December 2003 - cypherpunks-legacy

Re: Why Americans feel no compulsion to learn foreign languages
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Mar 27, 10:57pm, Jonathon Blake wrote: > One other advantage to knowing a language other than > English. Legal encryption. << Unless a federal law > encrypt it with PGP. Would the cryptanalysts recognise > the plain text, even if they had it? >> Well, it's a special case of security by obscurity, isn't it? If the language is something unusual, maybe that helps, but if the language is too obscure, you may be identified (by your ethnicity, your history, or your friends/community) as a speaker of it. I guess it does raise the economic cost of "decipherment" some. But many immigrant parents have learned to their embarrassment that this kind of encoding doesn't work too well %^) The Navajo/Na Dene codetalkers (WW II) developed a real arcane jargon, so I was told. Maybe it was because the conditions of war were completely different than their language's environment so they were forced to invent words, or maybe they thought it was a good idea, or whatever. But I believe transcripts of their transmissions are often mostly unintelligible to native Navajo speakers who weren't in the know.

1 0

Re: The Law Loft: Surviving the Biometric I.D. Card
by Hal 17 Dec '03

17 Dec '03

I have been surprised not to hear more about this aspect of the immigration reform laws. Unfortunately the alert which Tim forwarded is out of date, and I believe the reforms did pass in some form. I view biometric identification as a very disturbing development and I'd like to hear more about the wording of the bills as finally passed. If they really want to give people a card which proves their legal residence in the US, a less intrusive approach is possible. Rather than set up a database of all employees, and/or give each person an official identity card, instead have people come and prove their residency, then give them a card with the biometric information and a blind signature. No other information goes on the card, no information goes into a database. The signature is a certificate testifying that the person with the particular thumbprint is legal to work in the US. The card can't be transferred since no one else has that thumbprint. But no identifying information is recorded. There is no advantage in people coming in twice to get more than one card since their print will be the same each time, so no database is needed. A simpler approach dispenses with the blind signature and just issues a regular signature on the thumbprint or other biomarker. This is about as good since proving residency will probably require at least an incidental display of identity papers, so you are already trusting the agency not to log you, and you can just as easily trust them not to log the signature. This is an approach which accomplishes the goal with a minimal intrusion into people's privacy. I don't know how it compares with current biometric concepts - maybe this is similar to what they are proposing, minus the database. But there is a general principle that government regulations should use the least restrictive means where they violate people's rights, such as the seriouss privacy violations in the current proposals. So I think it should be possible to make a strong argument that privacy protecting alternatives which accomplish the objective must be considered. The key concept is to unlink identity from the credential. That is the crucial idea of credentials, one which has not yet pentrated the popular consciousness. Maybe we need to start pushing it more. You don't have to prove your identity to prove you have certain qualifications. There is no need to tie everything to a central identifier. A system of dispersed, stand-alone credentials will be far better at protecting privacy. Blind signatures can help protect against cheating, but policy can work too, especially when credentials are issued by a public agency on a large scale, so systematic and secret record keeping is impractical since so many people are involved. I know a lot of people will oppose even this form of biometric information, which is not tied to identity. Perhaps we could have some discussion on the degree to which people see this kind of system as a privacy threat. If the credential concept is new we could discuss that, too. Hal

2 1

Re: New crypto bill to be introduced
by jim bell 17 Dec '03

17 Dec '03

At 06:03 PM 3/28/96 -0500, Declan B. McCullagh wrote: >At CFP today, we heard about a new crypto bill being introduced >tomorrow, which will be similar to Leahy's bill with the >crypto-being-used-in-furtherance-of-crime portion removed and an >explicit no-government-mandated-escrow provision added. While this does sound like progress, I'm suspicious. Peter Junger's analysis raised serious doubt as to the ability of bill to open up the crypto export market as it purported to. And where, exactly, did this these changes come from? Who was consulted? What recommendations were NOT taken? >We have put our "List of Shame" numbers on our nametags. >-Declan You're overdoing it on this "List of Shame" thing. You don't know who actually made those anonymous postings, and it's been observed that those names seem to correspond nicely with an NSA-hate list. It would not take a great deal of imagination to conclude that the NSA was motivated to de-focus our anger at the Leahy bill and replace it with a great deal of back-stabbing commentary. (If that was the intent, it succeeded...) On the other hand, I've also noticed that there hasn't been a lot of specific analysis of the Leahy bill in the last few weeks, and my suggestion that the Leahy bill be informally re-written to address Junger's objections (as well as my own, and Tim May's, etc) has not resulted in a great deal of repair work. Now, miraculously, a replacement bill appears that includes SOME repairs. (obviously, we have to wait to hear how most of it comes out...) I get the impression that we are being sequentially offered ice cream cones with decreasing amounts of poison in them, in the hopes that at some point we'll bite. It seems to me that whoever is writing these bills should be willing to make a statement about what his goals are, and who he's talking to as he crafts them, and what changes he was UNwilling to include. Jim Bell jimbell(a)pacifier.com

