December 2003 - cypherpunks-legacy

Re: Executing Encrypted Code
by Jazzmin Belle Sommers 17 Dec '03

17 Dec '03

>>>> You could also timestamp the software so that it only runs for a given >>>> length of time. This will encourage people to upgrade regularly. ;-) >>> Or to reset their clocks. Which is what many of us do when software is >>> about to "expire." >>However, why not use "beacons"? chop chop chop I have been using some shareware that simply has a built-in counter. Once the counter runs out, you have to register. I would suppose that one could hack the code to find the counter, assuming you could decompile it (or wanted to). Personally I think this is a decent solution to the problem -- the counter on this particular software let you use it 50 times. That's adequate to determine whether you want to keep it or not. Of course, if you saved the .zip file to disk before you installed it, you could delete the copy and reinstall the .zip. But everyone knows this. Jazzmin Sommers

1 0

RE: Securing ActiveX.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Armenians are murderous cowards. They killed over 2 million Moslems in > this century alone - mostly women and children. I note that along with this racist generalisation you decided to post the following rant: >As usual, Timmy May spouts racist, anti-Semitic shit. As usual, he has >no idea what he's talking about. So what else is new... As well as a number of other rants along those lines. There is little difference between over generalisations of the kind you made above and, for example, discriminating against someone on the basis of race, colour, religion etc. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 8:31 PM 12/19/1996, Timothy C. May wrote: >At 7:34 PM -0800 12/19/96, Peter Hendrickson wrote: >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) > Or to reset their clocks. Which is what many of us do when software is > about to "expire." You are right that this only works in instances where the customer just needs a little prodding to get the upgrade and not in instances where the customer might put up with significant inconvenience to avoid it. However, why not use "beacons"? The clock could have a built-in timer that needs to be reset once a month from an authenticated source. This assumes the presence of net connectivity, but that's not a terrible assumption. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:16 PM 12/19/1996, Ben Byer wrote: > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Let's say each key is 2048 bits and there are 10 million processors. That's only 2.38 gigabytes, or under $1000. Easy enough to put on the Web or on a set of CD-ROMs. > Also... with a few million possible keys like this, all you need to do > is to either guess or factor just one of them. Yes, my working assumption is that factoring is very hard. >>> Does the authentication defeat this? >> I'm sort of waving my hands around when I say "authentication". >> One approach is for the manufacturer to authenticate software submitted >> by approved vendors. The vendors are then tasked with encrypting it >> for the correct processor. > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. You have to have the "approved" message so that you don't get viruses and to thwart piracy in case anybody did manage to get the secret key out of the chip. How well it goes over depends entirely on how much you pay for the software. >>> Our computers would only run software from Microsoft? Scary. >> There are all sorts of nifty deals that could be made. Microsoft >> could commission a special run of the processors which only run >> Microsoft approved software. Machines using these processors could >> be given away or sold at a steep discount. > Right; the only reason I could see people using this would be for > economical reasons. And one would expect piracy-proof software to be very inexpensive. Most people who pay for software have little sympathy for those who don't. >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) >> The processors could also support metering. > Right; once the user loses control of what he's running, then you can > pretty much do anything you want as far as metering goes. Right you are - see below. > ObGAK question: Would this be exportable? I mean, you could be > encrypting god knows WHAT into those .exe's... Key escrow? How would > they get the key?!? I can see the headlines, "Key Escrow Database > Leaked to Pirate Firm"... :) While I am certainly not a lawyer, and even the lawyers can't tell you what is legal to export, I would guess that Big Brother would be delighted with the manufacturers of this processor. It can't be used to encrypt communications, only to decrypt software. What is more, you could control the physical processors so that exportable processors accept a different authentication key. Then, the manufacturer of the processor can take care not to authenticate any privacy enhancing programs for the export version of the processor. Free speech and constitutional issues evaporate because the processors are physical devices and not expressions of ideas. Even "better", not very many organizations in the world can afford the fab lines to manufacture a state of the art processor. So, if the G-7 countries are brought onto the reservation, it would be feasible to forbid all free processors. Peter Hendrickson ph(a)netcom.com P.S. Did you hear? For Christmas Big Brother is raising the chocolate ration from 30g to 20g!!!

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:20 PM 12/19/1996, Timothy C. May wrote: >> However, why not use "beacons"? The clock could have a built-in timer >> that needs to be reset once a month from an authenticated source. This >> assumes the presence of net connectivity, but that's not a terrible >> assumption. > I mentioned "beacons" in the portion of my message you did not quote here. Gack! > As for why they are not being used, they don't exist. Here's how I would do it. When the processor wants to update its clock, it generates a random number and encrypts it for the trusted time source. The trusted time source decrypts its message to get the random number. It timestamps it, encrypts it, and sends it back. This means you can't replay old time messages to keep using your old software. Is it possible to have a little clock and rechargeable battery on a chip? If so, then this technique should be easy to use. If not, then the processor can count the number of cycles it runs and use that as an approximate means of deciding when to check the time. Or, it could demand a time update every time it is power cycled. Peter Hendrickson ph(a)netcom.com

