December 2003 - cypherpunks-legacy

Re: TIS--Building in Big Brother for a Better Tommorrow
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:41 PM 2/26/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On 22 Feb 96, John Young wrote and quoted Steve Walker: >> To supplement TIS's Web site information on CKE, here's a >> mailing from Steve Walker earlier this month: >> TRUSTED INFORMATION SYSTEMS, INC. > February 2, 1996 >> There has been amazing progress on TIS's Commercial Key >> Escrow (CKE) initiative since my last status report. > [Much quite-valid disgust with CKE (GAK!) deleted] >> ...it represents the first export approval of a DES-based key >> escrow encryption system, a small step... > >...backward. > >> ...the private sector's need for encryption protection and >> governments' needs to be able to decrypt the communications >> of criminals, terrorists, and other adversaries... > >There is no difference between the justification for this and >what was offered to justify Clipper. > >"Other adversaries," like those who want to keep their affairs >private, or wish to live free in an increasingly unfree world? >I think I'm gonna puke. Instead of "and other adversaries," why didn't they just come out and say, "and Jim Bell"? I feel left out! Ignored! Now I know how "the Professor and Mary Ann" felt. This is a social slight I can't possibly tolerate! Jim Bell, Adversary. jimbell(a)pacifier.com Klaatu Burada Nikto Something is going to happen... Something...Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTJzNPqHVDBboB2dAQFROAQAge2OrsqHHnQ6fBPw2UWoWdiJcagwWspA s8Zed6Rfeo/X3Hhuy6KT8AaRq2TwaHaiykaEaDMEzdRUhgKQi32pOP3/Pr/ISUqH PXh8QEDdmaYPmVTnw++2TZTJtWosPvn0g/zgpAqPVy5ibVJ03dzdToAj2+2vjdxF j9zauQHsvxQ= =xLqm -----END PGP SIGNATURE-----

1 0

RC
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

And might I point out that "RC" has been the registered trademark of the Royal Crown Bottling Company since long before Mr. R... P.fla

1 0

[South SF Bay Area] PLAY ANNOUNCEMENT: "Breaking the Code" (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

FYI. Might be amusing. I'll probably go, if I can find a free moment. -rich The Dream Team ---------- Forwarded message ---------- Date: 25 Feb 1996 20:55:33 -0500 From: Michael Deleon <deleon(a)rahul.net> Newgroups: ba.announce, ba.motss, rec.arts.theatre.plays Subject: PLAY ANNOUNCEMENT: "Breaking the Code" Menlo Players Guild Presents BREAKING THE CODE by Hugh Whitemore Based on the Book: Alan Turing: The Enigma by Andrew Hodges The private life of an extraordinary and brilliant man becomes the means of his destruction in this dramatic story, which won acclaim on Broadway. At its center is Alan Turing, the mathematician and British war hero who broke the famous German Enigma Code, giving the Allies the key to winning World War II, and yet was persecuted by his government for his sexual orientation. This portrait of a complex, visionary man torn by society's conflicting rules is chillingly powerful. February 23 - March 16 Thurs-Sat, 8pm Sunday March 10 at 2:30 Burgess Theatre, 601 Laurel Street, Menlo Park Tickets and info call (415) 322-3261 Visit our web page at http://www.best.com/~carjack

1 0

Re: Remember, RC4 is now PC1 (fwd)
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:08 PM 2/26/96 -0500, you wrote: >The latest version of ssh has something named "arcfour, which is a >cipher based on a usenet posting in Spring-1995. It is widely >believed and has been tested to be equivalent with RC4. (RC4 is a >trademark of RSA Data Security." Then they will get sued by SeaWare saying it conflicts with their trademark for .arc format compression. Maybe someone should go into the business of "Trademark Collision Insurance(tm)". It seems that no matter what you do, everything(tm) is trademarked nowadays. (TCMAY(tm) and "Cypherpunks(tm)" are a trademark of "Tentacles R Us(tm)", a division of "Evil Incarnate International(tm)".) | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Ass. Politics
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:02 PM 2/26/96, jim bell wrote: >>Salman Rushdie, in a speech I heard several years ago, said that it was <...> >A few people who basically seem to oppose my idea ("Assassination Politics") >try to use the Rushdie example as being some sort of "evidence" why it Has anyone considered using jim bell as a source of randomness?

