December 2003 - cypherpunks-legacy

Credentials ?
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Ed rites: > Even with the manned entrances, the ones with just a >receptionist/secretary, they seldom check that the picture matches the one >on the badge, so even if they've invalidated the badge, the receptionist >will still more than likely let you into the place if you wave your >keycard/badge around. People have *always* been the weak link in spite of the fact that "personal recognition" is considered best. Back in the days of high compression engines measured in hundreds of cubic inches rather than bottle sizes, everyone who worked at the Cape (Canaveral, Kennedy, whatever) had a pack of Winstons in the car. The back entrance was through a drawbridge, a sweeping right turn, and then a short straight to the guardboxes at the entrance. When the bridge was up, a considerable amount of 28 cents/gal Sunoco 260 waited for the bars to raise. Unleashed, a small block could be wound up pretty good by the gate. Seems that a pack of Winstons (white rectangle over red rectangle) at 40+ looked just like a Secret badge. Warmly, Padgett ps Tim was correct, believe I *registered* Libertarian that year - do remember not getting invited to vote in any primaries.

1 0

ANNOUNCE (a cypherpunks exclusive!)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've added a couple of features to BAP (mainly being able to quote an encrypted message that you are replying to, and a command-line interface for script-writers.) and called it v1.1 and I'm distributing the 1.1beta at <a href= "http://www.c2.org/~bryce/Niche.html"> the Niche </a> for 20 cents payable in Mark Twain Bank Ecash. If you are too technologically backwards or miserly to pay 20 cents for this then you can probably convince me to e-mail a copy. BAP is "Bryce's Easy PGP"-- my own PGP<->Unix programs integrator script. When I set out to write it, my goal was to make it easy enough to use that my mother could do so. She does now, so I consider it a success! Here is what some other people have said about BAP: "Great job! Much better than the hacked sendproc I used to use with MH!" - Philip R. Moyer <prm(a)rome.isl.sri.com> "I've tried competing products and found this to be the cleanest, smoothest and easiest to install. I have no personal, commercial or financial interest in this product. It does 'auto-pgp' for pine, elm and tin." - Henry W. Farkas <hfarkas(a)ims.advantis.com> "So far, I've been absolutely _thrilled_ with BAP and how easily it integrates with both elm and trn. As you can see, I actually have it running on almost everything I post or email from this site." - Alexander Williams <thantos(a)runic.mind.org> "I have just 'bought' copies of your bap_in and bap_out software, and I'm just letting you know so that you can add me to your user list. You may be interested to know that this is the first thing that I've found worthwhile 'buying' using [cyberbuck trial] ecash since I joined the digicash ecash scheme just after it started. I've been wanting to incorporate pgp into email (I use elm) for a while now, and your software has enabled me to do so easily. Good on you, keep up the good work." - Glen Pringle <pringle(a)cs.monash.edu.au> I'm not going to be available to work on BAP for a little while so all the glaring security holes, uglies, crashing errors and so forth that come with 1.1b1 are just going to stay there for a week or two unless someone else fixes them. People who give me complaints, bug reports and feature suggestions have the privilege of being added to the <a href="http://www.c2.org/~bryce/BAPThanks.html"> "Hall of BAP Contributors" </a>. <BLINK> tag available upon request. Oh yeah-- and I've marked down the price of "BAP classic" (v1.0whatever) to US$0.50 for each piece. Come and get 'em! :-) Bryce "Toys, Tools and Technologies" the Niche New Signal Consulting -- C++, Java, HTML, Ecash Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b1 iQCVAwUBMSXwNPWZSllhfG25AQGHVQP/e5csq/Kw5yJOrIHLw8eFtNCd4Wa6A5ta JYZinIMhVpXSaoOwt9Wktu+6F3DKfY8qIMYXIEKWcF6LaUUoqtnP+ul/Ilcgp2ft xrA2jTjoa4U12oCLYgwxRZHAtV+LGCTWp5qekU9bbj9rdIG1L0TRdcm/LfhEz+4f xE2EOaoLAyg= =j7/+ -----END PGP SIGNATURE-----