1 0

Expedia New Member Information
by accthelp＠expedia.com 17 Dec '03

17 Dec '03

Welcome to Microsoft Expedia Travel Services! Below is your new membership information. Please keep this confirmation mail as a record of your Member ID and Password. Your Member ID is: cypherpunks Your Password is: cypherpunks The Expedia Internet address is: http://expedia.msn.com/ Expedia is a free service. To use the Expedia Travel Agent, you will have to type your Member ID and Password on the Sign In page. Whether for business or pleasure, Microsoft Expedia makes it easy for you to plan and purchase travel arrangements that best meet your budget and personal preferences. Expedia is on the job 24 hours a day, 7 days a week. With a click of your mouse, you can: * Reserve and purchase airline tickets * Reserve hotel rooms * Reserve rental cars * Subscribe to Fare Tracker for the lowest airfares to your favorite destinations * Research over 300 destinations in the Expedia World Guide * Chart your course with over 200 city maps * Check out the world of adventure in the Mungo Park online magazine * Catch up on the latest travel news, weather and more We look forward to fulfilling all of your travel needs. Expedia Member Services Start your travel here. http://expedia.msn.com/

1 0

Re: Proof that "cypher punks" have complete degenerated...
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 19 Dec 1996 04:24:14 +0000, geeman(a)best.com wrote: >It wasn't worth commenting on. >Appending data after the ctrl-Z as stego? >Not even worth a letter to the ed! >> No one even commented on the latest Dr. Dobbs issue. I know - I was amazed that made it into the issue. It's almost amazing that someone would go to such effort to do this and miss all the [IMHO] easier ways. Simply astounding... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:52 PM 12/19/1996, Bill Frantz wrote: >At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. >> Software piracy becomes difficult, if not impossible. Code is sold >> on a processor by processor basis. Code for a different physical >> processor cannot be decrypted or executed. > This makes backup hard. That is the rock the routine copy protection hit > up against. There were many, me included, who simply said, "If your > product is copy protected then I will buy from your competitor." No, you can backup just as much as many times as you like. The code isn't stored on the chip permanently, it is only decrypted there. There is a similar problem, though. If your processor dies you could lose your software library. There are ways to mitigate this. One is for the vendors to just trust people and reissue the code to a new processor. Of course, you track how often you have to do this. Or, you could turn in the broken processor and have the manufacturer certify that it was turned in to the software vendors and that a new version of the software should be generated. This might not be so important if you generally pay for metered software. >> Viruses are not feasible if the authentication is strong. > So is user written code, public domain code etc. If there is an > un-encrypted mode for that kind of code, then viruses again become > possible. User written code is harder to arrange, it is true. You might have a way to execute non-authenticated code but at a speed comparable to an emulator. Or, you might just have another computer for running your own code. Right now it is not uncommon for a software library to exceed the value of the machine. It might actually be economical to have two machines if one of them can support a rich software library which doesn't cost as much money because it can't be pirated. Free software is still possible to run at full speed, but it has to be authenticated. The free software writer just has to do whatever the software vendor had to do to get it okayed. This makes it harder to release free software, but the effort is still a small fraction of the work required to build a significant application. Getting it to execute for particular processors is easy. You could release a piece of software which takes code and encrypts it for your particular hunk of silicon. If you could offer otherwise free software for, say, $20 and know that everybody using it will pay, many people might consider that to be a great deal. Right now the mechanisms of moving the software are too expensive to really make it feasible for something under $20. Development might be a bit tricky, but there are workable solutions. The manufacturer could release special processors which have an additional authentication mechanism for software developers which is specific to each developer. They could authenticate code to run on their own machine, but not on anybody else's. This does make it possible for software developers to pirate software (if the can get a secret key), but if the number of development processors is low, this could be manageable. If the environment was well defined, you could conceivably develop in a high level language on one platform, but deploy for sale on the decrypting-processor platform. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:41 AM 12/20/1996, Scott V. McGuire wrote: >On Thu, 19 Dec 1996, Peter Hendrickson Wrote: >> The manufacturer of the encrypted-code processor would protect its >> instruction set using intellectual property law. Given the high >> price of a fab, it is entirely feasible to stop anybody from building >> a new architecture which can execute the code about as fast as >> the encrypting-code processor. > It seems to me that this is where this scheme would be broken. Have > intellectual property laws been (successfully) used in this way? I don't know, but I bet it would be possible to arrange if there was support for it. Or, maybe the instruction set itself remains a trade secret. Sure, it could leak out, but aren't there laws against industrial espionage? (If the instruction set was secret, the manufacturer might have to provide a compilation service.) > And even if so, would they be enforced in all the countries where the > chips might be fabricated? Yes, if the laws exist they would be easy to enforce. What does a state-of-the-art fab cost now? $5 billion? $10 billion? I was generous when I said "G-7". Which countries can really compete in this market? The U.S. and Japan, I believe. There is no reason to rule out extra-legal pressure, either. The USG appears to have played the policeman in supporting the DRAM market in an informal way. It would be very easy to have a chat with the Japanese government about the importance of stopping software piracy. Peter Hendrickson ph(a)netcom.com

1 0

Ebonics
by Timothy C. May 17 Dec '03

17 Dec '03

In order to remain compliant with the new California law requiring increased use of "Ebonics," the new academic name for "Black English" (and known by honkey mofos as "ghetto jive"). Apparently the coloreds have had enough of "standard English" and its repression of their culture. To meet the requirements of this new law, 10% of my posts from now on will be written as best I can manage in the Ebonic language. Switching to Ebonics: De honks be chimin.' Code be fly! I's huffa be gots to be sizing, bitch. PGP 3 be dope, nuffin but bad! I be axing you if it be outa honkeyland or outa Afrika? Dat bitch Reno be sayin' it be 'legal be usin' dope 'warez. Day be hos. --a melanin-challenged honkey mofo Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Test files for encryption
by Steve O 17 Dec '03