2 1

Re: PPV Descrambler (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > "This is cypherpunks. Not Cable-TV-Piracy-Punks." > > Cable-TV-Piracy-Punks? Who's this guy? I asked for a text file (for > informational purposes of course). Oh and David K. Merriman, PPV is > not on cable. > Video Scrambling & Descramblin for Satellite & Cable TV R.F. Graf & W. Sheets ISBN 0-672-22499-2 $31.95 PPV is on the Austin, TX cable systems. Several varieties even.

1 0

Re: Traffic Jams on the Internet
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:54 PM 3/27/96 -0500, Mark M. wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On Tue, 26 Mar 1996, E. ALLEN SMITH wrote: > >> It occurs to me that it would be good if people sent in some >> non-governmental/hierarchial solutions to this problem, such as ones using >> digital cash as "postage" for prioritized mail. > >I read an article on various Internet pricing schemes a while ago and one >of the ideas was a pretty clever solution. Internet services would be >classified according to their bandwidth requirement and need for >interactivity. The cost per byte of e-mail might be very cheap whereas the >cost per byte for videoconferencing might be more. There's no real way to >rip off this scheme, because if you try to send an e-mail and classify it >as "high priority" it is more expensive. The phone companies have dealt with this kind of problem for years. For example, there are issues of phase jitter and bit error rate that they deal with all the time. If anything, they don't quite understand the email type communication of, "Oh, anytime in the next 10 minutes, and tell me if it doesn't get thru and I'll send it again." In ATM, these characteristics are bundled into what is called Quality of Service. That, along with bandwidth, make a reasonable basis for charging. Email is a bit like flying standby, while video is more like the Concorde. IMHO, the only long-term solution to the problem of bandwidth allocation involves markets. Markets feed cost information back to the users and give the providers incentive to improve service. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: ITAR double standards?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:20 PM 3/27/96, Asgaard wrote: >I believe in this parallel thesis. As was reported from the dec -95 >OECD meeting in Paris: > >>The statement from SHELL International is interesting. >>They can accept 'a trustworthy international key escrow >>infrastructure based on X.509 certificates' but they also >>need to 'protect their assets against Government intelligence >>gathering, organised crime, civil unrest and data privacy >>legislation obligations'. Indeed, there are _many_ reasons for multinational and/or non-U.S.-based companies to be suspicious of the United States or any of its minions holding the keys to confidential business information. Bamford's "The Puzzle Palace" reports on many incidents in which U.S. agencies intercepted business transactions for various reasons. Even of allies, as in the case when one of the NSA's SIGINT antennas picked up a message from the U.K. government to the ambassador in Vienna alerting him to the coming devaluation of the pound. (A great opportunity for Ollie North and his covert ops boys to make some extra millions by currency speculation.) Likewise, ITT routinely cooperated with the FBI and pre-NSA surveillance agencies to supply the traffic of corporations and businessmen. Given that even nominal allies spy on each other (Pollard spied on the U.S. for Israel, Chobetsu routinely spies on U.S. companies in Japan, France bugged Air France jets to spy on U.S. businessmen, etc.), I just don't see any international agreements that protect adequately. And when I say "nominal allies," consider that many in Washington have been saying in recent years that Japan is America's "real" enemy! (I certainly don't endorse this view...they're all a bunch of rascals.) I believe the obvious flaw in the whole key escrow debate, the flaw that is so obvious it seldom gets discussed, is that it is expected that the U.S. will be the holder of keys. Or its minions in Europe and Asia. Flawed, irretrievably. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: What backs up digital money?