1 0

SSH for Windows update?
by Ed Carp 17 Dec '03

17 Dec '03

The SSH Windows client stopped working on Feb. 9. Anyone either have another version that works now or another SSH client for Windows? Anyone know if Tatu's client is ready yet? Thanks in advance. :) -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes The mark of a good conspiracy theory is its untestability. -- Andrew Spring

1 0

Perl T-shirt makes the big time
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Spotted in an NSA contractor's office: a column from InfoWeek or some such rag about the RSA-Perl T-shirt. Said column hijacked May's idea that shirting was trivial and turned it on ear-- ITAR is routinely being violated and no one cares. NSA-heads said they got article by fax from the Death Star in Ft. Meade. Wonder how many black-clad Perl-toters there are on the reservation.

2 1

PHO_ton
by John Young 17 Dec '03

17 Dec '03

New Scientist, 24 February 1996: "Trick of the light fools forgers." Researchers at U-Conn Storrs are developing security systems that use a new kind of invisible code -- the phase of light. A transparent phase mask over a photo on a credit card would make it very difficult to forge. The authenticity of the card is checked by a reader composed of a laser light source and a device called an optical correlator. Bahram Javidi, leading Storrs researcher, will publish the latest findings in SPIE proceedings, called "Optical Security and Counterfeit Deterrent Techniques" (v 2659). "Good connections, quantum style." For quantum computers of the future, any "noise" in the connection between sender and receiver could prove disastrous. The problem is that the data in such computers will be held in the form of individual photons and, since quantum theory states that they cannot be checked because the mere act of measuring them will transform them, every error that creeps in will go uncorrected. Now IBM researchers have come up with a way to make the connection crystal clear (PRL, v 76, p 722). [Cf. recent thread "IBM's Breakthrough."] PHO_ton

1 0

Re: Numbers don't lie...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:18 AM 2/18/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >The second point is that their scalability seems to be based on costs per >chip alone, cost for which the engineering cost has been recovered and for >which the yeild is significant, hardly givens when you are talking pushing >the state of the art, given this 200 Mhz Pentiums would be U$10.00 also >(well, maybe U$25.00). Doubtless that is why they assume chips that are very far from state of the art: Since interprocess communication is trivial for key cracking, you are better off using large numbers of cheap chips, than smaller numbers of good chips. >Finally, no cost is allocated to the sustem required to program/evaluate >the ponderings of these 100's of ASICs. As anyone who has ever programmed >a massively parallel computer (which is what they are talking about in their >brute force machine, it is the boundary communications that kill you. Again: Interprocess communication is trivial. A brute force key cracking machine is *not* a general purpose massively parallel computer. Suppose you have a million chips. Each chip tries keys. A few bytes of the plaintext, headers and stuff are known. Assume eight bytes known. Then we could handle the interprocess communication with a single desktop computer. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

