December 2003 - cypherpunks-legacy

Re: Response to ticket 012398-6918-403
by kozmo killah 17 Dec '03

17 Dec '03

1 0

Just a Reminder...
by mall＠daltek.net 17 Dec '03

17 Dec '03

* * * * You have been carefully selected to receive the following as a person obviously interested in this subject based upon your previous internet postings, or visits to one of our affiliate web sites. If you have received this message in error, please accept our apology as a responsible e-mailer, and reply with the word REMOVE in the subject line. You will be automatically excluded from future e-mailings. Thank you for your consideration and help in making the Internet spam-free. * * * * At your request, we recently sent you our International Shopping Mall Complex banner rates for your business. The following is an update on categories available, and several other new options available to fit your expansion plans and budget. Please take a look and see what would work best for you. We do have a 25% off special introductory offer on our Mini- Mirror Store Program, details below. PLUS HERE IS SOME EXCITING NEWS..a cutting edge option to be offered shortly to our clients. Right now, we are working on adding a program to the Malls that will enable ONLINE PURCHASES TO BE CHARGED TO THE CUSTOMERS' TELEPHONE BILL. This presents unlimited possibilities for impulse buying, no forms, just click a button... Right now, it can be used for items like downloading software, and electronic reports and books...But Here is the Big News..it will soon be able to work for hard goods!!..Just think about the opportunities here. We will be sending out a full report on this in the next week or two in our Client Newsletter. Another option available is an item that we can add to your mall stores which has proven very successful in increasing sales for any business. We would be glad to send you more information on this, just check box below. This has worked well for wholesale, retail, manufacturing and is so simple, you will wonder why you haven't thought of it before! Established in 1994, our award-winning International Shopping Complex avgs 1.5 million hits a month in our four Mall locations with approx. 300 stores from 29 countries. As the Web gets more and more congested, you know that attracting qualified buyers to your site gets even more challenging! You will get tremendous exposure in four shopping locations. You could not get a more targeted audience for your products. These visitors only come to the Malls to see the shops and are specifically looking in the listed categories for retail, wholesale/mfg or industrial offers. The advantages to having four store locations is huge. You will get four new URL's to post on all the search engines, and we also give you a site address where you can enter each url once only and it will automatically send it to 100 directories/search engines, giving you 400 new listings right off the bat, (no charge). A business that has four or five separate locations definitely establishes you as a serious business. This is the concept used by the offline shopping malls that spread from coast to coast - new brand names were established and became household words. What some of our storeowners have accomplished: One storeowner, after just over a year, grew to 5-figure Internet sales, another doubled their sales in just one month, another's business grew to over 70% international, an industrial client reports great response and sales, wholesalers and mfg. are getting distribution for their product lines, another storeowner has built a tremendous catalog mail order business, one store introduced a new product which started selling the first weekend online... Here is what another happy customer wrote last week, on renewing for another year with us: "You have a great system and it really helps me. You are a valuable and indispensable facet of my business." CURRENT OPTIONS AND RATES - All rates include installation and ONE FULL YEAR'S RENT - no monthly fees. 1.MINI-MIRROR SITES - These are very popular for large sites and for those who have frequent page updates. We "mirror" (copy) the front page of your existing site and install it in the four malls, linking back to the rest of your pages. You still have four new URL's. $475. SPECIAL THRU FEB.4, 1998...$375.00. (25% Introductory Discount). 2. NEW! EXCLUSIVE Banner Ads - These are just being offered and some categories have already been taken. One banner is offered per category directory and includes a " mini-mirror site" also. Inquire for availability. $495.00 per category banner, $1500 for all four Mall Entrance/ Main Directory also available. Some categories already sold out. (See list at end of this message). 3. FULL MIRROR SITES - If you have an existing site, and want to have four additional full stores in the Malls, we "mirror" (copy) your entire, existing site. Again, we have to quote you depending on complexity and size, we do also have a size limit. 4. ORIGINAL STORES - If you do not currently have a web site, we can design and install a storefront for you. This is obviously by quote as it depends on how many products, etc. It includes an online order form. Basic starts at $795.00. (includes all four locations). To receive details on any of the above options, please just fill out the following and email back. ========================== I would like information on the Exclusive Banner Ads. My Product/Service Category is:_____________________ Categories: Apparel/Accessories, Arts/Crafts/Antiques, Books/Education, Collectibles, Home/Garden/Pets, Food, Computer, Cosmetics/Personal Care, Toys/Games/Hobbies, Health/Fitness, Wholesale/Industrial, Gifts, Business/Finance, Jewelry, Auto/Boats, Audio/Music/Videos. SPORTS, TRAVEL, FLOWERS, JEWELRY - ALL FOUR LOCATIONS ARE SOLD OUT APPAREL, COMPUTER, HEALTH, COSMETICS...3 each still available. This applies to banners only of course, you can still have mirror sites in any category. My http:// is _______________________________ ========================== I would like a quote on an: Original Store ( ) Full Mirror ( ) My Site Address is: http://_________________________ ======================== I am interested in the 25% OFF mini-mirrors SPECIAL INTRODUCTORY OFFER, (Note: good thru February 1, 1998 only) My site address is: http://_________________________ Note: We do not accepted x-rated sites. ALSO PLEASE CHECK HERE IF YOU WOULD LIKE INFORMATION ON THE OPTION MENTIONED IN PARAGRAPH THREE. ( ) Thank you for your interest. ================================================================

1 0

ULotD? Cuban Tattoos.
by Robert Hettinga 17 Dec '03

17 Dec '03

A bit o'apocrypha for a Monday evening... Cheers, Bob --- begin forwarded text Resent-Date: Tue, 27 Jan 1998 11:27:25 -0500 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Cc: bostic(a)bsdi.com Subject: ULotD? Cuban Tattoos. Date: Tue, 27 Jan 1998 10:14:12 -0500 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/2668 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: Arunas Norvaisa <arunas(a)witty.com> There was a guy in Florida, Cuban by nationality, who had been unable to get US citizenship and was due to be deported. A couple of MIT students, who had heard about this guy and were after a lark, hopped a plane down to Florida and took this guy to a tatoo studio. What they tatooed on to him was the DES algorithm, in some computer readable form. Thus rendering the guy unexportable. The US government offered to scrape the tatoos off, but they guy's lawyers screamed something about human rights abuses. The way I heard it, the guy was eventually granted citizenship. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

