December 2003 - cypherpunks-legacy

Espial
by bneiman＠navix.net 17 Dec '03

17 Dec '03

I noticed your newsgroup posting, and thought you might be interested in a great business opportunity. Reply to this e-mail with your name and address info and I will sent you information. Or visit by web site: www.espial4u.com. Thanks.

1 0

Re: Sandy and I will run a cypherpunks "moderation" experiment
by Paul Wren 17 Dec '03

17 Dec '03

At 05:32 PM 1/8/97 -0800, Rich Graves wrote: > >In practice, a system such as Chudov's STUMP reduces the latency and >moderator effort considerably, as responsible posters get put onto the >white list for auto-approval (to be degraded to hand-moderation if they >lose it). For list regulars, it's as if the list were unmoderated. > "All animals are equal; some are more equal than others"

1 0

Is this true?
by remove＠opportunity1.com 17 Dec '03

17 Dec '03

My information tells me you are someone looking for an opportunity to make extra money. What if you could market with the best bulk email product available and at the same time make $100 every time you refer someone else to buy it? This bulk email program can personally address your letters which alone can greatly increase your response rate. It also can download addresses from 18 different sources. Users of Floodgate and Pegasus are rushing to get their hands on this product. It's so easy to use that I found myself stripping addresses and doing my first mailings within hours after registering it. As Entrepreneurs we understand the key to success is recognizing where the market is. The Internet is full of people promoting products and services. Now you can offer them the tool they need the most. For more information email me at cybergy(a)mindspring.com If you would like to be removed from any future mailings simply send email to remove(a)opportunity1.com. Thank you, Walter Cantrell

1 0

ok, htf do I get off this list?
by Si Dawson 17 Dec '03

17 Dec '03

OK, I've now sent THREE requests to majordomo to get off this list.. I got a reply back 4 hours ago saying I was off, and the next two said I wasn't a member of the list. Interesting list (minus the spamcrap obviously) and I think the moderation will be a good thing, BUT the 20 emails I've received in the last 4 hours (since I 'officially' unsubbed) is (to say the least) far more than I (or any reasonable mortal) can deal with. How do I unsubscribe? No, more importantly, how do I stop all these damn emails turning up? Thanks in Advance Simon As I think, talk, and act.. so I shall become..

1 0

Re: IBM Key Recovery Propaganda on United Airlines
by Eric Verheul 17 Dec '03

17 Dec '03

> To me, Key Recovery cryptography is like using a condom with a > hole in it. No thanks. Actually, on microscopical level *all* condoms have holes in them; the holes are just small enough for you not to worry bout it. The same applies to (good!) Key Recovery cryptography: there are holes but not big enough for you to worry about! > > Toto > Eric //My life-time-emailadress is Eric.Verheul(a)pobox.com //Use this when emails start bouncing when I have //switched to my next (inadequate) Internet-provider

6 7

Re: About ICF(International Cryptography Framework)
by Pass me another! 17 Dec '03

17 Dec '03

John Young wrote: > > Here are two docs on ICF which might be helpful: > > http://jya.com/halicf.htm (Hal Finney's critique posted to c'punks) > > http://jya.com/declan.htm (news reports) > > John Thanks a ton...I appreciate it...I checked them out. They say that this tech may not be available for some time...however, I feel that may not be necessarily true...tech is coming and going much faster these days and according to Ray Bamford's stance at HP, he seems to think that this may soon(within the next year) become a viable reality. Can I ask what your stance and views are on this issue? And any ideas as to what we as a community can do about this NAZI-istic progression of freedoms?? -spanky

1 0

IBM Key Recovery Propaganda on United Airlines
by dimple＠pacific.net.sg 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Aeon Flux
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

-

1 0

A vote of confidence for Sanderson.
by Butler, Scott 17 Dec '03

17 Dec '03

After reading all of these people babbling on about giving a vote of confidence for Sandy I decided that I should also. I have full confidence in Sandy:-) (Well it normally works over here in the U.K...if a football manager receives a vote of confidence from the board of directors it is a foregone conclusion that his resignation will be handed in or his P45 will be handed out within days!) Scott