CDA Strikes.
by Ludwig von Drakenberg III 17 Dec '03

17 Dec '03

Read this in http://www.zippo.com/editor.htm. > So what's the plan....man ? > > So the CDA has come to pass and we need to move on. People will test the > constitutionality of bits and pieces of the Telecom Law, a conservative > supreme court will find the law valid, or refuse to review it. Things will never > be the same. For those who think they will be, or the for the" Don't worry, > President Clinton won't enforce the law" crowd, Friday marked the first arrest > under the new law. They picked an unsympathetic figure, twice before > convicted child pornographer, and got him for illegal data transmission over > the Internet. > Next time it won't be such an unsympathetic figure. It will be some ISP, > minding their own business, not knowing they have a user that didn't read the > rules. They'll spend a year in federal court, defending their postion based on > not knowing they comitted a crime. In the end, they will win, but they'll be > broke, and out of the business. Won't happen to large providers, too political, > and they have the resources to do all of the CDA compliance window decorating. -- Ludwig von Drakenberg III God *is* the dice of the universe. drake(a)servidor.unam.mx My goddess gave birth to your god. Facultad de Ciencias, UNAM Fuck the CDA -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAzExbCgAAAEEAONJqT5AeaOg29oT2WXzpgkMQ/BxZXCiduJsOAWRRIPlkOQc 7RN2ooQKJmvHamhoaXktoIbmpK3fkPoEt4OONDtncmOKQKKKl9BgifUW9lO1msRp W0WIGZ9wTlX/1j6RTcdAEEWqWlBi4xz8A7a3MJdoIANPOV1Zs6HEQwyN9No5AAUR tCpFZHVhcmRvIEVzY2FsYW50ZSA8ZHJha2VAc2Vydmlkb3IudW5hbS5teD4= =nmxM -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: "Physical Reality"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:41 AM 2/28/96 +1100, Mark wrote: >I dislike having to follow up something so unrelated, but the bad boys are the >criminals, the song is about what will you do when the cops come for you. >The cops are not the "bad boys" in the song. Trust me. > >Mark > Actually, the song is deliberately ambiguous. Because the phrase "Bad Boys" is repeated at both ends of the verse, you can't tell whether it refers to the cops or perps or both. I don't know the origin of the song but I recall in life or in fiction a special (Las Vegas?) police unit that called itself the Bad Boys. Certainly the Bad=Good reversal is well established in popular culture. DCF

1 0

VAN_goh
by John Young 17 Dec '03

17 Dec '03

2-26-96. FT: "Net's rivals feel the squeeze. A quiet revolution is transforming global electronic trade." Value added networks (Vans) such as GEIS and Advantis are already at risk from the Internet, according to Price Waterhouse's *Technology Forecast*, a panoramic sweep through today's electronics, from chip designs to video compression software. Electronic commerce, the forecast says, has become a worldwide phenomenon, reshaping marketplaces, trading relationships and international trading boundaries. 2-27-96. NYT: "AT&T Makes Belated Move On Internet." John Markoff. AT&T is to introduce a service Tuesday that it hopes to use to link millions of its long-distance telephone customers to the global computer network. Analysts said the entry by AT&T was certain to alter the competitive landscape for ISPs. It will offer relatively inexpensive dial-up access to the Internet and the Web to personal computer users at home. Company officials said pricing will "be aggressive enough to make the industry sit up and take notice." "You're about to see a new AT&T," said an analyst. The service will use Netscape for browsing and a search tool designed by Verity Inc. VAN_goh