3 3

Eureka! Wed Jan 28 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Wednesday's issue of Eureka! PLAYGAL This is truly a breathtaking site. Well-designed and easy to use with excellent content. The tour alone has hotter porn than many other 'free' sites - go see it now. It's explicit, comprehensive and top quality. There are 2,000 video feeds online, free live fucking with sound, 10,000 erotic stories, 1,000s of top quality pix, adult and arcade games, real ama- teur competitions and much more. Click now and be astounded! Playgal .... http://www.playgal.com/playgal/banner_abc1.html PLEASE VISIT THIS FINE EUREKA! PARTNER SITE James And Victoria's Erotic Site http://www.jamesandvictoria.com/ads/ads.cgi?advert=eureka Our free site has hundreds of photos, thousands of erotic stories, personal ads and several chat rooms. NUMB NUTS These guys have got more than just free hot hardcore XXX pix. A picture post, live sex shows and live chat is just part of their plans to get your nuts numb (thru over use). It's a heaving sack of horny sex. You'd be nuts to miss it! Numb Nuts ......................... http://www.numbnuts.com/ HERMITAGE There's plenty of thumbnailed asian beauties looking winsome, innocent, and most importantly, naked. These are pix of pretty girls in a pretty pink site. Pretty much, you'll be sure to fall in love. The girls just shine thru! Hermitage ....... http://www2.gol.com/users/able/nudfot1.htm HUMPIN AND PUMPIN Mature women, teen temptresses, they're all coming out of the woodwork. However you like your horny naked babes you'll find them here. There's a vast selection of sexy chicks with bedroom eyes, wearing a saucy grin. Essential ass on tap. Humpin and Pumpin ............ http://www.luvgun.com/pumpin/ PINK LOLLIPOP There's plenty to suck on and see. With free XXX pix and even some sound files. The web masters even want your comments to improve it. Hey boys! You're doing a good job with nice pix, and hot categories. Keep it up - so will we! Pink Lollipop ................. http://www.pinklollipop.com/ BRAND NEW - HOORAY! THE ADULT SEARCH ENGINE Now adult surfers have our very own search engine, directly designed to only list adult sites, and so run fast because all other types of site are ignored. Check it out today! Hooray! -----------------> http://eureka.abc-web.com/hooray/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here --> http://www.netscape.com/download/ Just 18 -----------------------> http://204.244.215.7/teens/ CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat -----------------> http://137.39.63.229/chat/ General/Fun Chat -------> http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!--->1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline-------->1-800-644-8779 FREE: Live 1-on-1 (international call only)--->011-678-77416 AMATEUR SITE OF THE DAY SUMMER: A hot 18 year old with the body and face of a goddess, Summer is the epitome of SEX. Her eyes enchant everyone she gazes upon. She also sports a world-class ass, one of the best on the net. Let Summer keep you warm on these cold winter nights! ---------------------------> http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY Amateur Women Stories: AmateurWomen.com brings you totally hot true sex stories and real pics of hot amatuer models. See and read what these hot honeys do in private! .......... ............................... http://www.amateurwomen.com/ DAILY CARTOON ----------> http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! ---> http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ----------> http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ------> http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ------> http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ----> http://eureka.abc-web.com/eureka/francais.htm ITALIANO ----> http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE > http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 --------------------------> http://137.39.63.229/?280 Pic 2 --------------------------> http://137.39.63.229/?281 Pic 3 --------------------------> http://137.39.63.229/?282 Pic 4 --------------------------> http://137.39.63.229/?283 Pic 5 --------------------------> http://137.39.63.229/?284 Pic 6 --------------------------> http://137.39.63.229/?285 Pic 7 --------------------------> http://137.39.63.229/?286 Pic 8 --------------------------> http://137.39.63.229/?287 Pic 9 --------------------------> http://137.39.63.229/?288 Pic 10 --------------------------> http://137.39.63.229/?289 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: Physical Meet: Feb. 21 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 27 Jan 1998 11:28:34 -0600 > From: "Troy A. Bollinger" <troy(a)austin.ibm.com> > Subject: Re: Physical Meet: Feb. 21 > Quoting Jim Choate (ravage(a)ssz.com) > > > > Ok, looks like the magic day is Saturday Feb. 21, 1998 from 6-7pm. > > > > So, now all we need is a place... > > > > Flipnotics worked last time. > > I'd like to suggest that everyone bring a printout of their PGP > fingerprint so we can sign each other's keys. I think I can make this one. I don't have any interest in signing or being signed however, thanks for the offer. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Video & cryptography...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Remember what your target is here. (Focus, Pinky!) The ultimate goal is that you're trying to convict a suspect of some wrongdoing in a courtroom, and you would like to use as evidence a piece of video footage. But now, in addition to the old standard of "chain of possession" whereby a police officer logs when s/he receives the evidence, who has accessed it in the lab, storage, etc., you may now be required to establish the "truth" of the video -- was it forged, staged, or altered? Can the defense convince a jury that a video is not what it appears to be? Look at the O.J. case where they convinced people that a piece of DNA might not have been his. What a load of malarkey they heaped upon those people, and shame on the prosecution for not going back and matching up another 50 markers, dropping the chances of an error from 1 in 3*10^12 to 1 in 3*10^60. (Ultimately, it wouldn't have mattered of course because they pointed out other "flaws" in the chain of possession, specifically the FBI crime lab. Why they might have had a *different* case with O.J.'s blood is beyond me... They could have retested the DNA from every cell in evidence on that trial, found only Nicole's, Goldman's and Simpson's DNA, and STILL they would have gotten it thrown out, because jurors are incapable of understanding math.) What this means to us is that, in a courtroom, a signed piece of digital tape will probably be accepted the same as an unsigned piece of analog tape. The courts have already established precedent that says that the scientific method has less value than an overpriced lawyer. Think about it: what we strive for as a cryptographic proof means less than the unsworn audio tape from a 21 year old intern. If some lawyer wants to challenge a piece of video, and can throw enough money at it, s/he's going to win. You're better off spending money training the persons operating the VCR, because that's the defense's next point of attack. The idea behind the digitally signed video frames is that the video "consumer" (the persons who shot and recorded the video) probably didn't edit the video to falsify some evidence, and that the person who built the camera is willing to go to court to testify that their video is not tampered with. As a video "consumer", you're willing to pay for a witness from the video equipment supplier to come testify that you didn't edit their video. It theoretically (in a certain, very limited subset of theory) eliminates the "Rising Sun" plotline where someone edited the digital video. Now, we all know that since you can falsify the video by all kinds of other means, the only thing it really accomplishes is it adds a float to the parade going past the jury. And whoever has the prettiest parade wins "justice", right? At 05:02 PM 1/26/98 -0500, Adam Shostack wrote: >Jim Choate wrote: >| > From: Adam Shostack <adam(a)homeport.org> >| > Subject: Re: Video & cryptography... >| > Date: Mon, 26 Jan 1998 13:56:57 -0500 (EST) >| >| > Schneier, Wagner and Kelsey have done some work on an authenticating >| > camera. > >Dave points out that this was Schneier, Hall and Kelsey. > >| > One issue to be concerned with is that what the camera sees is not >| > always the truth. Putting a film set together to film bigfoot is >| > easy. The fact that the film is authenticated as having come from the >| > camera doesn't mean a whole lot in some cases. >| >| Doesn't this same sort of issue arise from any other digital signature >| process then? There should be nothing fundamentaly different between the >| characteristics of a video camera signing a frame than a person signing >| email. > > It arises in a different context; with a signature on paper, >you're generally indicating that you've read and consented to whats on >the paper, not that you created it. The meaning of a camera signing a >video still is not obvious to me. Is it intended to be 'this is what >we saw through the lens?' or 'this is what really happened?' > >Adam

1 0

Information on key handling with Microsoft products (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