1 0

Re: True random numbers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:13 PM 2/17/96, maruishi(a)netcom.com wrote: >I think you are probably right when you say that it is not truely random. >I don't think I thought about it very much, but this method does produce >a kind of a pseudo random numbers. Yes, it produces a "kind" of pseudo random number...the problem is determining which "kind" it is and whether it is sufficient for the planned use. The Netscape RNG also produced a "kind" of pseudo random number generator...but it was insufficient, as events showed. > But I think it would be really hard to simulate this method because >if you send data to a network way out there in Europe then all the >machines in between can cause the tranmission to slow down or spend up >depending on the type of lines nad CPU load etc... If by "simulation" you mean "prediction," I agree. I agree that predicting the next bit in a sequence might be hard. (But "hard" is a slippery term, and the history of crypto is littered with the corpses of systems that seemed to be hard but weren't.) However, even predicting the next bit with 50.0001% accuracy might be sufficient to reduce the work factor in an attack by many orders of magnitude. And some attacks might rely on the overall statistics of the bits, not just the ability to predict the nth bit. Again, there's a huge literature on this. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Some thoughts on the Chinese Net
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:00 PM 2/15/96, Carl Ellison wrote: >At 12:31 2/15/96, Jon Lasser wrote: >>How would packets coming into the country be marked / passed on? > >Presumably, you'd need a Chinese-approved identity key in order to get >packets into the country. Chinese web surfers are tracked by a special "cookie," a la the Netscape cookie, but with special features. The "Chinese fortune cookie." (The crypto block managers open your cookies and tell you your fortune.) Packets are laundered, of course, in a Chinese packet laundry. Fat Fong say man who write in code get run over by tank. --Tim May [This Bible excerpt awaiting review under the Communications Decency Act] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said. "Dad's getting old. I say we should fuck him." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

1 0

Re: Credit cards - Privacy - Unique Situation
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Rick Tait wrote: > > Being a British guy recently moved to the USA, I may be in a unique > situation in being able to protect my privacy, and I was wondering if > fellow cypherpunks may be able to give me some hints in being to > "protect" myself... > > Since my SSN is barely a month old, since I don't yet have a credit card > over here, since I won't (yet?) be in many of those beloved databases, what > steps can I take to "hide" myself before it's too late? Too all intents and > purposes, I have metamorphed from a newborn US baby into an adult, > overnight. Thus I have an SSN, I pay tax (etc), but I'm not on anyone's > direct mailing lists.[..] Depends on how much you're in British databases. I imagine that when those who desire to track your movements feel the need they'll check with UK and European sources. A lot of the databases are already linked up and shared. An acquaintance from the UK who came here several years ago was able to use his debit card in local ATMs, for instance. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSZdiSoZzwIn1bdtAQERMQF+KW+TYNLJA5GO1VLxonngp0bEHx80OVOn Y3+dr1f/did4h1VkFsyqpy0a3ZI7hnEe =KF7W -----END PGP SIGNATURE-----

1 0

Re: Using lasers to communicate
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:07 PM 2/17/96 -0500, cypherpunks@toad wrote: >> Depends upon how paranoid you want to be. A small radio-controlled >> helicopter is available cheaply at Radio Shack, and might even be >> capable of holding a receiver, re-transmitter and recorder. > >If I wanted to intercept a laser beam I'd spray an aerosol mist >into the beam and look at the scatter. On a dusty or humid day I >might not need the aerosol. > >Why not just encrypt the link? Then anyone can tap and it doesn't matter. >I'm in the process of building a tightbeam microwave link that can carry >2 Mbps over 50Km. Anybody got any gunn transceivers they don't need? If you have a secure link you don't need encryption. Arguably, the converse is true; if you have secure encryption you don't need a secure link. Isn't the ability to transmit secure data over insecure channels one of the primary justifications for encryption? dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMSZeJjVTwUKWHSsJAQEhswf/Xm1QwUTrBkzYWmbBu0+c4qkBXUfZR1Ck DEzgpuBMhGV/2YO+654AwEKBMK7u91J/I8mkl6h84UIclrBUydmmh2N0m34qlZRi 4R6KdFR0w80WsvTAcX+qJoACLrf9JsrLq03Y1lytSdVYxax6NWIY+OXOQBf36xCp aSq5+HYe3498+9QQEho+LpKw3A84bWPYjh5sFBheffgf6mpbsY+Tu3/fhDOESuGc ZjBLcjNlUtZ9IYnD+dzlAJBH04Lpgigfqjj5ZkGV04Q+jgumO8+HZbE+ymJnhfX7 G4KcPESnkpcK0JaiEVJtiKA5Eh2Ur8J8MUXxou4QY4j44md22v8aZw== =qyyj -----END PGP SIGNATURE----- ----- David E. Smith, c/o Southeast Missouri State University 1000 Towers Circle South MS 1210 Cape Girardeau MO 63701 dsmith(a)midwest.net, dsmith(a)alpha.c2.org, PGP 0x961D2B09 (573)339-3814 http://www.midwest.net/scribers/dsmith/ "Reality is only for those lacking in true imagination."