1 0

"Physical Reality"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:23 PM 2/21/96 -0800, L. Detweiler wrote: >Barlow brings up this topic in his recent "cyberspace declaration of >independence" (which can clearly be criticized as out of touch with >physical reality but is nevertheless compelling). Various critics of cryptoanarchy from D. Denning to L. Detweiler to A. Grove, to J. Kellstrom to the 1991 instance of P. Metzger have argued that the continued existence of the physical attack medium renders this new form of social disorganization DOA. Boiled down to its essentials, this argument can be expressed by the lyrics of the song "Bad Boys" as used as the theme song of the reality TV show "Cops." For those who no longer participate in the previous culture, they are: Bad Boys, Bad Boys Whatcha gonna do? Whatcha gonna do when they come for you? Bad Boys, Bad Boys repeat endlessly. I would suggest instead that the critics of cryptoanarchy are out of touch with "physical reality." For the "Bad Boys" to come for you, a whole series of requirements must be in place: 1) There must be Bad Boys 2) They must be able to travel 3) There must be a reason for them to come "for you". They need motivation 4) There must be a you 5) The Bad Boys must know where you are 6) The Bad Boys must be able to travel to where you are 7) The answer to the question "Whatcha gonna do?" must be "nothing" (This would seem to be implied by the song.) 8) They must have something to do to you when they "come for you" otherwise the journey is a waste of time. Let's examine each of these requirements to see how technological change has affected them. 1) There must be Bad Boys There are fewer Bad Boys these days. Not that Human Nature has improved all that much but law enforcement employment (relative to population) is down. The collapse of the SU and the Eastern European police states has dramatically reduced the world population of government agents. When 1/4 of your population was in the enforcement business full- or part-time (as in the DDR), the end of that system reduces the supply of "muscle." Note that during this Century of Blood, governments were murdering someone every 20 seconds or so (160 million in the last 100 years). Reports indicate that the death rate is lower these days. Occasional minutes go by without any murders by government. Additionally, even in places like the US where there would seem to be more enforcement personnel employed than ever before, bureaucratic management has worked to reduce worker productivity. Since law enforcement is still organized along Stalinist lines (state ownership and management, hierarchical organization, pay unrelated to performance), not much actual enforcement is undertaken. A New York Times article on INS agents whose job it is to find and arrest illegals within the US said that they were allowed to grab about one perp a month. The rest of the time was spent on paperwork. At the rate of 12 deportations a year per agent, it will be quite a while before the backlog is cleared. And, indeed, all the evidence we have from studies of the "clearance" rates of crimes to the street price of illegal pharmacuticals, to the "average time served per crime" suggest that effective enforcement is down. This is what we would expect since the law enforcement system has retained a very traditional organizational model while the rest of society has become much more efficient. A massive increase in what we might call "regulatory targets" combined with a decrease in the number and efficiency of the regulators, means less regulation and effectively fewer Bad Boys. 2) They must be able to travel If the Bad Boys are to come for you, they have to be able to travel. The internationalization of the modern business and communications environment has made this more difficult. There are very few enforcement agencies that have unlimited budgets of the sort that allowed Lt. Gerard to chase Dr. Richard Kimball around the country for years on end. Enforcement is largely a matter of chance. The Bad Boys come for some small part of the criminal population and leave the rest alone until chance brings them within reach. A multinational investigation and enforcement program costs the earth. It will only be undertaken in very significant cases. Nation states are still the basic unit of enforcement and so jurisdictional conflicts cause many costs and delays. Since it is part of human nature to be more concerned with one's own "stuff" than with other's "stuff," foreign enforcement agencies won't pursue cases with as much energy as domestic agencies might be willing to. One way that people are more powerful than governments is that people (or their corporations) can be citizens/residents of several nations much more easily than a single nation can rule the citizens/residents of other nations. Even within the United States, jurisdictional differences among the states can be exploited by natural or artificial persons. As regional trading blocks like NAFTA and the European Free Trade Area spread, people will be able to move around much more easily than government agencies. Since there are no sovereignty issues raised when people do business in multiple jurisdictions, these distance and jurisdictional barriers will fall much faster for private parties than for the government Bad Boys who want to come after them. <More Tomorrow> DCF

2 1

Re: Proposed Legislation Regualting Expert Testimony
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A nameless associate, who lives in Albuquerque, seems to have a local perspective on this... >Date: Mon, 26 Feb 1996 17:11:54 -0500 >To: rah(a)shipwright.com >Subject: Re: Proposed Legislation Regualting Expert Testimony > >Bob, > >It is clear from the following why the bill did not pass: > >>When a cryptologist or computer expert testifies during a criminal >>defendant's penalty hearing, the cryptologist or computer expert >>shall wear a cone-shaped hat no less than two feet in height for the >>duration of the hearing. The surface of the hat shall be imprinted >>with stars, moons and lightning bolts. >> >>Additionally, the cryptologist or computer expert shall be required to >>wear a white beard no less than eighteen inches in length for the >>duration of the hearing. The cryptologist or computer expert shall >>punctuate crucial elements of his testimony by stabbing at the air >>with a wand no less than one foot in length. >> >>Whenever a cryptologist or computer expert provides expert testimony >>regarding the defendant's methods, the bailiff of the court shall >>dim the lights of the court room and shall administer two strikes to >>a Chinese gong." > >You see, the conical hat, the beard, and the wand are the costume of Manny >Aragon, >the President pro tem of the Senate, and the striking of the gong is the >conditioned response of Ray Sanchez, the Speaker of the House, to anything >Manny says. Of course, *black* hats and goatees on cryptographers are somewhat de regeur, cf. Sameer, Eric, Derek, etc. By the way, do *you* have a black hat, Tim? Cheers, Bob Hettinga PS: I'll stop now. ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

In favour of privacy legislation
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