17 Dec '03

Can someone point me to any standard files that are used when testing encryption strength. Iie i'm looking for a gourp of files that may have been used by an agency or Internet group in the past that when encrypted were tested for byte frequency etc. as well as cryptoanalytic atacks. thanks in advance. steveo privsoft(a)ix.netcom.com

1 0

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 03:30:46 EST, you write: << > >You could also timestamp the software so that it only runs for a given > >length of time. This will encourage people to upgrade regularly. ;-) > >> If anyone thinks it is anything but trivial to track down a call for time/date and a comparison of the two.. and then overwrite the area with some nop's to make sure the address jumps come out the same.. your sadly mistaken =-}

1 0

C2Net Party: January 24th
by sameer 17 Dec '03

17 Dec '03

http://www.c2.net/party/ C2NET is having a party January 24th at 654 Mission St. San Francisco assorted snacks, a cash bar and live music by WEIRD BLINKING LIGHTS with dj accompaniment by DJ FLINT and DJ PINNIPED will be present for your enjoyment Festivities begin at 8PM We hope to see you there --- Directions: >From the West or North: Take Oak Street East. Turn left on Laguna. Turn right on Fell. Fell crosses Market and becomes 10th Street. Merge left within one block of Market. Turn left on Mission. >From the East: Take Hwy 80 West across the Bay Bridge. Take the first exit on the left (Harrison Street exit) Turn left on Harrison. Turn right on 3rd Street. Turn right on Mission. >From the South: Take Hwy 280 North. Follow 280 to its end at 4th & King Streets. Follow King Street to its end at 3rd Street. Turn left on 3rd. Turn right on Mission. >From BART: Take BART to the Montgomery station Walk south on New Montgomery Street Turn right on Mission. Parking: There is a commercial parking lot across the street on Mission and another one on the corner of 3rd and Mission.

1 0

Re: Executing Encrypted Code
by Hal Finney 17 Dec '03

17 Dec '03

From: Ben Byer <root(a)bushing.plastic.crosslink.net> > [Quoting Peter Hendrickson:] > > The software vendor would be wise to check that the public key was > > legal. It would be a simple matter for the manufacturer to publicize > > all public keys that had been installed on chips. > > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Probably an easier way would be for the chip manufacturer to issue a key certificate (signature) on the chip keys. Then it is a trivial matter for any software manufacturer to verify that a proferred chip key is legit; just check the cert. > > One approach is for the manufacturer to authenticate software submitted > > by approved vendors. The vendors are then tasked with encrypting it > > for the correct processor. > > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. Hey, it's a free world, right? Some people only run authenticated code from big companies; other people turn off the authentication bit in the CPU and can run any old thing they stumble across on the net. Everybody's happy. The first group doesn't have to worry about viruses, or at least they have somebody to sue if they see one, and the second group gets to run all the freeware and PD code they can today. > Right; the only reason I could see people using this would be for > economical reasons. Yes, I think this is a point often missed in these discussions. People say, why would I want a CPU which will limit the software I can run, something which will let a software maker give me a version of his program which will only run on my CPU and which I have no ability to share with others? What's in it for me? The answer presumably is that the software manufacturer will sell software with such limits for much less than he will sell unlimited software. That's because software piracy is such a major problem, and this way he can be protected against piracy from this copy of his program. So people with these CPU's can buy their software a lot cheaper. Now if you only use pirated software anyway, which you get for free, then obviously this is not much of an incentive. It is only for people who pay for their software. But that is a significant market. Of course the big downside is that the track record of tamper resistant hardware has not been too strong lately! If a system like this gets into widespread use and somebody finds out that shooting X-rays at the chip exposes its secret key, you've got a big problem. Hal

2 1

Key Escrow Rule
by John Young 17 Dec '03

17 Dec '03

The Federal Register of December 13, 1996 has published "Licensing of Key Escrow Encryption Equipment and Software" This parallels the draft regulations for encryption export provided by Steptoe & Johnson on December 11 but sets provisions specifically for key escrow products. We've put it at: http://jya.com/ke121396.htm (39 kb) Here are excerpts from the opening: ----------------------------------------------------------------------- This interim final rule amends the Export Administration Regulations (EAR) by imposing national security controls on Key escrow information security (encryption) equipment and software transferred from the U.S. Munitions List to the Commerce Control List following a commodity jurisdiction determination by the Department of State. This interim final rule also amends the EAR to exclude key escrow items from the de minimis provisions for items exported from abroad and to exclude key escrow encryption software from mass market eligibility. Further, key escrow encryption software is subject to the EAR even when made publicly available. ... Once transferred, key escrow encryption items will be controlled for national security reasons. A license will be required from the Department of Commerce to all destinations, except Canada. This is an initial step in liberalizing the treatment of encryption exports. The Bureau of Export Administration is preparing regulations to further implement the Administration's encryption policies, which will be published in the Federal Register in the near future. ...