2 1

Re: Spin Control Alert (LI Newsday, 2/12/96)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 15-FEB-1996 01:33:25.17 >Since you don't understand the way Federal criminal charges work, >there's no reason I should take your argument seriously. (Hint: The >*U.S. Attorney*, or an AUSA, files charges, not you, me, or a random >"athiest.") How about a lawsuit by the atheist against the site? Since the CDA claims that such material is harmful, and tries to make it illegal, such a lawsuit would appear to have grounds - especially if the atheist has a child that is "surfing the Net." Now, they're unlikely to _win_, but the atheist can cost them some money _and_ make the CDA look stupid. If I were in the American Atheist Foundation or some such, I'd do such a lawsuit against a Christian Right organization that had supported the CDA. Of course, the selective enforcement will be a good argument in favor of the law being unconstitutional. Crypto relevance? Criminal laws aren't the only things that a crypto-anarchial system will make less effective. Civil lawsuits (under things like libel) also will be. I'd call this a good change. -Allen

2 1

Risks of a style anonymizer?
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One risk of "style anonymizers", though: if the style becomes too generic it's just another levelling of readability. Usenet and mailing lists can become that much more boring, if not stupidified with too many spelling erros and grammatical abuses. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSZfQyoZzwIn1bdtAQF47QGAkP5+ti0j6KyJg8KY1ei1dF9Yz8FAnz4b EjB4r6nMXDW2wBG7ZnpFkX1YO6Aezmte =vrAk -----END PGP SIGNATURE-----

2 1

Re: A Cyberspace Independence Refutation
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

jamesd(a)echeque.com said: > >j> 1. President Clinton declared CDA unconstitutional and directed >j> the Justice department to refrain from enforcing it. At 01:57 PM 2/16/96 -0600, Sten Drescher wrote: > Then why is the Justice Department defending it? Sorry: My error. As you pointed out he ruled *part* of the CDA unconstitutional -- a part that no one expected to be enforced anyway --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

CyberManicheans (was Re: CyberAngels)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"declan+(a)CMU.EDU" or someone using that identity has written: I fear the so-called "CyberAngels" more than I do the Feds. At least with their brand of jackboots, there can be accountability. The CyberAngels are more like CyberCads, CyberFrauds, or CyberCriminals. Cyber-vigilantes? Odd that their home page has a blue-ribbon. They don't seem to understand what the hell they are doing... it's not a requirement that ISPs require online presence to be verifiable anyway. Even if you're ISP operator knows who you are, it doesn't follow that it's definitely YOUR presence in a usenet post or on IRC. There's plenty of semi-anonymity on the net without using things like remailers or "decense" protocols or DC-Nets. Under their logic, we should all have little bar codes implanted in our skulls and checked at every street crossing and doorway. There's also a difference between rudeness and criminal activity. Anonymity isn't a cause of crime. It's icing on the cake, and criminals will find a variety of other ways around validated User-ID at the ISP level anyway.... which lulls one to a false sense of security, since once you're got a legitimate-appearing ID for your ISP, you can do quickie hit-and-run "cybercrimes" and fall off the face of the earth anyway. There's just so much an ISP or even a clerk at a department store can do to verify your identity. One store I know doesn't accept checks from Post Boxes, believing that they are all-too-often used for fraud... but a street address from a fly-by-night mail box rental is undetectable by them. The Cyber Angels are just as clueless as the authors of the CDA. Cheers, [***CENSORED***]

