real reason such prosecutions are rare is that the government realizes how Orwellian it sounds to say: "You are being prosecuted because you were a mercenary for Oceania in its war with Eastasia. While Oceania was once our ally in our battle with Eastasia, and we endorsed and financed your role as a mercenary, we became allies with our great friend Eastasia and are now in a state of war with the tyrants of Oceania." >Explicit isn't a dirty word, Or is it? AOL has declared "explicit" to be a Banned Word, along with "pissant," "craps," and "cock," and numerous other such ordinary words. (So much for mentioning their pissant policies, a game of craps in Las Vegas, or a male chicken.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

RE: Redundancy in XOR encryption
by geeman＠best.com 17 Dec '03

17 Dec '03

in any practical or semi-practical application, you'll have to have a way to decompress the perfectly compressed data. A dictionary? A Huffman-tree-ish sort of thing? Are you going to transfer it out-of-band? **It** becomes the target of interest. ---------- From: paul@fatmans.demon.co.uk[SMTP:paul@fatmans.demon.co.uk] Sent: Tuesday, September 17, 1996 12:33 PM To: cypherpunks(a)toad.com Subject: Re: Redundancy in XOR encryption > > > > Compress P to get perfect compression (ie. 0 redundancy) > > Encrypt F (the compressed text) using a repeated key XOR > > > > of course this is all rather theoretical as there is no such thing as > > perfect compression, but I just thought it might be interesting to > > see if this is indeed strong, superficially it appears so to me... > > > > Paul: > I think that if the cryptanalyst knows that F has zero redundancy > that he can run searches from 0 to n bits for the key and have > the computer flag solutions that have zero redundancy. I never though of that. > I also think that a perfectly compressed file would have a relative > entropy value close to one also, hence the computer could flag possibles > that have both characteristics. yeah, these two are reasonably unlikely to occur together (only a reasoned guess, anyone got any comments on this?) so we really have a weakish system. > Hence, instead of searching for plaintext by counting coincidences, > we are searching the decrypts for solutions that have zero redundancy > and a relative entropy value close to one. How many solutions will > have both these qualities? I don't know. But if the compression method > is known, brute force will be tried, and only having to try to > decompress (read) data that has the resultant characteristics > of compressed information will speed things up by quite a bit. Yeah, this is still a form of brute force but I was thinking of this in terms of a smallish (sub 200 bit) key, so brute force against solutions with 0 entropy is a realistic possibility.

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

snow <snow(a)smoke.suba.com> wrote: > Actually, don't some wealthy Canucks come south of the border for > certain treatments unavailable in the Great White North? Yes, some wealthy (and not so wealthy people) go south of the border for treatment. Some go because the treatment is unavailable here, others go if they chose not to wait for treatment here. The most common types of exported services are usually high cost and/or experimental but their availability is most often constrained by the low number of people who are qualified to render the service. Many services unavailable in a patient's local area are still covered by provincial health plans. This works when a patient has to travel from a remote region, to another province or to the U.S., and can cover experimental treatments. Some Canadian hospitals make use of U.S. care providers for services when a backlog exists in Canada. For example, Windsor has used Detroit MRI services to reduce waiting times. There are also people who go the other way (U.S. to Canada), usually when they have to pay their own bill. Detroit to Windsor is again not uncommon. > Are the PRICES as high in Canada as here? In general, prices are lower in Canada for the same level of care. I do not know if the underlying costs are also lower in general. Each province create a payment schedule for services that it reimburses. Hospitals bill the province for services, but all capital cost items (e.g. equipment, buildings) must be paid for from other sources (e.g. donation). Thus, we tend to have fewer capital intensive treatment facilities since the ROI is usually low. The figures that I have seen indicate that the U.S. pays 40%-50% more than Canada on overall health care services. Some of this is due to the rapid availability of higher cost/experimental services. Some of this is due to the higher cost of the administrative bureacracy. Due to the large difference in total costs, I do not think that travel in either direction significantly effects this number. Ciao, James Check out www.spinex.com for more effective alternatives to MRI for diagnosing spinal function at 1/20th of the cost. P.S. No, Canada is not perfect, and I don't know everything.

1 0

[joke, non-code] Re: Get this for a snake-oil example :)
by f_estema＠alcor.concordia.ca 17 Dec '03

17 Dec '03

On Wed, 18 Sep 1996, Benjamin Grosman wrote on coderpunks: > Hey there...thought I'd drop this in to you... > someone I know is in the process of being set upon by a shamster (well, ^^^^^^^^ Shamster: SHA-enabled biocomputing hamster. Distantly related to Shneier's DESosaurus. Cute, cuddly and mathematically secure and authentic. I leave to the imagination its input and output processes. Eats snake oil for lunch.

3 2

Re: The GAK Momentum is Building...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:49 PM 9/18/96, Declan McCullagh wrote: >On Tue, 17 Sep 1996, Timothy C. May wrote: >> >> (BTW, I predict that the tainted term "key escrow" is now gone from the >> official lexicon. I haven't seen the Clipper IV proposal, but I surmise >> that the baggage the term "key escrow" carries means that some more >> benign-sounding term will be used in the final proposal. Something like >> "Key Recovery System." You heard it here.) > >I agree, of course. But Gore's office has been telling me about the "Key >Recovery System" for months. It's nothing new in the DC cryptolexicon. Yeah, I shouldn't have added the "You heard it here" line, implying I had invented the term. As others have noted, this seems to be the new term for key escrow. The brainwashing must've taken hold on me, and as a good citizen-unit I had absorbed the message: "Key Recovery is Security, Ignorance is Strength." --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0