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: tcmay(a)got.net (Timothy C. May) > At 1:46 PM 3/27/96, Scott Schryvers wrote: > >Question. > >If e-cash were backed by gold would that make it more reliable than say the > >dollar? > > This question, and much of the debate that appears here about digital money > in its many and confusing forms (e-cash, digicash, bitmarks, e$, > cypherfrancs, chaums, etc.), displays a "type error" in thinking about > digital money. > > No form of digital money extant is an actual currency in the conventional > sense. Nor does this seem likely. Nor necessary. Nor useful. Nor important. > > Rather, think in terms of _checks_ or _wire transfers_ and the like. An > order to transfer funds from one account or place of holding to another. Tim is right when he goes on to say that digital money is not exactly like any of the traditional financial instruments. However I think it is more like cash, and for that matter more like currency, than like other things. Here are some of the ways it is like cash. It is basically anonymous, with neither buyer nor seller able to learn the identity of the other, even with the help of the bank. It is untraceable; there is no way to know, given a piece of cash, under which transaction it was withdrawn from the bank. It is a bearer instrument; anyone can hold it, and whomever presents it gets the value (that is, it is not "made out" to a certain individual). A piece of dcash is an asset, a claim on the bank. When dcash is withdrawn, the bank must debit (reduce) the customer's account immediately. Likewise, when it is deposited, the depositor's account gets credited. Between those times the net amount of money in bank accounts was reduced, by exactly the amount of circulating dcash. When the money supply is counted, circulating dcash will need to be included with traditional currencies like cash and coins (I think that is M1), since it is not counted in the bank accounts. The difference with checks and wire transfers is that in those cases there is a direct transfer of assets from one account to another. These are not bearer instruments; in fact wire transfers aren't really financial instruments at all, and do not carry value. There is normally no anonymity or untraceability either, with these kinds of transactions. So I see them as being very different from dcash. The best analogy to dcash is the private currency which was issued by banks and other financial institutions prior to about 1850 (in the US). Until that time the US government did not issue paper money, it was all private. A bank would issue bank notes, which would circulate in its local area as money. They were backed up by "real money", specie, metallic coins, which the bank kept in its vaults. The digital cash issued by Mark Twain bank is in many ways a throwback to these old bank notes. There are differences, of course. A lot of attention is focussed on the non-transferrability, the fact that you have to deposit the cash at the bank after each transaction. Some people say that this means that the cash doesn't circulate, hence is not a currency, hence must be more like checks, etc. But I disagree. I view this aspect of dcash as superficial and unimportant. First, it may not be technically necessary. Some cash systems have been proposed which allow for transferrability. But second, even if it is necessary to exchange cash after each transaction, that can be done completely automatically. In fact, the agency which does so doesn't even have to be the bank, as far as the financial aspects go. The exchange has no financial impact on the bank's accounting procedures. And it can be completely automated for users. They don't even have to be aware of it. Their software can turn in received dcash at the bank for fresh banknotes, anonymously and automatically. So I view dcash as a circulating currency, where the act of transfer in some implementations requires some technical assistance from an agent of the bank able to make digital signatures on its behalf. It is more than simply a mechanism for transferring funds from one account to another (unless you think of government currency in those terms). I view it as possessing real value, as being a genuine asset in the same sense as other forms of cash. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMVnJehnMLJtOy9MBAQGoxwIAiFRtBo215dXzlRWR1drH8dQR63zKkPoQ 5EDk85YM8fxIaDg/cYrGEzl+bDlF2qOJisjrCl9XkTJEBrifHavrEQ== =792N -----END PGP SIGNATURE-----

4 3

suggestions for starting an e-bank
by brookfld＠netcom.com 17 Dec '03

17 Dec '03

Hi! If I were going to start an e-bank, what would you suggest? 1. What type of e-cash system? 2. What services to offer? 3. Where would I get information? 4. Where is there a need in the marketplace? A friend of mine has the means and desire to do this, and he wanted me to ask and then forward the answers to him. Thank you in advance. --Richard