1 0

BXA Crypto Meeting
by John Young 17 Dec '03

17 Dec '03

Federal Register: December 12, 1996 ----------------------------------------------------------------------- Bureau of Export Administration Information Systems, Technical Advisory Committee; Notice of Partially Closed Meeting A meeting of the Information Systems Technical Advisory Committee will be held January 7 & 8, Room 1617M-2, in the Herbert C. Hoover Building, 14th Street between Constitution and Pennsylvania Avenues, NW., Washington, DC. This Committee advises the Office of the Assistant Secretary for Export Administration with respect to technical questions that affect the level of export controls applicable to information systems equipment and technology. January 7 General Session 9:00 a.m.-12:00 p.m. 1. Opening remarks by the Chairmen. 2. Presentation on Office of Exporter Services outreach program. 3. Update on status of Export Administration Regulations. 4. Public discussion on encryption issues. 5. Other comments or presentations by the public. Closed Session 6. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. January 8 Closed Session 7. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. The General Session of the meeting is open to the public and a limited number of seats will be available. To the extent time permits, members of the public may present oral statements to the Committee. Written statements may be submitted at any time before or after the meeting. However, to facilitate distribution of public presentation materials to the Committee members, the Committee suggests that public presentation materials or comments be forwarded at least one week before the meeting to the address listed below: Ms. Lee Ann Carpenter, TAC Unit/OAS/EA, Room 3886C, Bureau of Export Administration, U.S. Department of Commerce, Washington, DC 20230 Dated: December 6, 1996.

1 0

Life with Dale
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:From: Dale Thorn <dthorn(a)gte.net> :I spent part of my growing up years in Leroy West Virginia, pop. :about 15, give or take. I know about hillbillies, and I know about :guns. :If you had the impression I am a whiner, or that that defines me as a :person, you're about as clueful as the other old farts who attack :people they don't know anything about. Name one thing Dale has not experienced.

5 12

Solidarity with Peruvian Guerrilla!
by aaron＠burn.ucsd.edu 17 Dec '03

17 Dec '03

** See list of useful Web sites at end of this post! ** Companer@s, I am writing this while I am tired and should be asleep, since I think that this matter is too urgent to delay. I apologize for any careless formulations. By now, you all know that the Peruvian guerrilla group MRTA (Movimiento Revolucionario Tupac Amaru) has occupied the mansion of the Japanese ambassador in Lima and is holding several hundred prisoners. Unless you are in an unusual part of the world, you also have seen how the bourgeois media are discussing the matter as a problem of how to deal with 'terrorists.' For the working people and all the oppressed and exploited of the world, and for socialists, communists, and anarchists, the seizure of the ambassador's residence along with about 400 bourgeois dinner guests is a great accomplishment. It is a blow against the terrorism of the Peruvian state and its imperialist patrons! Those captured in the raid include many members of the Peruvian and international ruling elite, including the head of Peru's secret police! It will be politically very difficult for the Peruvian state to launch a military attack as a means of resolving the crisis, since that would create quite a few 'illustrious corpses' and lead to a falling out among bourgeois sectors.. (And it would be difficult to get the world's poor majority to join the bourgeoisie in mourning its dead!) It seems that there is already a falling out between Fujimori and the Japanese over Fujimori's refusal, so far, to negotiate. It is very important that the situation in Lima not be resolved in a way that can be seen as a victory for the bourgeoisie. It is our task to publicize who the real criminals are in Peru and to help wring concessions from the Peruvian dictatorship. In particular, we should demand the release of all political prisoners and prisoners of war from Peru's hideous torture-chamber prisons. In this context, let's not get involved in sectarian battles among the various factions of Peru's anti-government left. Whatever differences the groups have, and these are very serious, we must keep in mind that the Peruvian state and its imperialist backers (in Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political prisoners must be released, whether of MRTA, the PCP (Shining Path) or neither. Thanks to the widespread publicity given to the events in Lima, many more people will be interested in what we have to say about Peru than normally would. Let's organize demonstrations at Peruvian Embassies, Consulates, airline offices, etc. Let's raise our voices in whatever forum may be available to defend the heroic guerrillas and to denounce the real terrorists. --In solidarity, --Aaron <aaron(a)burn.ucsd.edu> P.S. Plans are being made for a demonstration at the Peruvian Consulate in San Francisco, California -- probably on Monday, December 23. If you live in the area, please send me an e-mail message. Otherwise, do what you can in your area! SOME USEFUL WEB SITES: Web site on the current crisis: <http://burn.ucsd.edu/~ats/mrta.htm> What Are The Goals Of Your Embassy Occupation? -- Interview With Norma Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In Peru: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> Partial list of hostages: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> MRTA's web site in Europe: <http://www.cybercity.dk/users/ccc17427/> Lima's best bourgeois newspaper (in Spanish): http://ekeko.rcp.net.pe/LaRepublica/

2 2

Dale defends free society from the NSApunks (was Re: Encryption ?
by nobody＠replay.com 17 Dec '03

17 Dec '03

I thought this was so funny I've saved it. Perhaps we could vote on the quality of Dale's ideas and arrive at an estimate of the proportion of NSA supporters on the list. THE AKOND OF SWAT :Date: Thu, 19 Dec 1996 07:36:03 -0800 :From: Dale Thorn <dthorn(a)gte.net> :To: SHARK <otaner(a)boun.edu.tr> :Cc: cypherpunks(a)toad.com :Subject: Re: Encryption ? : :SHARK wrote: :> :> I am a Mathematic student at Bosphorus University in Turkey. :> I am interested in both computer applications and mathematical base of :> encryption.Where can I find this kind of staff on internet. :> Is it necessary to have high level of mathematical background in order to :> deal with encryption?? :> :> By the way Is there any member of this list from Turkey? : :There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. : :That is the main reason they accuse people of being snakeoil vendors, :to discourage people from inquiring about really new ideas, like some :of my ideas for example. : :Just so you know....