> There's been some discussion recently on this news alias about how > Microsoft > handles key management (and some related topics) in CryptoAPI (more > specifically, the Microsoft base CSPs). Below is a document we've put > together to help answer these questions. > > Thanks, > -JasonG > > Product Manager, Windows NT Security > Microsoft Corporation > > > > Microsoft's Response to Recent Questions on the Recovery > of Private Keys from various Microsoft Products > > Recently, there has been discussion on some Internet forums about the > methods Microsoft uses to store private keys in some of its products, as > well as about CryptoAPI's role in key management. These discussions > included > some inaccurate information about the PFX and PKCS-12 formats, as well as > how Microsoft implements these formats in its products. > > This paper was prepared by the Microsoft Public Key Infrastructure team to > provide some additional insight and clarification on these issues, and in > some cases, identify long-term plans that Microsoft has to continue the > improvement of security in our products. > > CryptoAPI > One area to clarify at the outset is the role of CryptoAPI. Implications > that any key management problem on Microsoft's Internet products would be > an > example of fundamental problems with CryptoAPI are absolutely inaccurate. > CryptoAPI is a set of cryptographic technologies that are provided for use > by other software--sort of a cryptographic toolbox. The actual > cryptographic > functions are provided through Cryptographic Service Providers (CSPs), > which > are implemented as DLLs. With the exception of the details about a > possible > PKCS-12 attack, all the issues raised in the recent discussions are > specifically aimed at Microsoft's base CSPs, not at CryptoAPI. The base > CSPs are the royalty-free, software-based CSPs provided with Windows NT > 4.0, > Windows 95, and Internet Explorer. These attacks do not apply in general > to > other CryptoAPI CSPs and do not indicate any fundamental concerns with the > security of the CryptoAPI architecture or applications built upon it. > > PFX/PKCS-12 > Microsoft products do not "store" private key material using PKCS-12, > contrary to recent descriptions on the Internet. For clarification, > PKCS-12 > is a standard format, used for export/import of Public Key Certificates > and > related key material. At present, the only Microsoft product that > supports > use of this format is Microsoft Internet Explorer 4.x. Internet Explorer > uses PKCS-12 solely as a means of migrating a user's Certificate and > public-private key pair between multiple Internet Explorer installations > or > between Internet Explorer and other products, such as Netscape > Communicator. > > > Some background might help. Microsoft originally developed the draft > specification for an encrypted export/import format, referred to as PFX, > but > the PFX specification was never implemented by Microsoft. Instead, the > PFX > specification was handed over to RSA Labs and it became the draft PKCS-12 > specification. The design was then reviewed, and contributed to, by a > number of other companies to arrive at the current PKCS-12 standard. > Microsoft and Netscape have both implemented PKCS-12 with 40-bit > encryption. > This was done to provide a common, exportable solution that was completely > interoperable. > > The example of breaking a PKCS-12 data blob, which was given in discussion > on the Internet, is not an attack on the "weak" cryptography of PKCS-12. > Rather, it is simply a dictionary attack (long known and well understood > in > cryptography), which works well if people use poorly-chosen passwords to > protect the PKCS-12 data blob. Examples of such bad passwords include > words > in the English dictionary. In our implementation of PKCS-12, we could > possibly do some things to make brute-force attack against an exported > PKCS-12 data blob more difficult. For example, performing a dictionary > check > on the password before accepting it for encrypting the data blob would > reduce the use of weak passwords. Alternatively, we could iterate the > setup > function to increase "diversity" making it much more expensive for an > attacker to search. However, neither of these methods are required for > protection of the data blob. Good security is always a combination of > technology and policy. As part of a strong security policy, strong > passwords > should be used on all resources. The Microsoft Security Advisor website > (http://www.microsoft.com/security) has some guidelines for choosing > strong > passwords. > > One statement by the original poster argues that Microsoft managed to > design > a security format that actually makes it easier to break into the > protected > data. As stated above, a number of well respected companies were involved > extensively in the design and review of PKCS-12 before it became a > standard. > An iteration count, which would make the type of attack described above > more > difficult (in terms of time), was added late in the PKCS-12 evolution. It > was, however, too late to make it into the Internet Explorer 4 product > release. Future versions of Internet Explorer will include support for the > an iteration count, further strengthening the security of exported key > material. > > Of course, in general the PKCS-12 data objects will not be available on a > user's machine, since they are only used by Internet Explorer 4.x when > exporting key material to, or importing key material from another system. > As > with any sensitive data, users should take care when working PKCS-12 data > blobs and not leave them on their hard drives. > > Exploiting Internet Explorer > One of the fundamental requirements to perform any possible cryptographic > attack discussed in the recent postings is the assumption that a malicious > entity could somehow access to data on a user's computer system, without > the > permission or knowledge of the user. This is a large leap of faith. > Users > that are using Public Key Certificates today are generally sophisticated > and > savvy users, or part of a larger corporate infrastructure with > knowledgeable > administrators. This class of users will certainly keep abreast of current > security issues and install security-related patches and updates as they > become available. Microsoft has been extremely responsive in dealing with > all known Internet Explorer security attacks and has posted patches for > all > currently known attacks. And, of course, security issues are certainly not > limited to Microsoft software. > > Information on security-related issues with Microsoft products is > available > on the Microsoft Security Advisor website at > http://www.microsoft.com/security. > > Attacks against Authenticode signing keys > Another concern identified was that if a malicious hacker could steal a > user's or company's Authenticode signing key, that hacker could sign > objects > with that key and distribute them. Then when other users tried to download > the signed object, they would think the key's owner really signed the > object, which might contain malicious code. The Authenticode program has > been designed to ensure that only trusted programs are allowed to run on a > users machine. As stated earlier Microsoft has been very responsive is > addressing security issues with IE. > > However, it is extremely unlikely anyone could be successful with a > simplistic strategy for stealing Authenticode signing keys and then using > them. As noted above, there are security patches already released for > known > Internet Explorer bugs that could possibly allow a key blob to be stolen > off > a user's hard disk (assuming a user left an Authenticode 'key' file on > their > hard disk). Second, anyone signing code using Authenticode technology is > extremely unlikely to leave their key material sitting on an end user > machine routinely used for browsing the Internet. > > Microsoft recommends storing key material, such as that used in > Authenticode, in hardware tokens. Such tokens prevent any of these attacks > from getting started as the keys are not stored in the PC and are not > exportable. The Authenticode signing keys that Microsoft uses for all our > software, for instance, are stored in such a physical hardware key storage > mechanism. > > Attacks on Encrypted Key material > There is some confusion over the algorithms and methods that Microsoft > uses > to provide protection of encrypted key material in Internet Explorer when > using the standard Microsoft base CSPs. There were changes between > Internet > Explorer 3.0x and Internet Explorer 4.x specifically to address any > possible > concern. Note, this concern is unlikely to be valid for any third-party > software CSP and is not relevant to hardware CSPs. > > Microsoft is constantly working to improve the security of our products. > We > determined that there were better suited methods for storing keys than > using > the RSA RC4 stream cipher algorithm used in Internet Explorer 3.0x. In > particular, a stream cipher, such as RC4, is not ideally suited for this > particular use because it can be susceptible to a "known-keystream > attack". > In a known-keystream attack, if you know the plain text, which you > arguably > might be able to determine given the number of standard PKCS-8 fields, you > can recover the keystream. If you recover the keystream, then a XOR > function will indeed decrypt anything else encrypted with the same key. > However, Microsoft only used this RC4-based implementation in the base > CSPs > that shipped with Internet Explorer 3.0x. The CSPs that shipped in > Internet > Explorer 4.x protect private key material in a form that is encrypted > using > DES, which is a block cipher and is not susceptible to the known-keystream > attack that can be used against RC4. > > Again, note that this kind of attack assumes some degree of security > breach > on the user's system such that the keystream could be obtained. > > Key export attacks > The original Internet posting raises concern about the CryptoAPI interface > CryptExportKey(). This function is fully documented and does indeed > export > private key material in an encrypted format. The presence of the > CryptExportKey() function is to support functionality such as migrating > key > material between machines for a user or creating a backup copy of a key. > It > should be noted however, that many CSPs, including most hardware based > CSPs, > do not allow exportable private keys and will return and error in response > to a CryptExportKey() request. > > Also, Microsoft's base software CSPs provide a means to mark keys as > non-exportable when they are generated. An additional security protection > is provided if the flag CRYPT_USER_PROTECTED is set, in which case each > use > of the private key, including export, requires the user to supply a > password > to access the key. Some commercial CAs are not currently setting this > flag > and do not provide the user a way to request it during Certificate > enrollment. We recognize this as a problem. We will continue working > with > CAs to assist them in supporting these security features. However, we > will > also make available a utility to allow setting this flag after key > generation for users concerned with this type of attack. > > The posting also asserts that an ActiveX control could be downloaded from > a > web page, simply ask for the current users key, ship the key off for > collection by an unscrupulous person, and then delete itself without a > trace. > > If users run unsigned code, or code from an unknown origin, a number of > unpleasant things can happen. This could indeed occur if the key as been > marked exportable and the CRYPT_USER_PROTECTED flag is not set. However, > such a scenario assumes that the user follows few or no policies with > regard > to good security, such as running code from unknown sources. Similarly, if > the user were running software from unknown/untrusted sources, that > software > could reformat their hard drive, or manipulate other user data. This > concept > is certainly not new. > > There was also discussion of 16 dialog boxes appearing to the user for > their > password if the CRYPT_USER_PROTECTED flag is set. Certainly asking the > user > too many times would be better than too few times, however in our tests, > under extreme (and uncommon cases), a user might be asked for their > password > at most four times when a key is used with the Microsoft base CSPs. > Perhaps > the claim came from an early beta release. > > ---------------------------------------------------------------- > Users Guide http://www.microsoft.com/sitebuilder/resource/mailfaq.asp > contains important info including how to unsubscribe. Save time, search > the archives at http://microsoft.ease.lsoft.com/archives/index.html