1 0

Re: China -- the fragile glimmer of freedom
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [Warning! This post is not primarily about "writing code." Instead, it's about cypherpunks "spreading crypto."] Tim May [& usually I agree with him] wrote: >At 12:10 AM 2/16/96, Bryce wrote: >... <snip> >>Perhaps you think that the compliant Chinese person is >>satisfied with his or her role as lackey of his government? >>Or is it that we and the Asians inhabit such different >>worlds that we will have to make do without each other's >>help? > >Well, where are the posts from outraged Cypherpunks living in the People's >Republic of China? Obviously, there aren't any. (Being an outraged cypherpunk in the PRC would no-doubt be harmful to the outraged cypherpunk's health.) >Some countries are so far gone, so deep in the muck of statism, that >nothing their governments do is very surprising. Ranting about how bad >things are in some country is not very meaningful. Supplying them with >tools is more meaningful. However, given that I know of no list members >living in the PRC, nor even any in soon-to-be-assimilated Hong Kong, I'm >not sure what the point is. I think that the goal here is to try to generate just one small group of cypherpunks in Hong Kong, who plan to stay on after the occupation. They will necessarily be very brave people, but IMO brave people _are_ there. I won't say bravery of that sort is common, but there are many people in China, and we all remember the guy who stood there in front of the tank...IMO remailer technology transfers will be _at least_ as important to this [admittedly ambitious] goal as direct crypto transfers are, as traffic-analysis is _VERY useful_ to the surveilance state. When the "remailer-in-a-box" is finished by a friend of mine "Real Soon Now" (tm) I hope that the directions to it are translated and that it is widely distributed [legally, of course]. ;) >I don't know about others, but I think the focus should be on the folks who >are salvageable, not the billion or so Chinese or the hundreds of millions >of Islamic women awaiting their clitorectomies and bowing toward Mecca for >guidance. Tim, you're giving up too quickly on most of the rest of the planet. As long as repression ever works somewhere, statists will attempt to (selectively) use annoying examples of how "orderly" it makes life. It's a one-way ratchet: When a moron bombs a building here, the US politicians cancel a repeal of the "assault weapons" ban. When some moron plants a bomb in London (or Paris) their politicians' reaction is not exactly the reverse... >Fact is that 90%+ of all list members are in the United States, and 97%+ >are in the so-called "Western world." We have a chance to deploy strong >crypto, the residents of Nepal and Singapore do not. I think that these statistics are likely correct, but I think it's not important, and we can't just give up this easily...We already know that China will be swallowing Hong Kong, a haven of capitalism, and IMHO we should work to make this process as "interesting" as possible. Anonymity is likely to upset the Chinese authorities as much as it upset the CO$. I know nobody in Hong Kong who will be staying, but I'm sure that some people on this list do, and Hong Kong is likely to be a better place for us to "infiltrate" than Beijing. Time is short, but if the fax machine gave us Tienanmen(sp?) I am optimistic about e-mail. Singapore residents (at least, those with a hankering for chewing-gum) might feel they have a reason to help us, if we simply try to be polite when we ask for help in putting together a good-looking Trojan Horse. JMR [who is even now preparing for the flames.] <snip> - ------------------------------------------------------------------------ Regards, Jim Ray <liberty(a)gate.net> Boycott espionage-enabled software! "If I had to summarize [Republican candidate Morry] Taylor's campaign message, I'd boil it down to two basic points: 1. The problem with this country is that the government is run by lawyers. 2. And these are *stupid* lawyers." -- Dave Barry 2/17/96 _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 http://www.shopmiami.com/prs/jimray IANAL _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMSZoUG1lp8bpvW01AQGsrAP/QdUrjiSoZ5avWu7MvdNDS5BMhv/WJecR MTbgwrAbrKa9TTw+kFifzdiMeJtldmwSyhAvskshfLHWtAl/RjWm7+Et6NcJeeZV nDoAljQNmU+xDM0jPGSu4PvkxNxndqbd3TiDOkfYtjLO16T+yA31j16RPiqjnG4C YWbM6iCvTJw= =Sq8a -----END PGP SIGNATURE-----

1 0

CyberManicheans (was Re: CyberAngels)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"declan+(a)CMU.EDU" or someone using that identity has written: I fear the so-called "CyberAngels" more than I do the Feds. At least with their brand of jackboots, there can be accountability. The CyberAngels are more like CyberCads, CyberFrauds, or CyberCriminals. Cyber-vigilantes? Odd that their home page has a blue-ribbon. They don't seem to understand what the hell they are doing... it's not a requirement that ISPs require online presence to be verifiable anyway. Even if you're ISP operator knows who you are, it doesn't follow that it's definitely YOUR presence in a usenet post or on IRC. There's plenty of semi-anonymity on the net without using things like remailers or "decense" protocols or DC-Nets. Under their logic, we should all have little bar codes implanted in our skulls and checked at every street crossing and doorway. There's also a difference between rudeness and criminal activity. Anonymity isn't a cause of crime. It's icing on the cake, and criminals will find a variety of other ways around validated User-ID at the ISP level anyway.... which lulls one to a false sense of security, since once you're got a legitimate-appearing ID for your ISP, you can do quickie hit-and-run "cybercrimes" and fall off the face of the earth anyway. There's just so much an ISP or even a clerk at a department store can do to verify your identity. One store I know doesn't accept checks from Post Boxes, believing that they are all-too-often used for fraud... but a street address from a fly-by-night mail box rental is undetectable by them. The Cyber Angels are just as clueless as the authors of the CDA. Cheers, [***CENSORED***]