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Wed, 27 Mar 1996, Mike Duvos wrote: > tcmay(a)got.net (Timothy C. May) writes: > > > At 1:46 PM 3/27/96, Scott Schryvers wrote: > > >> Question. If e-cash were backed by gold would that make it > >> more reliable than say the dollar? > > Not necessarily. Historically, gold emerged as the primary > currency metal because [Excellent points about gold's practical use, good timing, and industrial value countered by the current lack of industrial value.] > Basically, one can create monetary value for any commodity whose > supply can be controlled, usually by the folks wishing to lend it > value, by simply making a stable market in it, and having the > reputation and power to control that market in perpetuity. > > The best example of this is probably the diamond market. Here we > have a rare but intrinsically worthless material, the gem quality > diamond, which has no useful industrial applications at all, > since non-gem quality diamonds and substitutes, both synthetic > and natural, are in abundance. I was with you until this. In fact diamonds are anything but rare. Their value is the result of the most exceptional marketing by DeBeers, and the very tight restrictions on supply. I might note that the restrictions on supply are even somewhat tangential. DeBeers has created one of the most historic, long standing and impressive market distortions anyone has ever seen. Of course this only goes to further the argument (which I think you are adopting) that it is fairly simple to estlablish a commodity of "value" regardless of intrinsic worth) > Gem quality diamonds are extremely valuable, because their supply > is carefully controlled, and because of clever marketing designed > to convince every male human in North America and most of Europe > that shelling out two months salary for one is the unique and > true symbol of everlasting love. Even gem quality stones are relatively abundant believe it or not. > The diamond industry has even made plans for the holographic > fingerprinting of every diamond they release, should synthetic > gem-quality diamonds ever hit the market, so that they may > continue their control of the supply of their "currency", even in > the face of a flood of absolutely identical "unsanctioned" gems. Again, even absent the intrinsic value of the substance it seems that marketing and perception will dictate "effective value." > I recall a very clever Science Fiction story I read a number of > years ago in which aliens completely destroyed human civilization > by manufacturing all the world's goods and services, and > accepting payment only in cowpies, which were subject to an > arbitrary and complicated grading system similar to that used by > modern gemologists. One day, the aliens simply left, and human > civilization, consisting mostly by then of PhD Cowflopologists > with expertise only in interpreting swirls on lumps of shit, > promptly folded. This is precisely the point, and why, while I agree with your comments about gold today, I think the most important issue is the long term solvency of a commodity. As you have noted, anyone can make a substance worth something in the short term. (Tulips) The challenge, and the goal in my view, is to create a currency based on a backing which endures the long term, and the unthinkable (collapse of a major government or some such). > Before I digress to far from your original question, let me state > the point I am trying to make here. If a entity, or group of > entities, with reputation and power to make a market, decide to > demoninate a currency using a rare commodity, it makes little > difference whether the rare commodity is near-perfect crystals of > carbon found only on land that they own, a vault filled with gold > bars, exponentiated random numbers modulo the product of two > large but closely guarded primes, or statistically unlikely > swirls in wads of digested plant material dropping from the butt > of a cow. > > In all these cases, the important thing is not the commodity, but > the entities guaranteeing the market, and the perception of their > reputation and ability to support said currency in perpetuity. > Absolute control over the supply of the commodity in question > doesn't hurt either. When the value of the intrinsic worth of a commodity in question does become apparent is in periods of transition, flux, disorder, or strife. The security of a currency is going to be a major factor, especially immediately following introduction, to its popularity- except in unusual circumstances (tulips, market distortions, etc.) > Indeed, US government backed e-cash would be a far more trusted > and reliable currency than gold backed currency printed by > DigiCash BV. I'm not sure this is precisely true. While gold itself might not be the best choice, the general principal that a commodity based currency is less secure or trustworthy than a government backed one (even a powerful and imposing government) is not one I'm prepared to endorse without reservation. > One good inflation-resistant indicator of whether gold is a good > value is the ratio between gold and silver prices. Both of these > metals are mined with similar difficulty, and have similar uses > for backing currency and as coinage metals. Historically, there > have been times when gold and silver prices were approximately > equal. > > I have no doubt that if the unwashed masses were sold the notion > that gold was the single reliable inflation-proof form of wealth > they could own, and the holdings of international bankers were > sold into the hands of millions of individual citizens, a > controlled devaluation would follow, together with much chortling > and uncorking of champagne, as gold and silver prices became > nearly equal again. I believe this correct. > As long as people who count have vaults full of the stuff, and > wish to carry it on their books as an expensive asset, it will of > course continue to have its current inflated value, and nothing > will be done to depress the market. In that sense gold is a > reliable asset, as long as most of the little people refrain from > jumping on the bandwagon. Just like diamonds. Again, while the commodity itself (gold) may not be appropriate, I don't believe this ends the argument. > > No form of digital money extant is an actual currency in > > the conventional sense. Nor does this seem likely. Nor > > necessary. Nor useful. Nor important. > > Actual currency can circulate forever in the economy without > eventual conversion into some other kind of money. The > requirements of current digital cash systems for centralized > clearing to eliminate double spending and to mint new coins tends > to preclude the kinds of perpetual peer-to-peer transactions we > think of when we conceptualize "currency." Which suggests that private currencys must utilize e-cash (if at all) merely as monetary instruments which continue to look much like what exists today. (e.g., drafts, checks, bonds...) > Real electronic currency could be invented, but would have to > live its life within a population of tamper-proof smart cards > communicating with each other through secure protocols. Whether > anyone will bother to implement such a system remains to be seen. I concur. > Until then, the "check" model of digital money is, as Tim points > out, the correct one. I concur again. > > The point being that talking about "what backs up digital > > cash?" is misleading. (What really backs it up is the > > reputation of the entities, but I digress.) > > "The reputation of the entities" is the only important > consideration regardless of what the cash is denominated in. In > most cases, the valued commodities, if they exist, are simply > pretty window-dressing for some unseen but powerful syndicate. Yet here I must differ. I'm still not convinced that a legitimate commodity somewhat resistant to the market distortions you cite does not exist. Don't ask me what it is yet, I'll have to give it some thought. > -- > Mike Duvos $ PGP 2.6 Public Key available $ > mpd(a)netcom.com $ via Finger. $ --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