1 0

Sweedish police weed out hackers
by Ray Arachelian 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Jan 1998 14:05:57 -0500 From: Salvatore DeNaro <Salvatore_DeNaro(a)usccmail.lehman.com> To: Ray Arachelian <sunder(a)brainlink.com> Subject: Forward this to the list? *** Swedish police weed out hackers 2 young Swedish hackers who turned a Swedish county's home page into an advertisement for pornography and marijuana and broke into the U.S. space agency's computer system have been tracked down, local media reported. After a yearlong hunt, police in Umea in northern Sweden finally traced the 2 youths, aged 18 and 15, and seized their computers, the newspaper Vasterbottens Folkblad said Wednesday. Police were quoted as saying no charges would be laid because no economic crime had been committed. See http://www.infobeat.com/stories/cgi/story.cgi?id=7065918-55d

1 0

update.350 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From physnews(a)aip.org Wed Dec 10 16:59:59 1997 Date: Wed, 10 Dec 97 14:35:44 EST From: physnews(a)aip.org (AIP listserver) Message-Id: <9712101935.AA25024(a)aip.org> To: physnews-mailing(a)aip.org Subject: update.350 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 350 December 10, 1997 by Phillip F. Schewe and Ben Stein QUANTUM TELEPORTATION has been experimentally demonstrated by physicists at the University of Innsbruck (Anton Zeilinger, 011-43-676-305-8608, anton.zeilinger@ uibk.ac.at; Dik Bouwmeester, Dik.Bouwmeester(a)uibk.ac.at) First proposed in 1993 by Charles Bennett of IBM (914-945-3118), quantum teleportation allow physicists to take a photon (or any other quantum-scale particle, such as an atom), and transfer its properties (such as its polarization) to another photon--even if the two photons are on opposite sides of the galaxy. Note that this scheme transports the particle's properties to the remote location and not the particle itself. And as with Star Trek's Captain Kirk, whose body is destroyed at the teleporter and reconstructed at his destination, the state of the original photon must be destroyed to create an exact reconstruction at the other end. In the Innsbruck experiment, the researchers create a pair of photons A and B that are quantum mechanically "entangled": the polarization of each photon is in a fuzzy, undetermined state, yet the two photons have a precisely defined interrelationship. If one photon is later measured to have, say, a horizontal polarization, then the other photon must "collapse" into the complementary state of vertical polarization. In the experiment, one of the entangled photons A arrives at an optical device at the exact time as a "message" photon M whose polarization state is to be teleported. These two photons enter a device where they become indistinguishable, thus effacing our knowledge of M's polarization (the equivalent of destroying Kirk).What the researchers have verified is that by ensuring that M's polarization is complementary to A's, then B's polarization would now have to assume the same value as M's. In other words, although M and B have never been in contact, B has been imprinted with M's polarization value, across the whole galaxy, instantaneously. This does not mean that faster-than-light information transfer has occurred. The people at the sending station must still convey the fact that teleportation had been successful by making a phone call or using some other light-speed or sub-light-speed means of communication. While physicists don't foresee the possibility of teleporting large-scale objects like humans, this scheme will have uses in quantum computing and cryptography. (D. Bouwmeester et al., Nature, 11 Dec 1997; see also www.aip.org/physnews/graphics) DO EARTHQUAKES HAVE ELECTRICAL PRECURSORS? The elastic waves measured by seismometers are transmitted by the flexing crust while an earthquake is doing its worst. But some scientists believe that flexing also goes on in the hours and even weeks before a quake. Too small to be detected seismically, the flexing might well be sensed electrically. As underground strata rearrange themselves before a quake, the thinking goes, pockets of water are squeezed into new configurations, changing local conduction properties, which can be monitored with buried electrodes. On this basis Panayiotis Varotsos at the University of Athens (011-30-1-894-9849, pvaro(a)leon.nrcps.ariadne-t.gr) has reportedly predicted certain quakes in Greece weeks ahead of time by triangulating voltage differentials at the level of 10 millivolts/km over distances of 100 km. (Some skeptics dispute this assertion.) In new research, Varotsos buttresses his claims with laboratory studies of another system under pressure which puts out transient electrical signals before it fractures, namely a crystal containing a variety of dislocations and defects. Conductivity patterns in the crystal convince Varotsos that analogous patterns (although on a much bigger distance scale) observed in the buried electrode arrays constitute a true earthquake precursor. (Varotsos et al., Journal of Applied Physics, 1 Jan, 1998; journalists can obtain the paper from physnews(a)aip.org.)

1 0

RE: Latest Clinton dodge?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > At 07:11 PM 1/26/98 EST, you wrote: > >"Roger J Jones" <cyber(a)ibpinc.com> writes: > > > >> > >> Thanks for the info - while I am at it - has anyone ever disclosed the > >> "distinguishing characteristic" that Paula Jones claims will prove its > Bubba > >> Bill? > >> > >Can you spell "curvature"? > > So you *do* have intimate knowledge of the president.... > but I won't tell :-) What is the difference between Bill Clinton and the Titanic? Only 1700 people went down on the Titanic. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

The only `culture' Timothy `C' Maypole possesses is that cultivated from his foreskin scrapings. ,/ \, ((__,-,,,-,__)), Timothy `C' Maypole `--)~ ~(--` .-'( )`-, `~~`d\ /b`~~` | | (6___6) `---`