1 0

Re: A Cyberspace Independence Refutation
by Dave Farber 17 Dec '03

17 Dec '03

The President can not rule anything unconstitutional. He can tell justice not to enforce it but sometime local federal prosecutors do what they want and some future administration can decide to enforce it. Only the courts or the congress can change things for sure. Dave At 03:20 PM 2/17/96 -0800, jamesd(a)echeque.com wrote: >jamesd(a)echeque.com said: >> >>j> 1. President Clinton declared CDA unconstitutional and directed >>j> the Justice department to refrain from enforcing it. > >At 01:57 PM 2/16/96 -0600, Sten Drescher wrote: >> Then why is the Justice Department defending it? > >Sorry: My error. As you pointed out he ruled *part* of the >CDA unconstitutional -- a part that no one expected to be >enforced anyway > --------------------------------------------------------------------- > | >We have the right to defend ourselves | http://www.jim.com/jamesd/ >and our property, because of the kind | >of animals that we are. True law | James A. Donald >derives from this right, not from the | >arbitrary power of the state. | jamesd(a)echeque.com > > >

2 1

Re: Libertarians and crypto and such
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Feb 16, 1996 23:06:27, 'Bruce Baugh <bruce(a)aracnet.com>' wrote: >At 12:43 AM 2/17/96 -0500, tallpaul wrote: > >>While the LP or its majority may not call for the things I've critiqued, >>certainly libertarians have. Nor, as far as I can recall, have LPers >>repeatedly posted to the cypherpunk list material that is on-the-surface at >>least significantly off-topic; libertarians have. And I responded. > >So you get the fun of attacking this straw man called "libertarians" without >any responsibility to identify any actual people it might include other than >a handful of folks that the vast majority of us think are kooks. And you've >also acquired the remarkable mental power, apparently, to discern who is or >is not an LP member based on their posts here. > Libertarians are not "straw men." They actually exist. I've seen them with my own eyes. If B. Baugh is upset that I have not mentioned any of the other libertarians (olf the cypherpunk list) that I have criticized, I would be happy to re-post to the list all of the related messages in other news groups on this topic listing their names. My "sent mail" archives contain a few thousand messages. (Aside to T.C. May: this is sarcasm and rhetorical hyperbole.) The vast majority of the libertarians on the cypherpunk list *might* think that the people I've criticized are "kooks" but I can find no evidence of this. I do note that some people who call themselves "libertarians" have so criticized the "kooks." The second point is, I think, either an error in logic. I have written nothing about my ability to tell what political party someone belongs or does not belong to. I infer that when someone tells me they are a member of the LP, CPUSA, SPUSA, etc. that they are, until evidence dictates another conclusion. If someone is a party member and decides not to make the material public, then they, not I, are responsible for any transient confusion that develops. But I do not demand or expect people to automatically list their party affiliation. I do note that the declared ability to "discern" unannounced party membership has historically been far more a rightwing then leftwing "ability" in the U.S.A. >Neat tricks. > >But until they're joined with a willingness to look at a wider range of >libertarian posts than the fragment that feeds your pet peeves, I reserve >the right to be impressed. Again, these seems to reflect your ability to reach conclusions about other people's behavior based on no evidence. I have read numerous posts by libertarians on the net; who has not! The issues I have responded to have usually centered on thigs like the mass killings of civilians, murder, and hatred of other people based on issues like race, ethnicity, nationality, and/or religion. You may consider these nothing more than my "pet peeves." This is your right. But in an era of increasing global hatred over such issues I do not think many would agree with your accessment of the relative weight of these issues. You need not be impressed; I was not posting to impress you. > >And yes, this is off-topic. So this is all I have to say about it. > I think then that you posted one message too many. --tallpaul

1 0

Patents suck
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: > Man's survival tool is his mind. > > Patents and copyright are establishing the ownership and protection > the result of the exercise of his survival tool. > > Therefore they are good. > > To try to eliminate them is equivalent to promote slavery. I take some disagreement with that. With patents, there is a problem of large companies owning them yet doing nothing with them except suing other companies or individuals. For example, look at arithmetic coding: there are many patents owned on it, yet a lot of software using this means of compression may be in violation of the patents... are the patent-owners publishing software or makingh efforts to license it widely? If anything, such patents are getting in the way of using many algorithms. Patents would be better if there was a good-faith attempt on the part of the holder to "use it or lose it". Somebody sitting on a patent and doing nothing with it deserves to lose it after a number of years.