2 1

Let you know!!
by sls123＠prodigy.net 17 Dec '03

17 Dec '03

Hi, Please forgive me for this e-mail, but I felt I just had to let more people know about this and get in on the ground floor! If you don't want to read it, please type "REMOVE" in the subject line. I won't contact you again. The program I am involved in incorporates "Spillover". Spillover is probably one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will probably be placed under you. You then earn commissions on these new people as if you had signed them up! Why? The way the program works I am trying to fill my downline and I can only have so many people on each level. After a given level is full, anyone else I sponsor "spills over" to the next level. This is where they start getting placed under you. So you see, it doesn't matter if you sign them up or I do, in the end the result is the same. I just signed up Monday and I already have 10 members in my downline, just from SPILLOVER! Nest Egg is in pre-Launch until April 1st, 1997 * You will receive check each month * * Free Sign Up! * The program just started, in fact it has less than 550 members. This IS the ground floor! The company is advertising in several major print publications next month! I have been in several MLM's and I can finally say; "This is the one I've been looking for!" If you know what it's like to lose sleep because your so exited, email me NOW! Don't miss this opportunity, email me for URL & sponsor information. Thanks, Mark

1 0

Free Samples, Software, and MoreI would like to invite you, as an internet user, to be part of a marketing test where you can get FREE software, FREE Samples, and FREE computer related money making offers from manufacturers nationwide. You may be asked to give your opinion, but there is no obligation.
by dans＠pleaseread.com 17 Dec '03

17 Dec '03

even if you had their addresses! If do not want to get anymore e-mail reports like this, please send email to dans(a)pleaseread.com with the word "REMOVE" in the subject or the body. -Lisa