2 3

sat survailience
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 27 Jan 1998 14:55:09 -0500 From: Somebody Subject: sat survailience To: rah <rah(a)shipwright.com> MIME-version: 1.0 Bob - something else to be paranoid about! <somebody's .sig> <snip> When Is a Satellite Photo An Unreasonable Search? By <some reporter> Staff Reporter of <A big newspaper> Over the years, satellite photos have plotted the course of Soviet warships and tracked the movements of Iraqi troops. Last year, they also nailed Floyd Dunn for growing cotton on his Arizona farm allegedly without an irrigation permit. Mr. Dunn contends that he did have the required permits but paid the $4,000 fine to maintain good relations with the Arizona Department of Water Resources. "You can't argue with a satellite," he says. "Being caught like I was caught is kind of unfair." As state and local agencies make more use of satellite imagery -- for everything from surveying illicit crops to detecting unauthorized building -- they're raising questions about the propriety of spying on American civilians from the sky. "It certainly has a 'Big Brother Is Watching You' flavor to it," says Larry Griggers, a director at the Georgia Department of Revenue. "But it prevents us from having to spend money for other types of enforcement." The state tax authority plans to use National Aeronautic and Space Administration satellites to check all 58,910 squares miles of the state for unreported timber cutting. It also plans to share the photos with any state agency that asks, which could lead to a wide variety of enforcement actions. Does taking satellite photos of private citizens and their property -- generally without their knowledge -- violate the Constitution's Fourth Amendment protections against unreasonable searches? The American Bar Association has organized a task force to explore that question, as well as such issues as how long photos can be kept on file and how freely they can be shared with police. Because U.S. Justice Department officials are on the task force, the recommendations are expected to influence how law-enforcement authorities and civil agencies use the new images and at what point they require warrants. Use of satellite images has increased markedly since the early 1990s, when the Russian space agency, Sovinformsputnik, began selling spy-quality photos to raise cash. The U.S. lifted its own restrictions on sale of high-resolution satellite photos in 1994, which encouraged entrepreneurs to launch satellites of their own that could compete with the Russian imagery. Those efforts may soon pay off. This year a joint venture of Lockheed Martin Corp. and Raytheon Co. hopes to launch a satellite that will yield imagery detailed enough to distinguish sedans from minivans. Another firm, Earthwatch Inc. of Longmont, Colo., says it is proceeding with plans to launch a similar satellite in 1999 -- despite the recent loss of radio contact with a less-advanced model the firm launched in December. Both enterprises decline to discuss their public-sector clients. Some state and local agencies have been purchasing photos from French, Indian and U.S. government satellites since the 1980s, and increasingly powerful computer software is allowing them to make better use of the imagery. The Arizona Department of Water Resources spotted Mr. Dunn's cotton crop, for example, because it routinely obtains photographs from the French government's SPOT satellites of 750,000 acres of central Arizona farmland. State officials then compare the images with a database of water-use permits to determine which farmers might be exceeding water-use rules. "A week doesn't go by where somebody doesn't propose a new use," says John Hoffman, whose Raleigh, N.C., business, Aerial Images Inc., has become the main reseller of images taken by Russian intelligence satellites. Much of what Mr. Hoffman has available is old imagery of Western cities. But he says he can also take orders for new photos on upcoming missions. Price: $6,500 to photograph 10 square kilometers with resolution of about six feet, which he says is sharp enough to distinguish cars from pickup trucks. In North Carolina several counties are using Mr. Hoffman's photos to find unreported building activities, agricultural development and other property improvements that would raise property-tax assessments. Demand from state and local agencies in his region is so strong, he says, that Sovinformsputnik, the Russian space agency, has scheduled a Feb. 17 launch of a satellite that will concentrate mainly on photographing the Southeastern U.S. Pictures taken from airplanes at lower altitudes are often more revealing, but satellite imagery can be much more cost-effective. Photographing an area the size of a small town, for example, can cost tens of thousands of dollars by airplane, approximately twice the cost by satellite. Some satellite imagery is faster as well. Although the satellites Mr. Hoffman works with use conventional film that is developed after the satellite returns to earth, newer camera platforms can transmit images digitally just minutes after they are taken. To date, there have been few legal challenges to the use of satellite imagery. But the technology of overhead photography is evolving faster than the law. Courts have allowed government officials to take detailed pictures from airplanes flying as low as 1,200 feet. And in 1986, the U.S. Supreme Court ruled that the U.S. Environmental Protection Agency was permitted to photograph a Dow Chemical facility in Midland, Mich., because the EPA used relatively conventional airplane-camera equipment. But the high court raised a red flag in that case: "It may well be ... that surveillance of private property by using highly sophisticated surveillance equipment not generally available to the public, such as satellite technology, might be constitutionally proscribed absent a warrant." The ABA task force is exploring just these questions. Sheldon Krantz, chair of the task force and a partner at Piper & Marbury LLP in Washington, says that it will propose in April that law-enforcement agencies be required to obtain warrants to use "satellite cameras [that] can focus on images of a few feet across." That standard would probably include most advanced satellite images, although the task force has yet to agree on more specific definitions. "We need to make some big value judgments about these practices before they become so widespread," says Mr. Krantz. Some businesses say they welcome oversight from space. Georgia-Pacific Corp. and other big timber concerns support the Georgia Department of Revenue's forest survey, saying it will help to disprove accusations that they have secretly cut trees without paying taxes. Several small timber owners already have been fined a total of $2,000 in a test of the statewide program that took place in Wayne County, near Savannah. And as sharper-resolution photos become available, some Georgia officials suggest the program could be used to look for objects as small as backyard porches, to check if homeowners have their construction permits in order. <snip> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE: Latest Clinton dodge?
by J-Dog 17 Dec '03

17 Dec '03

At 01:15 PM 1/27/98 EST, Dr.Dimitri Vulis KOTM wrote: >David Honig <honig(a)otc.net> writes: > >> At 07:11 PM 1/26/98 EST, you wrote: >> >"Roger J Jones" <cyber(a)ibpinc.com> writes: >> > >> >> >> >> Thanks for the info - while I am at it - has anyone ever disclosed the >> >> "distinguishing characteristic" that Paula Jones claims will prove its >> Bubba >> >> Bill? >> >> >> >Can you spell "curvature"? >> >> So you *do* have intimate knowledge of the president.... >> but I won't tell :-) > >What is the difference between Bill Clinton and the Titanic? >Only 1700 people went down on the Titanic. > >--- > >Dr.Dimitri Vulis KOTM >Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > most people get Aids from sex clinton gets sex from Aids lates J-Dog

1 0

Privacy and presidential philandering, from the Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

******** http://cgi.pathfinder.com/netly/opinion/0,1042,1714,00.html The Netly News (http://netlynews.com/) January 27, 1998 Private Parts by Declan McCullagh (declan(a)well.com) Already you can hear the plaintive sound of President Clinton's partisans whining about privacy. The allegations about Will's wandering willy are too intimate, too sensitive and (if the truth be told) too embarrassing to be discussed publicly, they claim. Yesterday the wire services were busy recycling Hillary Clinton's plea for a "zone of privacy"; a Clinton defender wrote in USA Today that nobody should be "inflicting the details of his sex life on the public"; a piece in the New York Times complained about a "fishing expedition into the President's sexual history." On NBC's Today show, Hillary groused about living in "a time where people are malicious and evil-minded." On many electronic mailing lists, the talk nowadays seems to be of little else. "The current pursuit of Clinton -- whatever the facts turn out to be -- strikes me, itself, as an obscenity," griped Edward Kent on a First Amendment list. "We need more protections of privacy in this country." Michael Troy replied, "I don't think there is a constitutional right to privacy for an employer (who is also a public figure) having sex with an employee in the workplace." He's right. The call for greater "privacy protections" is a call for censorship in disguise. [...]

1 0

unsolved billing problem
by CLAUD W WELCH 17 Dec '03

17 Dec '03

I cancelled my membership prior to the end of two days. i would like a refund.