1 0

Indian datacom freed?
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

The Indian Techonomist: bulletin Copyright (C) 1996 Rishab Aiyer Ghosh. All rights reserved Indian datacom freed? by Rishab Aiyer Ghosh February 16: Today, in a "brainstorming" session to discuss the new datacom policy proposed by The Indian Techonomist, the Department of Telecommunications indicated its enthusiasm for a free datacom environment in India. As no official decision has yet been taken, I cannot make the details public for the moment. There is one exception: the Telecom Secretary (and Chairman, Telecom Commission) R K Takkar has made it quite clear that content providers in cyberspace will receive all the free-speech protections available to other media. Mr Takkar said that existing laws for obscenity and national security were enough for the Internet, and in any case were not the concern of the DoT. Mr Takkar said that there was no need to licence on-line content providers, and indicated that Internet service providers would not be responsible for illegal content, apparently implying common carrier status for ISPs. The other parts of the proposal, relating to low entry barriers for ISPs and free competition met with a largely positive response. The full text of the proposal is now available at http://dxm.org/techonomist/news/newdcom.html Apart from Mr Takkar and myself, present at the meeting were Telecom Commission Members P Saran and P Khan, as well as some other senior DoT staff. I would like to thank Vinton Cerf and Lawrence Landweber for the support given by the Internet Society to the proposal. The Indian Techonomist: bulletin. http://dxm.org/techonomist/ Copyright (C) 1996 Rishab Aiyer Ghosh (rishab(a)techonomist.dxm.org) Tel +91 11 6853410; Fax 6856992; H-34-C Saket New Delhi 110017 INDIA May be distributed electronically provided that this notice is attached

1 0

Cybercrooks
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Dream of the Internet Becomes Worst Nightmare Manhasset, N.Y., Feb. 16 -- Technology managers, who dreamed of the Internet as a new business tool and championed their cause to senior management, are waking up to nightmares of security gone awry, reports CMP's InformationWeek in its February 19 issue. "The incidence of cybercrook attacks to mine or sabotage a company's information resources is rising rapidly," states Bob Violino, editor-at-large of InformationWeek. "What is especially alarming is that despite the fact that companies like Rockwell International and Merrill Lynch and various government agencies employ the latest firewall and encryption technology available, they are experiencing security breaches on a regular basis." Business users have been particularly skittish about the Internet since last September, when two computer science students at the University of California at Berkeley cracked the public-key encryption code used by Netscape Communications Corp.'s popular browser software. "There are more experts than ever in the intruder community who know the infrastructure of the Internet," explains Cathy Fithen, CERT's team leader of strategic incident response. "In the past we saw people breaking into systems using passwords. Now they look for flaws to exploit involving networking protocols and source codes for operating systems." The fear of invasion is well founded, according to federal law enforcement agencies, which have stepped up their investigations of online intrusions. "We're aware that this is a serious problem for any industry using the Internet," says Jim Freeman, special agent in charge of the FBI's San Francisco office. "Salvation from the government, or from vendors with new security products, seems unlikely," says Violino. "History shows that as soon as new security tools are developed, hackers learn to crack them. And while not every company possesses trade secrets, security is still a must for everyone in business. For now, at least, absolute security is one thing the Net can't offer." But, companies are so focused on Internet intrusions from outsiders that they often fail to consider the possibility of an inside hacker. According to John Reinke, chief information security architect at Merrill Lynch & Co., Inc. in New York, "There is no modern large organization that I now of that does internal firewalls." At Bell Laboratories, where an internal network links some 300,000 host computers around the world, security is a constant concern. "We're bigger than the entire Internet was in the late 1980s," says Bill Cheswick, technical staff manager at the labs' computer science research department in Murray Hill, N.J. "Our firewall keeps the bad guys out but you can't say there aren't bad guys inside the company." --