1 0

AOL: The Happy Hacker
by SECRET AGENT 66 17 Dec '03

17 Dec '03

From: IN%"destiny(a)crl.com" "David Cassel" 9-JAN-1997 05:27:47.48 To: IN%"aol-list(a)cloud9.net" "The AOL List" CC: Subj: The AOL List: The Happy Hacker Return-path: <owner-aol-list(a)cloud9.net> Received: from cloud9.net ("port 1250"@cloud9.net) by delphi.com (PMDF V5.0-7 #10880) id <01IDZXJME7BK90PW97(a)delphi.com>; Thu, 09 Jan 1997 05:27:33 -0500 (EST) Received: (from majordomo@localhost) by cloud9.net (8.8.4/cloud9-1.0) id EAA02888 for aol-list-outgoing; Thu, 09 Jan 1997 04:42:59 -0500 (EST) Received: from crl.crl.com (unknown(a)crl.com [165.113.1.12]) by cloud9.net (8.8.4/cloud9-1.0) with SMTP id EAA02882 for <aol-list(a)cloud9.net>; Thu, 09 Jan 1997 04:42:56 -0500 (EST) Received: by crl.crl.com id AA27763 (5.65c/IDA-1.5 for The AOL List <aol-list(a)cloud9.net>); Thu, 09 Jan 1997 01:32:41 -0800 Date: Thu, 09 Jan 1997 01:32:39 -0800 (PST) From: David Cassel <destiny(a)crl.com> Subject: The AOL List: The Happy Hacker Sender: owner-aol-list(a)cloud9.net To: The AOL List <aol-list(a)cloud9.net> Message-id: <Pine.SUN.3.91.970109004403.24862A-100000(a)crl.crl.com> MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Precedence: bulk T h e H a p p y H a c k e r ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ In 1995 a hacker named Happy Hardcore wrote a program that granted unlimited free access to AOL. Yesterday AOL issued a press release applauding his conviction in a court in Virginia. (http://www.prnewswire.com/pdata/19970108-DCW022.html) According to press accounts, Nicholas Ryan -- who studies computer science at Yale university -- was found guilty of a felony offense under the Computer Fraud and Abuse Act: he illegally accessed AOL "and violated AOL's terms of service". But AOL's press release doesn't tell the whole story. The Washington Post reported that in fact, AOL dropped over 370,000 subscribers between March and June of 1996 "for credit card fraud, hacking, etc." [9/16/96] Up until September of 1995, AOL didn't even verify the authenticity of credit card information submitted for free-trial accounts. (And as of last year, they'd distributed over 100 million of them.) Monday AOL shut local phone access to the entire nation of Russia because it couldn't collect enough accurate information to cover their expenses. Ryan was targeted because he created a program used by other hackers--and because he publicly taunted AOL in the program's documentation. He included internal AOL e-mail (stolen by other hackers) discussing the company's plans to thwart his program. Ryan wasn't charged with creating the program, but for accessing the system illegally--a crime he shared with nearly half a million others. For six months of access, he faces a maximum of five years in prison and $250,000 in fines. Under AOL's new value plan, the stolen time would have a cash value of $60. AOL's public statements indicate they want to appear tough on hackers -- especially now that they're seeking revenue from on-line transactions. A press release announcing the appointment of a vice president to AOL's optimistically-named "Integrity Assurance" division stressed her previous employment at the CIA--saying Tatiana Gau wants to "improve the world's most secure online environment". (The phrase "most secure" appeared three times.) Yesterday's announcement even asserted AOL had achieved "the first successful computer fraud prosecution involving an Internet online network." (One technology correspondent quipped, "Maybe it means that Kevin Mitnick is just a figment of Tsutomu Shimomoura's imagination.") AOL's announcement went so far as to claim that AOL is safer than the internet because AOL uses a private network. But safety still depends on how a network is administered. In 1995, a beta of AOL's telnet client put users directly behind their firewalls--and earlier that year, AOL's mail server was accessible via telnet, allowing forged mail from any AOL address. Hackers even took the stage during a 1995 celebrity appearance on AOL--then taunted the scheduled guest and the event sponsors. (http://www.aolsucks.org/security/recondite.html) "I am sure Corporate Communications will be getting some questions about it," read an internal e-mail titled "Hacker Attack In the Rotunda Last Night". Ironically, that message later ended up on the AOL Security Page--"What AOL Does Not Tell You." http://www.netvirtual.com/blank/aol) The next month AOL's CEO Steve Case wrote a letter to all users about hacker problems, arguing that "it happens everywhere", and adding that "when we discover hackers", AOL "aggressively take measures to head them off". But within days of that announcement, hackers were posting internal mail that they'd stolen to the internet. They continued undaunted, posting internal memos, and even Case's home address. In probably the most embarrassing development, in-house mail ABOUT the hackers was being circulated BY The hackers (ftp://ftp.crl.com/users/de/destiny/aol/hacker1) At the time, AOL spokeswoman Pam McGraw told me, "We've encountered these problems in the past, and we make changes to the service as appropriate-- and as we can". The hackers had reverse-engineered AOL's "Rainman" software, which had been mistakenly stored in AOL file libraries accessible by their hundreds of remote staffers. The company fumbled for an explanation--Pam McGraw told the press AOL believed the heist was effected with the Visual Basic macro program AOHell. (Some later attributed her remarks to a deliberate