2 1

Trans World Specials Fare Sales
by Trans World Specials 17 Dec '03

17 Dec '03

Welcome to Trans World Specials for January 13, 1998. All tickets must be purchased by January 16, 1998. Fares are valid for travel originating 1/17/98 and returning 1/19/98 or 1/20/98. We have some great fares to great cities for you again this week. Call right away and take advantage. Have you read about our new Trans World First service? Read about it at http://www.twa.com On to this week's Trans World Specials. Roundtrip Fare: To/From: $69 St. Louis (STL) / Nashville (BNA) $69 Washington, DC (National) / New York (JFK) * * TWA Flights only. Trans World Express excluded $79 Detroit (DTW) / New York (JFK) nonstop only $99 Chicago (ORD) / New York (JFK) nonstop only $99 St. Louis (STL) / Atlanta (ATL) $99 St. Louis (STL) / Washington, DC (National only) $129 Cedar Rapids (CID) / Atlanta (ATL) $129 Hartford (BDL) / Houston (HOU) $129 Lincoln (LNK) / Atlanta (ATL) $129 Nashville (BNA) / Salt Lake City (SLC) $129 St. Louis (STL) / Colorado Springs (COS) $129 St. Louis (STL) / Hartford (BDL) $129 St. Louis (STL) / Houston (HOU) $129 St. Louis (STL) / New York (LGA) $129 St. Louis (STL) / Norfolk (ORF) $129 St. Louis (STL) / Toronto (YYZ) ** $129 Colorado Springs (COS) / Toronto (YYZ) ** $129 San Antonio (SAT) / Toronto (YYZ) ** $159 Boston (BOS) / Colorado Springs (COS) $159 Hartford (BDL) / Colorado Springs (COS) $159 Nashville (BNA) / Ontario, CA (ONT) $159 Nashville (BNA) / Portland, OR (PDX) $159 Nashville (BNA) / San Jose, CA (SJC) $159 New York (LGA) / Colorado Springs (COS) $159 Norfolk (ORF) / Colorado Springs (COS) $159 St. Louis (STL) / Ontario, CA (ONT) $159 St. Louis (STL) / Portland, OR (PDX) $159 Washington, DC (National) / Colorado Springs (COS) $179 Boston (BOS) / Ontario, CA (ONT) $179 Hartford (BDL) / Ontario, CA (ONT) $179 Los Angeles (LAX) / New York (JFK) nonstop only $179 New York (JFK) / Las Vegas (LAS) nonstop only $179 Norfolk (ORF) / Ontario, CA (ONT) $179 Ontario, CA (ONT) / New York (LGA) $179 Ontario, CA (ONT) / Washington, DC (DCA) $179 Ontario, CA (ONT) / Toronto (YYZ) ** ** Fares are valid for U.S. origins only. Fares for Canadian origins may differ. All travel is valid on TWA only. Call TWA at 1-800-221-2000 and book your Trans World Special now. ******************************GETAWAY VACATIONS************************* Puerto Vallarta -- Sheraton Buganvilias includes: - roundtrip airfare - 2 nights hotel accommodations at the deluxe Sheraton Buganvilias Resort - airport transfers - 2000 bonus FFB miles in addition to actual mileage earned - only $399 from St. Louis - $459 from Chicago, Des Moines, Detroit, Indianapolis, Kansas City, Little Rock, Moline, Nashville, and Omaha. - $519 from Cincinnati, Cleveland, Columbus, Dayton, Milwaukee and Minneapolis London Theatre Week includes: - roundtrip airfare - Continental buffet breakfast - half-day sightseeing tour - tickets for 2 plays or musicals - choice of first-class or superior first-class hotel - bonus 5000 FFB miles in addition to actual mileage earned - valid for 2/6/98 or 2/27/98 departures - only $1099 from Chicago, Cincinnati, Dallas, Houston, Minneapolis and St. Louis - $1179 from Austin, Columbus, Dayton, Indianapolis, Kansas City, Oklahoma City San Antonio, and Tulsa For reservations call 1-800-GETAWAY (438-2929) today ! *********************************ALAMO********************************** Alamo offers these low rates for an economy car valid 1/17/98 - 1/19/98 $16.99 Houston, San Antonio $17.99 Chicago, Detroit, Nashville, St. Louis, Toronto $18.99 Colorado Springs, Las Vegas, Portland (OR) $20.99 Atlanta, Hartford, Norfolk, Washington-DC, $21.99 Los Angeles For reservations call Alamo at 1-800-GO-ALAMO and request rate code RT and ID # 443833. For online reservations access http://www.goalamo.com ********************************Hilton Hotels & Resorts***************** Hilton Hotels/Resorts offers these low rates valid the nights of 1/17/98-1/19/98 $55 Washington National Airport Hilton, Arlington, VA (free airport shuttle, only 5 minutes from the sites of DC) $65 Galveston Island Hilton Resort, TX ( located directly on the beach; hotel offers tennis and outdoor pool) $69 Los Angeles Airport Hilton & Towers (free airport shuttle, fitness center, outdoor pool and 12 restaurants) $79 Colonial Hilton & Resort, MA ( located 12 miles north of downtown Boston) $87 Detroit Metro Airport Hilton Suites ( suite accommodations, full american breakfast and beverage reception) $88 O'Hare Hilton, Chicago ( connected to O'Hare via walkway, 18 miles from downtown) $99 The Capitol Hilton, Washington-DC ( in the heart of DC, 2 blocks from the White House) $131 Alanta Hilton & Towers ( pool, fitness center, tennis courts and easy access to area attractions) For reservations call Hilton at 1-800-774-1500 and ask for Hilton Value Rates. Visit Hilton at http://www.hilton.com ***********************************TERMS & CONDITIONS******************* Airfare Terms and Conditions: GENERAL CONDITIONS: Fares shown are round trip, nonrefundable and are subject to change. Changes to itinerary are not permitted. Fares do not include Passenger Facility Charges of up to $12 depending on itinerary. Must use E-Ticketing and credit card is the only form of payment accepted. Offer is not available in conjunction with any other discount, coupon or promotional offer. Seats are limited and may not be available on all flights or days of the week. Tickets must be purchased at time of booking and no later than 1/16/98. Standby passengers not allowed. Valid for outbound travel on Saturday (1/17) and return Monday (1/19) or Tuesday (1/20). Travel is effective 1/17/98 with all travel to be completed by 1/20/98. Minimum stay is 2 days. Maximum stay is 3 days. Travel to/from Canada a $6 US departure tax is additional. Getaway Conditions: ALL PACKAGES: All packages include round-trip economy airfare. Price is per person based on double occupancy and is subject to change. Availability, restrictions, surcharges, blackouts and cancellation penalties apply. No other discounts or promotions are valid in conjunction with these packages. DOMESTIC CONDITIONS: Depart for Puerto Vallarta Tuesday or Sunday and return Thursday or Tuesday. Travel valid for departures 2/3, 2/8 or 2/10 and return 2/5, 2/10, or 2/12 LIMITED AVAILABLITY. Price does not include Passenger Facility Charges, US departure, agricultural, customs & immigration tax of up to $54 per person. Full payment due by 1/19/98. INTERNATIONAL CONDITIONS: Seats are limited and may not be available on all flights. Price does not include Passenger Facility Charges, US departure/arrival, agriculture and security fees from point of origin of travel up to approximately $85 per person. Price includes standard room - superior rooms have an additional charge. Full payment is required by 1/16/98. Car Rental Conditions: Taxes (including in California, VLF taxes ranging up to $1.89 per day), registrations fee/tax reimbursement, and airport access fees/taxes, if any, are extra. Optional CDW, liability insurance, fuel, additional driver fee, drop charges and other optional items are extra. Rates higher for renters under age 25. Rates valid for rentals commencing on Saturday and ending by 11:59 PM on Tuesday. Rates only valid during week in which they are published via TWA Internet site. A 24-hour advance reservation is required. Availability is limited. Hotel Conditions: Hilton Hotels and Resorts special rates are available only during the specific week in which they are published via the TWA Hot Deals Internet site and the HiltonNet Internet site. Limited availability; rooms at these Hilton Value Rates are sold on a first-come, first-served basis. Availability, rate, and terms of occupancy are not guaranteed and will be confirmed at time of reservation. Participating hotels, rates and terms are subject to change without notice. Single or double occupancy. Early check-in, late check-out subject to availability. No extra charge for children when they stay in parents' or grandparents' room; total room occupancy subject to local fire safety regulations and other applicable laws or regulations. Rates vary by season, do not include any other fees or charges, including without limitation state or local taxes or gratuities and are subject to change without notice. Advance booking required. Advance deposit may be required. Offer cannot be combined with any other special discounts, coupons, certificates, special rates, promotional offers, award stays, or meeting/group stays. Hilton reserves the right to cancel any Hilton Value Rate at any time without notice. Hilton is not responsible for the terms of other offers in the program, or for any electronic, computer, telephone, security, virus or any other problem or damage related to use of the program or its offers. For reservations call 1-800-221-2000 (domestic) or 1-800-892-4141 (international) or call your travel agent and ask for TWA's special Internet fares.

1 0

(eternity) autonomous agents
by Ross Anderson 17 Dec '03

17 Dec '03

Adam Back: > If the participant in the CPU resource market is not expected to be > able to vet all source code he runs, this gives the would be eternity > operator a chance to distribute his risk. It's even better than this - your PC becomes a common carrier and you are no longer liable :-) If this doesn't happen, then the advocates of Java need a whole new security infrastructure to assure users that the applets they download aren't defamatory, pornographic, seditious or in breach of copyright! Tim May: > Another science fiction writer, Bruce Sterling, popularized "data havens" At one time, Malta was thinking seriously about becoming just such a data haven, and I expect one will appear sooner or later. After all, what's left of the British Empire is funded by money laundering and tax evasion - pardon me, Sir Humphrey, `offshore financial services'. Once the online world becomes a significant part of the global economy, small countries that wish to achieve the high living standards of Bermuda, Gibraltar and Jersey will be able to get there by cashing in on `offshore data services'. Countries like Tonga already sell domain names, but a full offshore data service would need some way of resisting pressure from the EU and the US government. Most of the tax havens do this by being under a colonial umbrella. Is there an alternative? Can we create virtual colonies in cyberspace? Can we set up a gateway to Eternity in some country like Liberia or Somalia, which is too dangerous even for the US Marines? Or do we have to cut a deal with Sir Humphrey? Hiding stuff inside usenet is actually a bit like hiding behind the skirts of Empire, isn't it? The same goes for hiding stuff on open access web sites, or in spam. Given the rate at which spam is growing these days, maybe that's where to put it. If the only way for Authority to cut mortals off from Eternity was to pass effective laws against spam, and the only way to stop spam was to have a global non-escrowed public key infrastructure so that all mortals could be strongly authenticated, then ... Ross