> The problem is the WILDLY broad/excessive scope of the legislation AS WRITTEN. I agree that the legislation, as written, one of the shortest I've seen, is overbroad. However, it's not _that_ far off the mark. Most of your objections (such as the one relating to unauthorised biographies, which are more likely to be challenged using existing libel laws than privacy legislation that doesn't specify penalties) can be answered with a simple change: replace "personal information concerning an individual" with "personal information concerning an individual directly gleaned from that individual's statements or actions." Or something. So if you build a database tracking my purchases at your store, or what I fill in your subscription forms, you can't resell it. OTOH if you buy my dossier from someone _else_, you're not liable, though your source probably is. So you could publish biographies or political exposes and only the primary source would be liable. That source is often liable in any case, due to existing laws concerning theft, trade secrets, breach of contract etc; it's just that primary sources in these situations are almost never identified. > AS WRITTEN, it would prohibit -- > * making available for a fee, information about pedophiles, rapists, etc., Ah yes, this would include the 98.32% of Internet users who are paedophiles. You don't believe that paedophiles and rapists deserve the same legal and constitutional treatment as anyone else? "First they came for the Jews..." > * maintaining a public-access database for profit, offering consumer > information about landlords' abuses of security deposits -- or renters' > abuses of property, > * making available for profit, almost all information about individuals in > public civil and criminal court records, These, along with databases on (proven) rapists, depend on policy for the use of "public" - government-held - information on individuals. In most countries, this is governed by widely distributed regulations, not any single privacy law. For example, the European restriction on publicising names of minors charged for serious offences _during_ trial. If the simple change on direct sources is made, these do not impact privacy legislation. > I have no problem with *carefully* constructed privacy protection. But (1) > that turns out to be VERY hard to construct, and (2) this bill ain't it. Legislation governing free speech in the US is huge. The body of law that strengthens free speech (interpreting "Congress shall make" as "any level of government shall make") and restricts it (taking "no law" to mean "no law except to prevent obscenity, libel, etc") goes far beyond the deceptively simple First Amendment, but this complexity and bulk is not a common argument against free speech legislation. The California bill, with some changes, may not be a carefully constructed body of law but could be a decent start. My personal opinion, living as I do between one country - India - that is still (fortunately?) fond of habitual civil disobedience, and another - the Internet - where civil disobedience is a technologically assisted state of mind, laws are an irritation. But if they are to exist to protect _some_ rights, they should, for aesthetic balance if nothing else, exist for _all_. Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

Re:
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 8:55 PM 2/22/96, Raph Levien wrote: >MOSS is dead, long live MOSS >---------------------------- > > There were five contenders on the field going into the day, and two >and a half at the end. MOSS was one of the casualties. A lot of us >were sorry to see it go, but eliminating candidates has got to happen >if we're going to have interoperation. > It's hard to say exactly what went wrong. MOSS had many advantages, >and was a nice, clean, pretty standard. I think what doomed it was the >lack of a good implementation. > Even though MOSS is no longer considered a serious contender, one >piece of it is still very much alive: the multipart/signed message >format. At the end of the day, there was strong, nearly unanimous >consensus that multipart/signed should be recommended as the signed >message format for _all_ of the email encryption protocols. I debated about responding since you are entitled to your opinion. After thinking about it for a while I decided I need to say a little something. It's my impression that MOSS suffered from lack of representation at this workshop. I got that view from at least 6 different people, so I believe it to be true. That said, I think it's unfair to declare its demise. Further there is a good implementation of MOSS. It was even announced at the workshop. Did you miss it? TIS has done an implementation that is available for anonymous FTP, albeit only within the US. It's integrated with MH, not the most favored mail user agent, but the current version has shell scripts that perform minimal MIME functions to facilitate integration with other agents. Finally, multipart/signed and multipart/encrypted are not MOSS. They are a framework independent of any particular secure email technology. True, MOSS depends on them, but I regard that as a feature not a bug. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

RE:
by Blake Ramsdell 17 Dec '03

17 Dec '03

> Further there is a good implementation of MOSS. It was even announced at > the workshop. Did you miss it? TIS has done an implementation that is > available for anonymous FTP, albeit only within the US. It's integrated > with MH, not the most favored mail user agent, but the current version has > shell scripts that perform minimal MIME functions to facilitate integration > with other agents. Is there a version that can be used in commercial applications? There is for PGP, S/MIME, and (I think) for MSP. From a developer's point of view, this will influence my decision between specifications. Blake