disinformation campaign--especially when, to suppress the program's distribution, AOL later told Boardwatch magazine AOHell contained built-in child pornography. ftp://ftp.boardwatch.com/aohell.txt) But AOL's attempts to cover-up security breaches left their members even more vulnerable. "I went to a bunch of new member chat rooms, used AOHell to fish for passwords, and got 25 of them," one Usenet poster gloated. "Doesn't AOL tell its users to not do that?" There were worse abuses. When AOL realized hackers could "sniff" passwords during TCP/IP connections, staffers say they were warned--but not the customers. "I hope that AOL alerts the General Membership to this problem in a timely manner," one staffer complained, "and not, as in the previous situation, wait until they are forced to by negative news coverage." Sources had told the Wall Street Journal that the 1995 security breach included hackers distributing customer credit card numbers in AOL hacker chat rooms, and AOL had warned staffers about the breach--but didn't tell their users (until the story broke in nationwide news reports.) The staffers complained AOL's hush-hush policy was aimed more at protecting their image than protecting their customers. In a memo warning staffers not to speak to the press, Steve Case countered that "We need everyone's support...to protect AOL's interest". That even applied AOL's content providers. Shortly before hackers took the stage at his live event, the producer of AOL's MacWorld area asked AOL about earlier problems. He told me AOL had attributed them to "some security holes that AOL promised were closed." It was when hackers took the stage that he found they were not. Even AOL's latest statements are suspect. The press release claims that AOL "immediately upgraded its security measures to prevent AOL4FREE or any similar software from working". But Nicholas Ryan told a different story. "AOL found a way to detect users of AOL4Free," began the program's documentation. "However, with only a few lines of additional code AOL4Free is again undetectable!" Tatiana Gau's claims that AOL has a "zero tolerance" policy for hackers is patently implausible. Macromedia's software piracy suit fingered 67 screen names in 1995. And over 70 came into play for the "Hacker Riot" that November--a coordinated attack on the New Member Lounges (http://www.getnet.com/~onion/work/planetmag/current/features/aolside.html) lasting several hours and affecting hundreds of users. This August AOL's Chief Financial Officer even pointed to the fake accounts as a possible culprit for the high figures on their subscriber churn rate. And just six weeks ago hackers doctored text at AOL keyword: legal. (http://www.news.com/News/Item/0,4,5712,00.html) Even yesterday, aolsucks.org received the comment, "AOL SUX!!!!! Thats why I make fake accounts with them!!!" Ironically, the documentation for AOL4Free ends with the classic hacker manifesto "The Conscience of a Hacker." The 1986 document ends, "I am a criminal. My crime is that of curiosity..." And most technology pundits agree. AOL's MacWorld area was mailbombed for a week and a half, with dozens of junk posts to its bulletin boards. "We hate that," their producer told me. "Does that mean the FBI needs to be brought in? Probably not." Chris Flores of Microsoft's Developer Division agreed. "If a Visual Basic program can automate hitting this key and hitting that key, the blame should be on AOL for allowing a certain keystroke to be hit... They should think of AOHell as a blessing. Since they know about it, they know that they have a fault in their system." MacWorld's producer added, "You've got to admire the hacker ethic in a certain way, because it's how things get done...how holes get patched." Indeed, as a result of the hacker presence, AOL began accompanying all e-mail and instant messages with a warning in red letters--that AOL staff will never ask you for your password. One Florida resident with a degree in criminology pointed out on Usenet that this alone wouldn't be sufficient--because password-fishers were incorporating the warnings into their scams! ("Enter your password to confirm that you understand the warning below." "Enter your password now to turn on pass-block, which offers protection beyond the simple password warning given below.") Now AOL's 3.0 software requires users to download small software changes before they can access the system. Unfortunately, there's no way to opt out--which creates a major security hole waiting to backfire. In any case, the hacker presence belies AOL's claims of the "highest level of security". In fact, Wired News reported that "Gau is confident, but she knows she has her work cut out for her. She's already spotted a link on the Web announcing her arrival. It was titled 'Hackers are laughing.'". It was my page. THE LAST LAUGH Within days of its creations, AOL threatened the AOL Security page with charges of copyright infringement. Unfortunately, the tactic inspired three other sites to mirror the documents--which are still there to this day. David Cassel More Information - http://www.wco.com/~destiny/time.htm ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ Please forward with subscription information and headers in-tact. To subscribe to this moderated list, send a message to MAJORDOMO(a)CLOUD9.NET containing the phrase SUBSCRIBE AOL-LIST in the message body. To unsubscribe send a message saying UNSUBSCRIBE AOL-LIST to MAJORDOMO(a)CLOUD9.NET ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0