4 3

[ADMINISTRATIVIUM] Firewalls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy C. Mayonnaise's reheated, refurbished, and regurgitated cud is completely inappropriate for the mailing lists into which it is cross-ruminated. ,,, -ooO(o o)Ooo- Timmy C. Mayonnaise (_)

1 0

metrics of eternity service properties
by Adam Back 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> writes: > >> This of course doesn't scale at all well. It is semi-OK for a tiny, > >> sparse set of reposted items, but fails utterly for larger database > >> sets. (If and when Adam's reposted volumes begin to get significant, > >> he will be viewed as > >> a spammer. :-) ) > > > >The best criticism of my eternity design to date! I agree. > > I assume you are serious, and do agree, as it is a very solid > criticism of the "Eternity as continuous posting to Usenet" model. Yes. I think my eternity service in USENET is actually fairly resistant to attackers determining readers and publishers. The limiting factor is the bandwidth consumed. We have to keep below some threshold otherwise news admins may attempt to filter out eternity articles; and there is some limit at which the system would break down altogether. One suspects posting more than around 10Mb-20Mb / day would be enough to motivate administrators to start filtering. Some people with questionable motivation also have made something of a sport of sending forged cancel messages, and these people will be more easily motivated, as as far as I can tell their motivation is a perverse enjoyment of censorship, and sense of self importance, and of malice in perpetrating DoS attacks. > I see several axes to the analysis of the various Eternity schemes. > > -- retrieval time for a customer or client to obtain some set of data, > ranging from (I assume) ~minutes or less in an Eternity DDS file system to > ~days or less in a Blacknet system to (I am guessing) ~weeks or months in > an Adam Back sort of system. Actually I was aiming for seconds access time with "Eternity USENET". (I am going to dub it "Eternity USENET" -- just any name -- because the lack of names to denote the services under discussion is becoming awkward.) However the reason I am able to claim seconds is because I aim to keep the data either in the newspool, or in a local copy of recent messages. The design is similar to TELETEXT, the text mode information services hosted as side bands on TV signals. The basic topology is the same: we have a broadcast medium, data is slowly re-broadcast. So my design is fairly analogous to a FAST-TEXT system, which keeps a copy of all the pages, and updates them as the TEXT signal sweeps past. So metrics we could use to describe the functionality of an eternity design should include "update time", and "access time". I'll try a quick table of this to illustrate my understanding of Eternity BlackNet (BlackNet used to host an Eternity like service), and Eternity DDS as compared to Eternity USENET. E-BlackNet E-USENET E-DDS update delay 2-3 days 2-3 days minutes access time 2-3 days seconds minutes b/width efficiency good/ poor intermediate intermediate nodes 10 10,000 10,000 capacity 100 Gb 100 Mb 10 Tb security good good intermediate security dependencies remailers, remailers, custom USENET USENET componenets ease of deployment easy easy hard Clearly these figures are order of magnitude only, if even that accurate. My reasoning is as follows: Eternity BlackNet: I am presuming we have third party BlackNet operators who offer to buy and sell information, acting as distribution agents. It takes around a day to send requests or submissions to the operator via a dead drop (encrypted material posted to USENET via remailer). If requested information is sent to clients via replyable nyms bandwidth efficiency is improved. If information is sent to clients via dead drops efficiency drops because the information is broadcast for each request. Clearly a user could, if he wished to improve his access time for browsing BlackNet eternity documents, replicate the entire BlackNet database locally. (Or perhaps subsets defined as all documents by a chosen set of authors, or all documents with given keywords, or with a given third party rating etc). E-USENET: This involves re-posting documents periodically to USENET, and relying on the small data set size to ensure that local eternity proxies can retain a current copy of the dataset. Variants on this approach can migrate towards E-DDS approach by using publically accessible E-USENET servers, and by E-USENET server caches sharing their then larger document store. Also by adding other submission mechanisms to the pool formed by the set of publically accessible E-USENET services. E-DDS: Economic incentives are used to encourage people to take risks in hosting controversial documents. Indirection is used to have a hidden set of data servers, which are only accessed via publically known gateways. (I would recommend looking at Ian Goldberg and David Wagner's TAZ server, the url for which I posted in an earlier post, for this indirection function). I am unsure how an attacker would be prevented from discovering the hidden set of data servers. How do we exclude the attacker from becoming a gateway server? I get the impression that the idea also is make the service a commercial success as a distributed web hosting system, and to get away with comparitively small amounts of controversial materials which migrate. This idea is a useful model I think. Comments? Clarifications, Ryan? Adam

1 0

Micromoney CryptoMango?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 13 Jan 1998 08:52:16 -0500 From: rah-web <rah(a)shipwright.com> Reply-To: rah(a)shipwright.com MIME-Version: 1.0 To: rah-web <rah(a)shipwright.com> Subject: Micromoney CryptoMango? http://www.infoworld.com/cgi-bin/displayNew.pl?/metcalfe/metcalfe.htm [Image] [StorageTek Click Here.] [| Navigational map -- for text only please go to the bottom of the page |] [|Opinions|] [From the Ether] January 12, 1998 Mango `pooling' is the biggest idea we've seen since network computers Mango, in Westborough, Mass., is not your average software start-up. In 30 months the company has raised $30 million. Its first product, Medley97, has shipped, transparently "pooling" workgroup storage. And someone at http://www.mango.com really knows the difference between features and benefits. But it's not the benefits of Medley97 pooling that interest me. What's interesting are the features and long-term potential of Mango's underlying distributed virtual memory (DVM). Mango's pooling DVM is the biggest software idea since network computers -- perhaps since client/server -- and Microsoft had better watch out. According to Mango, Medley97 offers transparent networking that's easy to use, fast, and reliable (not to mention secure and high fiber). Windows users working together on a LAN can share files in a pool of their combined disk storage. Every pooled PC is both a client and server. Go ahead and drop Medley97 into any PC you want to pool. Medley97 installs, checks configuration, and updates required Windows networking software. The product adds the PC's storage to the pool, giving you a shared, fast, and reliable network drive, M:/, which is available on all pooled PCs. For this you pay Mango less than $125 each for up to 25 PCs. Mango CEO Steve Frank was technology chief at Kendall Square Research (KSR), the ill-fated parallel processing company near MIT that was not Thinking Machines. Frank says KSR taught him how dishonesty doesn't work but parallelism does. Unlike KSR's, Mango's parallelism just has to be on volume platforms, such as Ethernet, TCP/IP, and Windows. Hence Mango. Underlying Medley97 are DVM processes cooperating through a TCP/IP Ethernet on pooled Windows PCs. The processes manage a 128-bit object space that copies virtual 4KB pages up, down, and around a distributed memory hierarchy. Medley97 offers ease of use by hiding continuously, automatically, and adaptively behind your familiar Windows user interface -- just below the file system APIs and above physical disk pages. Medley97 offers performance by moving files through the Ethernet from disk to disk and from disk to memory, closer to where the pages are used most. And Medley97 offers reliability by keeping synchronized backup copies of file pages on different pooled PCs. Mango's DVM generalizes backup and caching. Pages are copied for nonstop operation. Copies are moved closer to where they are used. Frank says it is often faster to access a page through Ethernet from a pooled PC's semiconductor memory than to access it from a local disk. Transaction logs are kept on all pooled PCs. The DVM detects when a PC drops out of a pool and copies any page that thereby lacks sufficient backups. When a PC rejoins a pool, transaction logs ensure it accesses updated pages. The garbage collection of deleted pages runs in the background. Noticing that Medley97 is available for up to 25 PCs, I asked the perennial parallelism question, "Does it scale?" Frank's answer: Yes. Medley97 is limited to 25 PCs only because that's all Mango has so far found time to test. With each PC adding resources, pool performance is "superlinear" as far as the eye can see. Well, this makes pooling the next in a long list of major computing paradigms: batch mainframes, interactive minicomputers, stand-alone PCs, PC LANs, client/server, peer-to-peer, thin-client, server clustering, and now peer clustering or pooling. According to Frank, Medley next needs to go from Ethernet to Internet. To support many pools. To add change control and archiving. Medley also needs to go beyond Windows. To pool processing as well as storage. So Medley, now written in C++, needs what else? Java. You can log into a Medley pool from anywhere and have your workgroup files available on the M:/ drive. With Java you could pool non-Wintel network computers. Well, if pooling scales, the whole World Wide Web should be one big pool. Mango's DVM generalizes the caching now done ad hoc all over the Web -- on server disks, in clusters, in caching farms, in proxy servers, in browsers, and in the file systems of PCs. Add Java network computers and before Frank knows it, Mango will be ripe for purchase if not integration by Microsoft. ------------------------------ [Image] Technology pundit Bob Metcalfe invented Ethernet in 1973 and founded 3Com in 1979, and today he specializes in the Internet. Send e-mail to Metcalfe(a)infoworld.com. Missed a column? Go back for more. [Image] ------------------------------ Copyright © 1998 InfoWorld Media Group Inc. | SiteMap |Search | PageOne | Conferences | Reader/Ad Services | | Enterprise Careers | Opinions | Test Center | Features | | Forums | Interviews | InfoWorld Print | InfoQuote | [Lion's Den] [InfoWorld Electric Features] [Intel Manageability] --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