1 0

RE:
by Blake Ramsdell 17 Dec '03

17 Dec '03

> James M. Galvin said: > It's my impression that MOSS suffered from lack of representation at this > workshop. I got that view from at least 6 different people, so I believe > it to be true. That said, I think it's unfair to declare its demise. I agree with this impression -- I think that MOSS was not represented in any meaningful way. The question that begs to be asked is: why? I also agree with the assessment that MOSS was a casualty due to a certain extent to the lack of representation. To recap the purpose of this conference, it was for the interested parties involved with security specifications to review their differences, determine the requirements, and possibly even to come out with a preferred solution. If the interested parties don't show up, it seems that they are not going to have their arguments heard. In fact, I believe that MOSS is the *only* specification that didn't have a significant group of proponents present during the entire proceedings. I knew darn well that we as a group would be gunning down one or more of these specifications to simplify the process, and if I wanted anything to say about it, then I'd better go. Before the conference, while this list was forming, I asked Dave Crocker what the agenda was, and who specifically was speaking about each specification -- the reason I did this is to find out if the *absolute best* representative for each specification was speaking, so that we would not end up in a situation where the audience was uninformed about a specification, and I could feel that the meeting would be productive. Ultimately, for PGP and S/MIME, it was the authors or editors themselves that provided insight into their respective specification, and for MSP it was at least one key implementor. For MOSS, it seemed that the whole contingency (people who were either in charge of the specification, who had plans to implement the specification, or who were significant customers interested in the specification) was you (an author of the specification), and you had to split. This is not a good sign. If the people who cared about MOSS participated in the public forums provided for discussing it (mailing lists such as pem-dev), then they would have been made aware of this meeting just like the other specification proponents, and would have shown up. You showed up, showed a chart that didn't demonstrate MOSS as a clear winner, and didn't stick around to discuss the chart (which I thought was a good start to finding The Answer). This also reminds me of a time when a call went out for the MOSS implementors to raise their hands (on the pem-dev list) -- and only Ned Freed answered. This could very well be because MOSS implementors don't hang out on the mailing list, which is somewhat strange since the timeframe in which this question was posed was very close to the release date of the specification (10/95). In fact, Dave Crocker recently said that "Clear, corporate commitments from product vendors ought to confirm or dispel the rumor of the MOSS demise", and we have not had *any* vendors step up since that statement. Don't get me wrong -- I don't consider myself to be prejudiced away from MOSS. Near the end of the meeting, I specifically pointed out that: First we had PEM, and it died. Now we have MOSS, which is 47 pages long, and less than *four months* old, and we are calling it dead also. The answer to that was that it made a great "over beer" question -- a question to be discussed over a beer. Care for a beer? Blake

2 1

Windows ssh -- this mail was written with it
by Tatu Ylonen 17 Dec '03

17 Dec '03

Secveral people have been asking recently about the status of my windows SSH client. Well, this mail is being written with it. I have finally had time to work on it almost full time for the last week, and it is finally starting to work. The basic protocol is now in farirluy good condition. Terminal emulation has been written (it is VT102, tested to work with vttest)), but the emulator hasn't been merged to Windows yet (that should be a couple of days work, max)). Channel forwarding code is not yet ready, but probably will in a couple of weeks. I will probably make a pre-alpha test distribution in very near future so that people can get some hands-on experience with it. (Eithher stiill durring this week, or alternatively soon after IETF which will be next week. BTW, I wiill give a presentation on SSH at the IETF.=) Anyway, this was just to give quick update Ö:-) (Sorry for the typos in this message, since emulation is not yet iintegrated it is hard to edit, and also key mappings won't work properly until I get the emulatoor in - hopelfully really really soon.) Tatu

1 0

PGP source code book sold out!
by John Gilmore 17 Dec '03

17 Dec '03

Date: Tue, 27 Feb 96 15:22:21 EST From: ehling(a)mitpress.mit.edu (Teresa A. Ehling) Message-Id: <9602272022.AA06562(a)mitpress.mit.edu> To: gnu(a)toad.com Dear John -- The PGP Source Code book is now out of print. We assumed there would only be limited interest in the source code, so we printed only 1500 copies. When we sold out of this run (just last month), we decided not to reprint, given that the 3.0 release is due this spring. Terry Ehling The MIT Press