Esnoop Corrections
by John Young 17 Dec '03

17 Dec '03

RH helpfully noted errors in a few URLs in the "Electronic Surveillance" doc which have been corrected: http://jya.com/esnoop.htm

1 0

FREEEEEE!!!!!!
by jccsendto4＠juno.com 17 Dec '03

17 Dec '03

While you are reading this I'll have made MORE MONEY!!! Can you say the same thing? If NOT.... DO NOT HIT REPLY.....just follow these three simple steps; ....type in address to jcc(a)mlweb.com ....type in subject FREE ....type in body MONEY You will receive via e-mail a comprehensive,dynamic FREE plan on how YOU can be doing the same thing! It really does work, I'm proof it does. No, I'm not a company or organization, I'm someone like you...Everyday hard worker who has come across a plan that puts CASH in my mailbox almost every day! Read it at your leisure after receiving and printing your FREE copy and then DO IT!! You'll be glad you did!

1 0

Re: Moderation and the Polymorphic Virus
by serw30＠laf.cioe.com 17 Dec '03

17 Dec '03

> To: cypherpunks(a)toad.com > serw30(a)laf.cioe.com writes: > > Yes, lets create polymorphic viruses and CPU cycle stealing Java > > applets. Maybe even a new and improved Internet worm... > Dr.Dimitri Vulis KOTM writes: > "Cypher punks" can't write any code - be it mail filters, viruses, or crypto. > Aw, surely "Cypher punks" can write some sort of code. Batch files, Macros for Word, programs for Logo or Turtle graphics, tell me it isn't so! Eric

3 3

RE: New Release: Universal Data Cryptography Module V2.0
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Black Unicorn on Thu, Jan 9, 1997 6:10 >On Wed, 8 Jan 1997 DataETRsch(a)aol.com wrote: > >> Integrated Mathematical Data Manipulation and Positioning. Extensive research >> shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. > >What research? >What is "extensive?" >What is "more advanced?" Paraphrasing a glossary of Comp-Sci terms I received in email, and using it to translate the second sentence above "Extensive research . . . PGP.": After trying unsuccessfully to get the damned thing to work for a very long time, we finally got it to work. Now it's so patched up we can't figure out what it's doing. PM

1 0

Interested in making extra income?
by ubs95＠earthlink.net 17 Dec '03

17 Dec '03

Suck_My_Big_Juicy_Cock, Hello! This is the only message you will recieve from us, so if you are not interested, we are sorry for the intrusion, just delete and we will not bother you again. We need help in our mail order dept. Would you like to be a catalog distrubutor? Profits are very good! For more information, DO NOT CLICK REPLY........ Send your inquirys to: UBS95(a)IX.NETCOM.COM

3 2

Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)
by Hal Finney 17 Dec '03

17 Dec '03

From: "Frank O'Dwyer" <fod(a)brd.ie> > However, what if there was a safe scripting language with bignum > arithmetic and other cryptographic primitives, and what if > lots of people ran a service that would accept scripts in > that language and respond with the answer? Say, a Safe-TCL > interface to Peter Gutmann's cryptlib, running at idle > priority? Sort of like a distributed batch queue, and also > a bit like the way jobs are (were?) submitted to Crays. The > Cypherpunks Super Computer. It need not be significantly slower > than raw code if the primitives are high level enough. A few years ago I coded up a TCL interface to Pr0duct Cypher's PGPTOOLS library. It did bignum arithmetic from the command line, and also let you use MD5 and IDEA on files and buffers. Unfortunately I had a major disk crash and was never able to recover my last version, and I never got back to it. Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever does it will be found to suffer from its own flaws. At this point I think Java is farther along the path to safety. I do like the idea of a widely available, installed, crypto-capable scripting language. This would be an ideal basis for trying out new crypto protocols and algorithms, without having to write a whole program from scratch. We have been talking about setting up DC nets for years, for example. The concept is so simple as to be almost trivial. But the infrastructure is the hard part - dealing with the I/O issues, the multiple architectures, all the configuration issues. I suspect that Java, when it gets its security API, may be a good candidate for this kind of system. It's already got high level socket I/O, and with a bignum package and some basic crypto primitives like one way functions, you could do a lot with it. You still have the problem of trading off safety for utility, though. Hal