StockAlert News: UNFC expects increase of $50M in assets
by kouqi32＠mci.net 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"> <HTML><PRE><BODY BGCOLOR="#ffffff"> REMINGTON-HALL CAPITALIZES ON RESURGENT REAL ESTATE MARKET Company expects to acquire $50 million in assets by mid-1998 DALLAS -- UNFC ), a diversified real estate investment firm formerly known as Universal Fuels Company, is quietly acquiring over $50 million in previously undervalued, undercapitalized or mismanaged commercial properties and making this new major player one of the best moderate-risk real estate investments in 1998. Founded in 1975 as Universal Fuels, the company provided uranium to the world as an alternative fuel, but as uranium became less used as a nuclear fuel source than other more economical and useful materials, Universal Fuels' stock declined almost to extinction over several years. Less than a year ago the stock price was less than 1¢. Four months ago officials from Camden-Townwest, a privately held real estate investment firm, approached Universal Fuels former management about converting Universal Fuels into a publicly traded real estate conglomerate. Camden-Townwest, founded in 1994, grew from $19,000 in cash to $3 million in assets in three years without seeking any outside capital. Since the change in management and corporate mission last October, <A HREF="http://quote.yahoo.com/q?s=UNFC&d=t">U NFC</A> has seen its stock value increase by over 800%. Remington-Hall is now making its move to increase assets at a tremendous rate. By mid-year management expects to acquire in excess of $50 Million in office buildings and multi-family properties at a significant discount to their market value. "We have been referred to as 'Cat Burglars of Real Estate'," said Douglas Fonteno, president & chief executive officer. "And that's a title we hope to keep." Larry Hood ,formerly Chief Operating Officer of Pizza Inn and Chief Financial Officer of Reliance Mortgage Company, is Remington-Hall's Chief Financial Offi cer, giving the new company immediate and substantial financial integrity. Wade Hyde, previously public relations and investor relations executive for Blockbuster Video and FoxMeyer Corporation, is Vice President of Marketing & Public Relations. Currently Remington-Hall is seeking to be listed on the Pacific Stock Exchange and the Nasdaq National Market. The company anticipates announcing over $10 million in newly acquired assets by the end of January. Name: Remington-Hall Capital Corporation ( formerly Universal Fuels) Symbol: Nasdaq: UNFC Mission: To aggressively acquire steeply undervalued real estate properties due to previous mismanagement or undercapitalization. Management: Senior executives with diverse experiences, including: Fortune 500 corporations, leading stock brokerage firms, real estate companies and national marketing. Goals: To increase assets to $10M by January 98 and $50M by mid-year Address: 1401 Elm St., Ste. 1818, Dallas, TX 75202-2925 Phone: (214) 749-4600 FAX: (214) 749-4608 Internet: www.remington-hall.com E-Mail: InvestorRelations@remington-hall ll.com Quote Yahoo! Remington-Hall <A HREF="www.remington-hall.com"> </A> </PRE></HTML> <FONT COLOR="#000000" SIZ

1 0

Census Director quits [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > By RANDOLPH E. SCHMID > Associated Press Writer > > WASHINGTON (AP) -- Census Director Martha Farnsworth Riche, who > battled Republican lawmakers over counting methods for 2000, is > quitting. > > Riche said Monday she would leave office Jan. 30. > > She has been involved in a lengthy dispute with members of Congress > over Census 2000, largely over how to count the many people who might > be missed by regular methods. > > The fight focused on a practice called sampling, in which the bureau > would determine the number and characteristics of people it cannot > reach based on the people it can. > > Though the practice was endorsed by the National Science Foundation > and statistical groups, Republicans in Congress have opposed it, > concerned that the result would be more people counted in largely > Democratic large cities. > > The results will be used to redistribute House seats to the states. [text deleted] ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

19 European countries ban human cloning [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > 19 EUROPEAN NATIONS SIGN BAN ON HUMAN CLONING > > Britain, Germany not among signatories > > January 12, 1998 > Web posted at: 8:00 p.m. EST (0100 GMT) > > PARIS (CNN) -- Nineteen European nations on Monday signed an > agreement to prohibit the cloning of humans. > > Representatives from 19 members of the Council of Europe signed a > protocol that would commit their countries to ban by law "any > intervention seeking to create human beings genetically identical to > another human being, whether living or dead." It rules out any > exception to the ban, even in the case of a completely sterile > couple. > > "At a time when occasional voices are being raised to assert the > acceptability of human cloning and even to put it more rapidly into > practice, it is important for Europe solemnly to declare its > determination to defend human dignity against the abuse of > scientific techniques," Council Secretary-General Daniel Tarchys > said. > > The text, which is to become a part of the European Convention on > Human Rights and Biomedicine, would permit cloning of cells for > research purposes.CNN's Margaret Lowrie reports > icon 2 min. 3 sec VXtreme video > > The accord will become binding on the signatories as soon as it has > been ratified in five states. > > Countries signing are: Denmark, Estonia, Finland, France, Greece, > Iceland, Italy, Latvia, Luxembourg, Moldova, Norway, Portugal, > Romania, San Marino, Slovenia, Spain, Sweden, Macedonia and Turkey. [text deleted] ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: (eternity) autonomous agents
by Ross Anderson 17 Dec '03

17 Dec '03

Ryan Lackey: > A "datahaven country" would have > to be immune to such tactics -- either having its own strong military > (China as datahaven) to defend its national interests, political > connections (Israel?), or enough trade with the US that shutting off > data commo would be impossible for economic reasons (Singapore?). A virtual datahaven could be constructed eaily provided you knew how to index controversial matter. Publish the rude things about the Prophet Mohammed on a server in Israel, the anti-Serb rants in Croatia, the kiddyporn in Sweden, the violence in America, the Nazi hate speech in Syria and the anti-scientology stuff in Germany. If someone wants to curse and swear at the whole world at once, then there is this amazing new invention called hypertext ... Ross

2 1

Re: (eternity) autonomous agents
by Thomas Womack 17 Dec '03

17 Dec '03

Ross Anderson wrote: >A virtual datahaven could be constructed eaily provided you knew how to >index controversial matter. > >Publish the rude things about the Prophet Mohammed on a server in Israel, >the anti-Serb rants in Croatia, the kiddyporn in Sweden, the violence in >America, the Nazi hate speech in Syria and the anti-scientology stuff in >Germany. I suspect you will still run into things which are illegal anywhere; national-security stuff can be handled provided you've got a complete list of pairs of unfriendly nations, but I don't think (eg) the more extreme sort of kiddyporn is legal *anywhere*. Tom

10 12