3 2

some clarification of jurisdiction in Berstein (long)
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- the question: ::I've seen two other reports (one from NBC) that say the ruling ::only covers the one federal district. ::Any lawyers want to clarify? The caveat: the following is a personal opinion and is not, in any way, to be considered either legal opinion or legal advice. Hire an attorney who specializes in these issues before you do anything rash which might qualify you for three hots and a cot. Basically, jurisdiction is all a question of who wants to honor whose decision until a higher level either affirms or rejects the lower court ruling (or sends it back w/o a full ruling but requiring a review of some part of the decision by the lower court). Generally speaking, the decision is valid for the Northern District of California, but a Federal district judge anywhere in the U.S. can make a concurring decision based on citing Judge Patel's decision that source code is protected under Amendment 1. In other words, the cite is valid anywhere, and can be used as the basis of a decision. Likewise, another district judge somewhere in the U.S. can issue a contrary ruling, still citing Judge Patel's ruling, but disagreeing with its tenants; or even ignore the decision and forge new ground. The basic rule of thumb is each federal judge is 'Judge Roy Bean, Law West of the Pecos' in his own courtroom, and able to virtually ignore even USSC rulings by claiming the action is not the same for some silly reason. He may be reversed on appeal... As for Judge Roy Bean, there have been a number who might qualify for the type in the Ninth Circuit who come to mind: Manny Real in LA, Hadder in LA, Foley in Vegas, and one in El Paso (whose name escapes me --maybe Peck), who was assassinated, probably by the drug trade, about 20 years ago. These are mavericks with a high percentage of cases reversed on appeal. Two of the four are of questionably diminished mental abilities, one was of questionable ethics, and one is just plain nuts --or at least off the wall (IMHO). I have not read the full Bernstein decision as yet, but I understand there are a fair number of unresolved issues such as binary objects. This again can spawn additional test cases, either by someone challenging the issue as Bernstein challenged the source code, which I consider was the correct decision as anyone can read source --understanding source code may be more difficult than reading a bad Russian translation of the nuances in Alice in Wonderland for some... (your mileage may vary...) Leaving government appeals out of the equation, if there are two or more district courts within an appeals circuit, whose fundamental opinion: 'source code is protected under Amendment 1 rights' do not agree, the obvious step is for the Ninth Circuit Court of Appeals, either by a 3 judge panel, or a full court review, to take jurisdiction and decide which of the two opinions suits their fancy. If a 3 judge panel does not give the decision expected, there is also a possible review by a full court on the motion of either party. Now, suppose the Ninth Circuit affirms Judge Patel. At that point every district court within the jurisdiction of the Ninth Circuit uses the Bernstein case as a given, an affirmed precedent; the rulings will reflect that unless some clever clown adds a twist and the judge falls for it. Again, setting aside appeals, there are multiple circuit appeal regions. None of these are bound by the Ninth Circuit decision, but it is a citation of importance. Now, if there are significantly different opinions in the appeal circuits, then the Supreme Court will decide whether they will accept the decisions for review, deciding which decision is valid; or the USSC can ignore it. Personally, I would publish anything regardless. I've had more than one go around with the simpletons. The first time the goons in gray trenchcoats shake you out of the rack in the early morning, there is a real adrenalin rush; after that it's: "Oh, shit, you guys again, who wants some coffee?" Whatever you do: keep your mouth shut; even teh previous thought is risky the assholes might charge you with attempted bribary of a Federal official. I have been quiet for 20 years; as you get older you get a lot more cranky, and less concerned with your welfare. You know: "strike another blow for Liberty, FUCK the CDA" and so on. Be a martyr; give your all for the cause. Eventually you end up in Springfield, Missouri, home for Federal Criminally Insane political victims. Larry Flynt (Hustler) managed to get away from the Feds who can hold an "insane" individual in their custody indefinitely: certifying him insane with one hand, while the other hand gives him a chemical lobotomy. Larry Flynt was sent to Springfield by a Federal Judge in LA for contempt of court --wearing an American flag as a diaper in his wheelchair (paraplegic). Unless you're a little crazy, I don't think I would start publishing source code yet. Oh, I expect it would be difficult for the Feds to get convictions with a strong precedent decision. But, keep in mind, federal judges are appointed on the basis of an ad in the local bar rag: 'wanted: middle aged person with failing law practice and good political connections.' A Federal judge is appointed for life; after age 65 they are able to choose cases which interest them; most of them seem to die on the bench (some would dispute they were ever alive on the bench). It's been said, "what do you call a lawyer with an IQ of 40?" "Your, Honour." If you wish to lay down the bait trail in the Northern California district, by all means, go ahead, but you might find yourself charged in a criminal action, and the government presenting a case that your charges are 'different' than the Bernstein case: Bernstein just wanted to publish an academic paper, you are charged with violation of the munitions act and maybe treason and espionage. And, always remember your opponent is a drug-crazed 800 lb gorilla with a mission: conviction. This case is the big one: Bernstein was the plaintiff, in a civil action. You will be the _defendant_, in a criminal action. I would not put a scenario like this past the DOJ scum; maybe multiple times to try and obtain results which match their corroded mental image of peace, prosperity, and union harmony. The DOJ is not interested in either justice or the Bill of Rights. Federal attorneys are striving for high conviction rates, like Vietnam body counts --and are enforcing the policies of the administration, not the courts, the constitution, or the people. If you managed to get here through the convoluted logic, I would be careful of how you loosen the floodgates. At this point we have made a statement which is a serious breach of their armor. We obviously need additional test cases to clarify the position, and the decision must ultimately be decided by the USSC. I would caution for another reason: if the Feds choose a preferred defendant who is flagrant, obnoxious, and on flaky ground; _they_ may have a good precedent, not us. Academic challenges are certainly among the best --a bit easier to make the point for education than for pornography. The next step IMHO, should be a challenge that object code is just a shipping container for the source code. == I'll get a life when it is proven and substantiated to be better than what I am currently experiencing. --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMrp6r704kQrCC2kFAQHx/gP6AoTCk7gEIjylULrXJcTS+QnOtV8Ic5s1 R0iPC0q3/67z9kROekOGOGkD1SRD8umnrO5rb7NRgJDBpdSzt1Hlp+FWZlH1HgZQ HmR0FZ6QUy1JKC9QJrw0oNTCaful/u4UHTAQLi4R8sTSx1RM/uWfR4Lw4kMKSQ11 Xa6hPWcvNZE= =Of3t -----END PGP SIGNATURE-----