1 0

IBM Opens Bin
by John Young 17 Dec '03

17 Dec '03

IBM announced today that it will make available free to the public its vast bin of 2 million US patents formerly accessible only to its own engineers and attorneys: http://patent.womplex.ibm.com/ Welcome to the IBM Patent Server. With this World Wide Web server, IBM lets you access over 26 years of U.S. Patent & Trademark Office (USPTO) patent descriptions as well as the last ten years of images. The first entries date back to January 5, 1971. You can search, retrieve and study over two million patents. NYT has a report about it: www.nytimes.com

1 0

Crypto Punch
by John Young 17 Dec '03

17 Dec '03

Punch in "cryptography" at the IBM patent site and ogle: you won't believe your oozing orbs. http://patent.womplex.ibm.com/ Then try other bell-ringers of this punch-drunk ring.

1 0

IMPORTANT: Additional information about UDCM.
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

{Please read this *entire* e-mail message.} Hi, A detailed description of the IMDMP encryption algorithm will be posted to this mailing list within a few days. An end-user application will be released within a few weeks. I would appreciate it if all you cypherpunks out there review the description and the software, and tell me what you think of IMDMP. Also: The AOL web site address my company has may not always work out when the server is having problems or user overloads. Please try again later. Again, the web site address for UDCM, Universal Data Cryptography Module, is: http://members.aol.com/DataETRsch/udcm.html. IN RESPONSE TO THE FLAME MAIL DATA RESEARCH HAS BEEN RECEIVING: Note: The 18 "sub-algorithms" of IMDMP are basically algorithm "modes", and, yes, many algorithms do *not* have multiple encryption layers, although, obviously, the more advanced ones do. Also, 256 bytes is equal to 2048 bits. I realize that most of you out there know that, but some of you don't. "Bits" are referenced more often than "bytes". And, the "industry standard" that IMDMP is obviously well above is DES, etc. Also, DES 128, PGP 1024, RSA 128, IDEA 128, and IMDMP 2048 were applied at their maximum settings on a file full of about 64 *million* repeating "A" ASCII character bytes. The mutation levels the algorithms rendered on their individual trash test files were compared. Subtle patterns where searched for. Binary character tallys where taken. IMDMP did *not* leave *any* repeating patterns in the test file that was used. In IMDMP, each of the 256 possible binary character combinations had an approximate count of 0.390625% of all of the 64 million bytes. 0.390625% is the best possible percentage. Are all of you out there satisfied? Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

7 7

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

A warning label ought to be tattooed on Tim C. May's head, saying `Warning: shit content under pressure'. o-:^>___? Tim C. May `~~c--^c'