2 1

RE: RE: [ Death of MOSS? ]
by Blake Ramsdell 17 Dec '03

17 Dec '03

Brad Knowles said: > Obviously a few additional enhancements would be necessary, such > as cryptographic signatures on return receipts and classification > labels (as two examples, there may be more), but MOSS is my current > best yardstick for measuring just how well a secure email standard > really is integrated into MIME, with the absolute minimal amount of > disturbance to the existing MIME standard (and thus, making it the > most "native" MIME implementation of a secure email standard). Both the PGP and S/MIME specifications propose the use of security multiparts -- how come these don't rank as highly as MOSS in your view of how well they are integrated with MIME? Blake

1 0

Anyone else getting these?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Is anyone else getting these strange "Message body suppressed" messages? Below is an example: At 7:31 AM 2/26/96, spook(a)eworld.com wrote: > ----- Message body suppressed ----- > >--NAA18253.825456631/dns1.noc.nsa.net-- > > > >** NOTICE **: A mailer error at NSA caused this >** message to get messed up. If the body of the message >contains only '----- Message body suppressed -----', >then we were unable to recover the entire message and you >will have to email the person sending you this message >asking him or her to resend it. NSA apologizes for >the inconvenience. Every day that passes convinces me we are entering a period of chaos. Large mailing lists are a likely casualty. --Tim (Yes, I changed "Best" to "NSA," for the fun of it.) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Intelligence ANFO
by John Young 17 Dec '03

17 Dec '03

FAS offers the January 19, 1996 testimony before the President's Commission on the Future of Intelligence by Bobby Inman, Frank Carlucci and others including Richard Haass, principal author of the recent CoFR report (which is now also at the IRP site). URL: http://www.fas.org/pub/gen/fas/irp/offdocs.html#aspin The Commission's report to the President is due this Friday. For admiration of the deeply set spook-hooks in the US economy, take a look at the IRP humongous list of firms that happily fabricate products for $28 billion per year. Firms that generously pasture the ex-TLAs like Inman, Carlucci, Haass, et al, for their, uh, wisdom and expert testimony to insure a bountiful demand for fertilizer and fuel oil.

1 0

Re: ViaCryptPGP 4.0?! (was Re: PGP integrated into Z-Mail)
by Deranged Mutant 17 Dec '03

17 Dec '03

Derek Atkins wrote: > PGP3, which I've been working on with Colin Plumb for some time, is > based upon a specified API. Although the API is still under > development, the plan is to have libraries available for UNIX, Mac, > and Windows (DLL). > > At this time the API Spec and Programmer's Guide documents are not > publically available. Hopefully this will change in the next few > weeks. Odd. I remember a prototype API spec being posted to c'punks last year. (Or was that something else?) And, what does this have to do with ViaCrypt PGP 4.0? Would it be 3.0 compatible or is it something entirely different? Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

2 1

E$? Whatever
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A GLIMPSE INTO THE FUTURE OF MONEY, AS CITI SEES IT Known inside Citicorp as the Electronic Money System, the bank's version of electronic currency for cyberspace is the result of four years of mostly top-secret toil by technical wizards who report to Colin Crook, the New York money-center's top technology officer. Still in a prototype stage and probably years away from full-scale operation, the Electronic Money System is described as fully equivalent to cash, but hardware and software reside on secure processing environment. At a recent demonstration, one of six laptops was programmed to contain the functions of two banks, with icons representing tellers, security, and other features. The other terminals were set up to display "electronic wallets" that individuals can use to withdraw money from the virtual bank, exchange money with each other, and perform a variety of sophisticated transactions. For example, a customer on one laptop can transfer $100 and 50 British pounds from his bank account to his electronic wallet. The cash then exists in digital form on the individual's computer hardware. "Our system does not depend on any network mechanism for security," said project manager Sholom Rosen. "The security is between the two devices. They have their own cryptography and security." Bank officials said they intend to apply the technology first in wholesale functions, with retail use still far in the future. -- American Banker, 2/23/96 --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0