1 0

FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Fri, 20 Dec 1996 07:32:52 -0500 (EST) >From: "Fred B. Ringel" <fredr(a)rivertown.net> >To: pgp-fone(a)rivertown.net >cc: pgp-users list <pgp-users(a)rivertown.net> >Subject: Mailing List Archive >Hi all- > > Finally got around to doing something I had meant to do. I have set >up an HTML-ized version of the PGPfone Mailing List archives. It is >reachable off the PGP Fone Registry, but the exact URL is : > > http://pgp.rivertown.net/pgp-fone/archives > >Now any newcomers to the list will find it easier to catch up, or if you >need to look something up, the archives are indexed by date, author, >and subject/thread. Hope you find it useful. Until I figure out how to >update it automatically over an NFS mounted system, I will manually update >them at least once a week. > > I'm sending this to PGP-Users too so anyone interested in the >PGPfone list can get a taste of what is going on there. The PGPFone list is >up to almost 100 subscribers and growing (tell your friends!!) > > Fred >/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ >Fred B. Ringel -- Rivertown.Net Internet Access >Systems Administrator -- http://www.rivertown.net >and General Fixer Upper -- Voice/Fax/Support: +1.914.478.2885 > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:42 AM 12/20/1996, Bill Frantz wrote: >At 11:16 PM -0800 12/19/96, Peter Hendrickson wrote: >> Or, you could turn in the broken processor and have the manufacturer >> certify that it was turned in to the software vendors and that >> a new version of the software should be generated. > I meant processor backup of course. When my processor breaks at 2AM and I > need to get the report out by 8AM, I'm going to call the software support > line and get help. If your processor dies you are SOL whether or not you have software. If it's worthwhile having a backup processor around, then you just have to spend a little more to have backup software, too. > Or the friendly hardware manufacturer is going to come > right out and certify my processor is dead. Come on and get real. With > most software vendors I can't even submit a bug report. If the reissuance of software is not possible (which I don't believe), it's an acceptable risk. Processors die far far less often than disks, and disks are getting pretty reliable. If the software companies can't get it together to reissue software, then it would certainly be easy to sell processor insurance to people who wanted it. This would allow them to replace their ~$10,000 software library. (You can buy theft insurance for roughly the same payoffs, so it's a feasible business. Theft is harder to verify and in my judgement occurs much more frequently than processor failure.) > Note that I am not saying there is a technical problem here. I do see big > problems with infrastructure and marketing. The last time software > companies tried to market copy protection, it failed in the market place. > I predict that encyphered instruction streams will too, and for the same > reasons. If the old copy protection just worked, it would have been widely accepted. Old copy protection had many problems. It didn't stop piracy. Sometimes it crashed your machine. Some schemes worked on some Intel machines but not on others. Backups were a problem. Etcetara. Peter Hendrickson ph(a)netcom.com