1 0

Trade secrets / moderator liability
by Greg Broiles 17 Dec '03

17 Dec '03

As reported by Michael Froomkin's correspondent, the Uniform Trade Secrets Act <http://www.execpc.com/~mhallign/usta.html> (enacted with local modifications in, as I understand it, 40 states, among them California) says that third parties may be held liable for misappropriation of a trade secret where the third party knows or has reason to know that they are doing so. For example, California Civil Code section 3426.3 says: 3426.3.(a) A complainant may recover damages for the actual loss caused by misappropriation. A complainant also may recover for the unjust enrichment caused by misappropriation that is not taken into account in computing damages for actual loss. (b) If neither damages nor unjust enrichment caused by misappropriation are provable, the court may order payment of a reasonable royalty for no longer than the period of time the use could have been prohibited. (c) If willful and malicious misappropriation exists, the court may award exemplary damages in an amount not exceeding twice any award made under subdivision (a) or (b). And misappropriation is defined in California Civil Code section 3426(1)(b) as: (1) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or (2) Disclosure or use of a trade secret of another without express or implied consent by a person who: (A) Used improper means to acquire knowledge of the trade secret; or (B) At the time of disclosure or use, knew or had reason to know that his or her knowledge of the trade secret was: (i) Derived from or through a person who had utilized improper means to acquire it; (ii) Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or (iii) Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use; or (C) Before a material change of his or her position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake. My other concern about moderator liability for approving/distributing trade secret material is in the criminal context. For example, the Economic Espionage Act of 1996 (HR 3723, now found at 18 USC 1831 et seq, <ftp://ftp.loc.gov/pub/thomas/c104/h3723.enr.txt> ) says that some trade secret violations are now a federal crime; and California Penal Code section 499c(b) also criminalizes some wrongful acts relating to trade secrets. Specifically, I think it's feasible to find aiding & abetting (and, more remotely, conspiracy) liability where a moderator knowingly and substantially contributes to public disclosure of a trade secret. It seems to me that there's a murky middle period, where the trade secret is known to some wrong people, but is still substantially a secret, where third party liability is present. But once a wide distribution of the secret is made, I don't think it's meaningful to talk about further distribution as misappropriation. If there's no common-sense "it's no longer a secret" safety valve, trade secret would provide time-unlimited protection to publically available information, which I think would be preempted by (or frustrate the purpose of) Congress' limited grants of protection to information via patent and copyright. But this is only my conjecture about how things ought to work, given the responsibilities created for third parties by statutes like the UTSA; I don't know of cases on this issue and given my work/bar review schedule, won't have time to find them any time soon. Also, as I mentioned in my previous message, I think there are good arguments that neither of the prominent trade secret disclosures I'm familiar with that have occurred (in part) via the list would create moderator liability. I'm mentioning moderator liability (and writing what's turning into a long message about it) not because I think it's an especially big danger but because I think it's an interesting public policy issue. I don't have the teeniest clue how other nations' laws might treat third parties who assist or enable the wide dissemination of trade secret materials. Perhaps other list members can offer a local perspective. -- Greg Broiles gbroiles(a)c2.net 510-986-8779 voice 510-986-8777 fax

2 1

Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)
by Hal Finney 17 Dec '03

17 Dec '03

[Sorry if this is a re-post...] From: "Frank O'Dwyer" <fod(a)brd.ie> > However, what if there was a safe scripting language with bignum > arithmetic and other cryptographic primitives, and what if > lots of people ran a service that would accept scripts in > that language and respond with the answer? Say, a Safe-TCL > interface to Peter Gutmann's cryptlib, running at idle > priority? Sort of like a distributed batch queue, and also > a bit like the way jobs are (were?) submitted to Crays. The > Cypherpunks Super Computer. It need not be significantly slower > than raw code if the primitives are high level enough. A few years ago I coded up a TCL interface to Pr0duct Cypher's PGPTOOLS library. It did bignum arithmetic from the command line, and also let you use MD5 and IDEA on files and buffers. Unfortunately I had a major disk crash and was never able to recover my last version, and I never got back to it. Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever does it will be found to suffer from its own flaws. At this point I think Java is farther along the path to safety. I do like the idea of a widely available, installed, crypto-capable scripting language. This would be an ideal basis for trying out new crypto protocols and algorithms, without having to write a whole program from scratch. We have been talking about setting up DC nets for years, for example. The concept is so simple as to be almost trivial. But the infrastructure is the hard part - dealing with the I/O issues, the multiple architectures, all the configuration issues. I suspect that Java, when it gets its security API, may be a good candidate for this kind of system. It's already got high level socket I/O, and with a bignum package and some basic crypto primitives like one way functions, you could do a lot with it. You still have the problem of trading off safety for utility, though. Hal

3 2