1 0

Re: Berkeley ftp site moved again?
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- s1018954(a)aix2.uottawa.ca wrote: > > I've been unable to get through to ftp.csua.berkeley.edu > and www.csua.berkeley.edu for the past two days. > > Does anyone know if the site (and the cpunk archives with it) > has moved or if it's just down? (I'd mail root, but what's the > point if the machine's down?) > > Sorry if I've missed this being mentioned before. It's just down. - Ian - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSZ7+SoZzwIn1bdtAQE74QF+LpQ4ArMpxZXxCF0HjKDkoa2oW8vMGUgP igMRtrhpScWkQOuAcXWun4/T+2hIHxCk =dKmJ -----END PGP SIGNATURE-----

1 0

Re: Text of personal use exemption
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Michael Froomkin wrote: > > http://www.law.miami.edu/~froomkin/personal-use.txt > Interesting. Note, however, the following proviso (123.27(a)(1)): (1) The software product(s) are to be used only on a simultaneously temporarily exported Category XIII(b)(1) hardware product or a simultaneously exported item on the Commerce Control List (CCL) This seems to say a couple of things: o I can't bring my copy of PGP or kerberos with me on a floppy, intending to use it abroad on a conveniently available computer; I must bring a computer with me. o The computer I bring with me must be a Category XIII(b)(1) hardware product; that is, something that is illegal to export (now, except for personal use), or be on the CCL. That second one seems weird. Does the CCL have things like normal portable computers on it? Otherwise, this exemption seems pretty useless... - Ian - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSaALCoZzwIn1bdtAQHakAF+Lu9NxtqTvIobwT8epPPK/aWP38ldAO1m zJpcRffvIUmcKjB+U+A2OxAnSFRGd6r7 =cvI8 -----END PGP SIGNATURE-----

1 0

Re: Remailers Pose Risk
by Michael Peponis 17 Dec '03

17 Dec '03

> Computerworld, February 12, 1996, Front page: > "Anonymous remailers have a lot of nasty potential," said > Stephen T. Kent, chief scientist for security technology at >So do kitchen knives or automobiles. So do brain-dead journalists and "security experts". Oops, take that back, no probability involved, they are nasty problems. [..] > One snowy day last month, for example, about 25% of the > workforce at a defense contractor in Rockville, Md., went > home after they received a bogus E-mail message dismissing > them for the day. The message originated from an anonymous > remailer that allowed the user to impersonate a senior > company official. :Was that a remailer or simply forged mail? How long have people been bitching about putting digital signatures on stuff like that. If it was signed, it could of been verified if indeed it was legit or not. Irregardless of where it came from, anybody stupid enough to believe everything they read, without checking out it's validity, deserves what they get. [..] > "As in the case of smallpox, yellow fever, flu epidemics, > AIDS or malaria, it will take disasters before the public > may accept that some forms of restrictions on the > electronic freedom of speech and that privacy may be > worthwhile."FNORD! What?? like anonymous electronic media spreads the disease somehow. To the person who wrote the article, you have proved beond a shadow of a doubt that you are dense as a brick. Wrong type of virus, you mean the other kind. > Do's and don'tsAhem > Unethical or illegal uses of anonymous remailers:[..] > - To violate copyright laws ... Scientology... > - To encourage others to commit unethical or illegal > behavior Oh Boo Hoo, the moral decay of society, that is your problem shithead, not mine, some of us survive no matter what happens to the rest of you. Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

1 0

Legal status of Indian Reservations and CDA
by Michael Peponis 17 Dec '03

17 Dec '03

If I remember correctly, are not American Indian reservations considered qusi-sovergin states under the law? If this is true, what would stop me from negotiating with some tribe to establish an ISP on the reservation and then placing whatever material I wanted on that site without fear of reprisals from the US goverment. After all, if they are a soveign state, decency is covered by whatever laws they have, if any, not the CDA. If this is true, the Indians get the benift of having state-of-the-art telecommunications in thier communities, plus residual job creation, and everyone else gets freedom of speech. Any comments? Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