3 2

Solidarity with Peruvian Guerrilla! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, MRTA is a bunch of terrorists, irrespective of whether the issues they are trying to deal with are legitimate. They have threatened to kill people if they don't get their way. This alone is enough for me to not support them. They also have taken their internal bitch outside their unhappy home and involved other nationalities. If they were my neighbors I would call the cops and if allowed on the jury I would give them the max. What I would suggest is that the Japanese take as many of the MRTA out as they possibly can. I support the Japanese. Screw the MRTA and the Peruvian government, little Hitlers are little Hitlers. Banzai! Jim Choate CyberTects Forwarded message: > From cypherpunks-errors(a)toad.com Fri Dec 20 14:21:00 1996 > Message-Id: <v02130501aee03559777a(a)[136.152.11.117]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 20 Dec 1996 06:16:20 -0800 > To: aaron(a)burn.ucsd.edu (All recipients) > From: aaron(a)burn.ucsd.edu (Aaron) > Subject: Solidarity with Peruvian Guerrilla! > Cc: nyt(a)blythe.org (nyxfer), seac+nafta(a)ecosys.drdr.virginia.edu, > bc05319(a)binghamton.edu (TAZ), BAYLEFT(a)cmsa.Berkeley.EDU, > red-skinheads-l(a)eart.com, anarchy-list(a)cwi.nl, spg-l(a)xs4all.nl, > LABOR-L(a)YORKU.CA, a-infos(a)lglobal.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > ** See list of useful Web sites at end of this post! ** > > Companer@s, > > I am writing this while I am tired and should be asleep, since I think that > this matter is too urgent to delay. I apologize for any careless > formulations. > > By now, you all know that the Peruvian guerrilla group MRTA (Movimiento > Revolucionario Tupac Amaru) has occupied the mansion of the Japanese > ambassador in Lima and is holding several hundred prisoners. Unless you are > in an unusual part of the world, you also have seen how the bourgeois media > are discussing the matter as a problem of how to deal with 'terrorists.' > > For the working people and all the oppressed and exploited of the world, > and for socialists, communists, and anarchists, the seizure of the > ambassador's residence along with about 400 bourgeois dinner guests is a > great accomplishment. It is a blow against the terrorism of the Peruvian > state and its imperialist patrons! Those captured in the raid include many > members of the Peruvian and international ruling elite, including the head > of Peru's secret police! It will be politically very difficult for the > Peruvian state to launch a military attack as a means of resolving the > crisis, since that would create quite a few 'illustrious corpses' and lead > to a falling out among bourgeois sectors.. (And it would be difficult to > get the world's poor majority to join the bourgeoisie in mourning its > dead!) It seems that there is already a falling out between Fujimori and > the Japanese over Fujimori's refusal, so far, to negotiate. > > It is very important that the situation in Lima not be resolved in a way > that can be seen as a victory for the bourgeoisie. It is our task to > publicize who the real criminals are in Peru and to help wring concessions > from the Peruvian dictatorship. In particular, we should demand the release > of all political prisoners and prisoners of war from Peru's hideous > torture-chamber prisons. In this context, let's not get involved in > sectarian battles among the various factions of Peru's anti-government > left. Whatever differences the groups have, and these are very serious, we > must keep in mind that the Peruvian state and its imperialist backers (in > Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political > prisoners must be released, whether of MRTA, the PCP (Shining Path) or > neither. > > Thanks to the widespread publicity given to the events in Lima, many more > people will be interested in what we have to say about Peru than normally > would. Let's organize demonstrations at Peruvian Embassies, Consulates, > airline offices, etc. Let's raise our voices in whatever forum may be > available to defend the heroic guerrillas and to denounce the real > terrorists. > > --In solidarity, > --Aaron <aaron(a)burn.ucsd.edu> > > P.S. Plans are being made for a demonstration at the Peruvian Consulate in > San Francisco, California -- probably on Monday, December 23. If you live > in the area, please send me an e-mail message. Otherwise, do what you can > in your area! > > SOME USEFUL WEB SITES: > > Web site on the current crisis: > <http://burn.ucsd.edu/~ats/mrta.htm> > > What Are The Goals Of Your Embassy Occupation? -- Interview With Norma > Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In > Peru: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> > > Partial list of hostages: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> > > MRTA's web site in Europe: > <http://www.cybercity.dk/users/ccc17427/> > > Lima's best bourgeois newspaper (in Spanish): > http://ekeko.rcp.net.pe/LaRepublica/ > >

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 7:43 AM 12/20/1996, Hal Finney wrote: >> The manufacturer is going to publish a list of ALL of the public keys? >> We're talking one key per chip, right? Isn't that an AWFUL lot of >> keys, like, in the millions range? > Probably an easier way would be for the chip manufacturer to issue a > key certificate (signature) on the chip keys. Then it is a trivial > matter for any software manufacturer to verify that a proferred chip > key is legit; just check the cert. Now why didn't I think of that! >>> One approach is for the manufacturer to authenticate software submitted >>> by approved vendors. The vendors are then tasked with encrypting it >>> for the correct processor. >> I'm not sure the "approved" bit would go over too well... one idea >> would be to license the compiler writers, who would build the >> encryption into compilers. It's still not horribly great, but >> better. > Hey, it's a free world, right? Some people only run authenticated > code from big companies; other people turn off the authentication > bit in the CPU and can run any old thing they stumble across on the net. > Everybody's happy. Maybe not everybody. My scheme would not let you turn off the authentication bit. That means that if somebody does find way to get at the secret key, they still can't run the code without doing something expensive with particular processors. Basically, this won't be worth the trouble. > The first group doesn't have to worry about viruses, > or at least they have somebody to sue if they see one, and the second > group gets to run all the freeware and PD code they can today. The second group would have to buy a different processor altogether, the way I proposed it. But, that does not seem unreasonable. One could even imagine systems which have a "free" processor and a decrypting processor. While they would have to have completely different instruction sets, they could be pin compatible. >> Right; the only reason I could see people using this would be for >> economical reasons. > Yes, I think this is a point often missed in these discussions. People > say, why would I want a CPU which will limit the software I can run, > something which will let a software maker give me a version of his > program which will only run on my CPU and which I have no ability to > share with others? What's in it for me? > The answer presumably is that the software manufacturer will sell software > with such limits for much less than he will sell unlimited software. That's > because software piracy is such a major problem, and this way he can be > protected against piracy from this copy of his program. So people with > these CPU's can buy their software a lot cheaper. I agree with all of this. Some people might be happier if they think of this as just another kind of agreement that people can make. Right now the software development agreement is weak because piracy is so easy. We rely a little bit on the law and a whole lot on the integrity of customers. Really, that isn't ideal. It would be nice if people could make strong agreements to write software. My judgement is that software piracy is less of a problem in the U.S. than it is elsewhere. My impression is that there are many other countries in the world where the whole "I should help pay for the development of this software because I am using it" idea just doesn't really show up on the screen. This processor would make it possible to sell software to the whole world without really worrying too much about how well each government enforces its laws or how ethical the people in foreign countries are. > Of course the big downside is that the track record of tamper resistant > hardware has not been too strong lately! If a system like this gets into > widespread use and somebody finds out that shooting X-rays at the chip > exposes its secret key, you've got a big problem. Processors are really only good for 3 years or so. The vendor is only betting that attacks won't become widespread in that time period. That is not a perfectly safe bet, but it isn't bad. The attacks can exist, but so long as they are expensive or hard to generalize to all processors, the software vendors are safe. Peter Hendrickson ph(a)netcom.com

1 0

The CyberSitter Diaper Change, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

[From this morning's Netly News. Check out the HTML version of the article at netlynews.com for links to the threatening letters, etc. --Declan] The Netly News http://netlynews.com/ December 20, 1996 The CyberSitter Diaper Change By Declan McCullagh (declan(a)well.com) Brian Milburn is angry. The president of Solid Oak Software, makers of the CyberSitter Net-filtering software, has seen his company's product come under heavy fire this year. Its offense? Critics say that CyberSitter has reached far beyond its mandate of porn-blocking and instead has censored innocuous, even invaluable web sites. I admit I'm one of its critics. In a CyberWire Dispatch that Brock Meeks and I published in July, we revealed that the censorware bans such places as the International Gay and Lesbian Human Rights Commission and the online home of the National Organization for Women. Our Dispatch showed the world -- or at least our readers -- that the makers of CyberSitter have a clear political agenda. The article prompted follow-ups in CyberTimes and the National Law Journal and an editorial in the Washington Post with an exchange of letters to the editor between a NOW executive and a representative of Focus on the Family, a conservative group that markets CyberSitter. To Milburn's mind, our act of revealing the truth about his company's product was, literally, criminal. In August, he told us that he had asked the U.S. Department of Justice to launch a criminal investigation into the publication of our article. He was particularly upset with one paragraph that included a fragment of his database demonstrating that CyberSitter expressly bans info about gay society and culture. He wrote: "Your willful reverse engineering and subsequent publishing of copyrighted source code is a clear violation of US Copyright law. While we would easily prevail in a civil court in seeking damages... we will seek felony criminal prosecution under 17 USCS sect 503(a) of the Copyright Act, and are preparing documentation to submit with the criminal complaint to FBI [sic]." Milburn was upset because CyberSitter's database is scrambled to prevent kiddies from grabbing addresses of porn sites from it. It's lightweight encryption, sure, but just enough to frustrate Junior. The scrambled database also allows Solid Oak to add and delete banned sites without the user's knowledge -- something that we believe is a dangerous practice. Now, I should point out here that neither I nor Brock did the actual decrypting; we had received a copy of the descrambled filter list from a confidential source. In any event, Dispatch's attorneys replied to Milburn, saying that the article was "protected by the full force of the First Amendment to the United States Constitution" and fell squarely within the copyright act's "fair use" provisions. We never heard back from him or the FBI. But that nastygram from Milburn wasn't his last. As criticism of CyberSitter becomes more intense, he's stepped up his counterattacks, threatening legal action, blocking critics' sites, or both. Take Bennett Haselton, a college student who cobbled together a site called Peacefire in August. This fall he started an anti-CyberSitter page that listed some of the more controversial actions of the software. Milburn complained. On December 6 he wrote to Haselton's Internet provider, Media3 Technologies, and tried to persuade them to give Peacefire the boot. His e-mail said: "One of your subscribers has made it his mission in life to defame our product as he appearantly [sic] has a problem with parents wishing to filter their children's access to the internet." Another charge was that Haselton had linked to a copy of our Dispatch. Solid Oak then added Peacefire and Media3 to its list of blocked sites. To Marc Kanter, Solid Oak's marketing director, it was necessary. "The site directly has links to areas that have our source code decoded on it.... There's no reason that our users should be able to go to sites that effectually inactivate our program," he said. Milburn also accused Haselton of reverse-engineering CyberSitter to get the text of its database -- that is, of being the confidential source for the CyberWire Dispatch. "Reverse engineering had to have been done in order to get the information, and we believe Mr. Haselton was the one who did it," Milburn wrote. Note to Millburn: Haselton wasn't our source. Then there's the case of Glen Roberts. His web page giving instructions on how to disable CyberSitter is now banned -- as is his Internet service provider. That's because CyberSitter differs from its competitors CyberPatrol and SurfWatch, which can restrict access by URL; instead, CyberSitter has to block access to the entire ripco.com domain. So what's my problem, really? If people don't want to use CyberSitter or other nanny apps, they don't have to. It's voluntary. It's effective. It protects children, and it sure is better than the Communications Decency Act. I have one major objection to all of the software filters currently on the market: Consumers have no way of knowing what's being blocked. Without knowing what's on the filter list, parents can't know what Junior will or won't be seeing. When reporters who try to reveal that information are faced with potential criminal investigations, the press's ability to shed light on these companies is threatened. Such programs also give parents near-complete control over what their children can and can't read. Traditionally, kids have been able to browse the stacks of a library away from parental supervision. But when the library is online, access can be completely controlled by censorware. Pity the closeted gay son of homophobic parents, prevented by CyberSitter from accessing soc.support.youth.lesbian-gay-bi. Finally, it's a kind of intellectual bait-and-switch. The "smut blockers" grab power by playing to porn, then they wield it to advance a right-wing, conservative agenda. Family values activists would never have been able to pass a law that blocks as many sites as CyberSitter does. Besides censoring alt.censorship, it also blocks dozens of ISPs and university sites such as well.com, zoom.com, anon.penet.fi, best.com, webpower.com, ftp.std.com, cts.com, gwis2.seas.gwu.edu, hss.cmu.edu, c2.org, echonyc.com and accounting.com. Now, sadly, some libraries are using it. Solid Oak claims 900,000 registered users. ###

1 0