1 0

Re: Legal status of Indian Reservations and CDA
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:03 PM 2/17/96, Michael Peponis wrote: >If I remember correctly, are not American Indian reservations considered >qusi-sovergin states under the law? > >If this is true, what would stop me from negotiating with some tribe to >establish an ISP on the reservation and then placing whatever material I >wanted >on that site without fear of reprisals from the US goverment. > >After all, if they are a soveign state, decency is covered by whatever laws >they have, if any, not the CDA. > >If this is true, the Indians get the benift of having state-of-the-art >telecommunications in thier communities, plus residual job creation, and >everyone else gets freedom of speech. "Bingo." Actually, not. Despite the Indian bingo parlors, look at what is lacking in this model: brothels, money-laundering banks, hash parlors, etc. (Not that there aren't whorehouses operating semi-openly on Indian lands, as elsewhere, just that the fiction that Indian reservations are quasi-sovereign is just that, a fiction. Recall the case of Native American uses of peyote.) Of course, this fiction of sovereignty has been useful for the intelligence community when they wanted it: Wackenhut and related CIA companies used the Cabazon Band of Indians lands near Indio, California to develop products that are illegal to develop in the nominal United States...despite being less than a mile from the main freeway linking LA and Palm Springs. And I was told that certain microwave (Long Lines?) lines were deliberately routed through Indian reservations, allowing NSA-GCHQ monitoring without violating the "no domestic interception" fiction. So, it might be possible to eventually push through an exemption to the CDA that is somewhat analogous to the way some Indian reservations can have gambling facilities that are otherwise forbidden, but I expect the court battle would be a long one, and would need big money to pursue. (Gambling got pushed through for obvious financial reasons, and perhaps because of some judicious payoffs to local officials, courts, etc. Yet another convenient fiction.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: True random numbers
by Sandy Harris 17 Dec '03

17 Dec '03

Deranged Mutant <wlkngowl(a)unix.asb.com> wrote: >maruishi(a)netcom.com wrote: >> >> I was trying to think of a way to come up with true random numbers... >> And knowing a bit of UNIX socket TCP/IP programming I made a small [..] > >I wouldn't trust the samples taken from networked sources. Me neither, in general. A possible exception: I wonder if the checksums on Ethernet or IP packets use a reasonably strong CRC algorithm. If so, they might be a decent source of randomness in an environment where you could be sure the Black Hats couldn't see them. e.g. using only packets from your own LAN, suitably protected by firewall & good administration. >You're better >off with a kernel patch that samples from local sources directly like >disk or keyboard timing variations... such patches already exist, with >similar drivers developed for DOS and OS/2 systems as well. I'd be more inclined to hash the kernel's internal tables, e.g. process & file descriptor tables. These should vary quite a lot & if the enemy can see them, random number quality is the least of your worries. RFC 1750 is a good reference on this problem. -- Sandy Harris sharris(a)fox.nstn.ca

3 3

Privacy and Information Disclosure
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:57 PM 2/17/96, "A. Padgett Peterson P.E. Information Security" >ps Tim was correct, believe I *registered* Libertarian that year - do remember > not getting invited to vote in any primaries. Thanks for confirming/acknowledging this. The larger point, not directed at Padgett is this: people voluntarily reveal information about themselves, get themselves placed on mailing lists for like-minded people (such as this list, or the Rose Growers of Alberta list, etc.), etc., and then they complain that others are compiling data on them! The classic example is borrowing money, whether via a credit card (you did know you're borrowing, didn't you?) or for a conventional bank loan. Most people who borrow money and then repay the money _want_ this to be known to other potential lenders...this is what a "credit rating" is all about. Of course, those who borrow money and then don't repay it are anxious not to have others know about this situation! If you don't want to be on a Libertarian Party mailing list, don't register officially as an LP member. If you don't want a record with the credit card companies, don't use their credit cards. If you don't want to be a list of people who buy sexual devices, don't buy them through the mail (or use money orders, mail drops, etc.). And so on. What I can't imagine anyone on this list wanting (though apparently some percentage do want them) are laws which give the illusion of enhancing privacy by taking away the rights of others. I say "illusion" because The Ones Who Really Matter will still have the goods on you. (The Lotus CD-ROM of addresses being the canonical example of this. It was hailed as a great victory that "the Net" rallied to get Lotus to abandon plans to sell this CD-ROM to me and thee, where in actuality it just meant that the sales remained to direct marketers, law enforcement, and the like. But the Ostrich Syndrome prevailed.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Remailers Pose Risk
by Deranged Mutant 17 Dec '03

17 Dec '03

Pitty the author of that article won't see replies to it on the list. > From: "Michael Peponis" <mianigand(a)unique.outlook.net> > To: cypherpunks(a)toad.com, wlkngowl(a)unix.asb.com > Date: Sat, 17 Feb 1996 18:03:09 +0000 > Subject: Re: Remailers Pose Risk [..] > Oh Boo Hoo, the moral decay of society, that is your problem shithead, not > mine, some of us survive no matter what happens to the rest of you. > Regards, > Michael Peponis > PGP Key Avalible form MIT Key Server,or via finger Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0