RE: What backs up digital money?
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Perry E. Metzger > >I'd say that anything directly dealing with digital cash, its >implications, deployment, and technical issues associated with >it. General discussions of whether the Federal Reserve is a bunch of >evil old men and the like are what are out of bounds. [...etc.] .................................................................. So you mean rather than merely, or only, complaining that things have not, or are not, working right (in our favor, to our benefit), because of what Evil Old Men have done to the system as it now operates, the discussion should go in the direction of: . "doing something about it", or . ideas on methods and techniques which would work, which could . make a difference (potentially, hopefully) towards the success of techie systems which would result in greater personal, individual control, also including perhaps: . clarifications on why, in spite of the resistance of those who are apprehensive about the break-down of law&order, these are a "good thing" to promote and implement (for those who don't "get it"), . aiming more at postive improvements and successes in the future, rather than focusing too much on past mistakes, failures, injustices (where the reader could wonder, "so how does this relate"). ...or something like that. .. >Blanc

1 0

Re: PPV Descrambler
by David K. Merriman 17 Dec '03

17 Dec '03

At 01:34 AM 03/28/96 +0000, you wrote: >I've been looking for a file on how to make PPV descramblers and havn't >found any. Commercial descramblers cost around $200 base price. If >anyone has a file on how to make them please e-mail me one. Thanks. > >captain_lee @mail.interconnect.net > This is cypherpunks. Not Cable-TV-Piracy-Punks. Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

4 3

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Does anyone have ANY code for DES or RSA encryption for use on a PIC microcontroler? A friend and I are developing an ASCII terminal (dumb term) that encrypts data going to the serial port and decrypts data coming from the serial port, so you could successfully send a message over a modem and have it automatically encrypted\decrypted. We have all the hardware almost done, but we are having a hell of a time writing the code for the encryption... Thanx in advance... l8r, -MeRC merc(a)redrose.net -or- merc(a)success.net -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQCVAwUAMUC05tnn3Dsf47p5AQE6AAP9E/JebLn1UtkOk41IGw/i4XHKckVcI6RH ptBMucqx01sSTxaR8tXPmmkKjz5f3xndxepbbs6nKfoNuSaODWSirOlNvt3i1DWL iUmB9+rUYmwwlpD7t6qyy2XzsAxO/M/nFT4ZxO8wi96nR/Rmp00LvCoK+YcjgQnj HReyQrIl4X+ZAI0DMUCzOgAAAQQAv6IH+OnLeP+chsgwymSVKqsXHO1xwJLxs657 Cf3miDM3mNBB/qmRziQ1zHeC/nXgaGhR7eAdidL6MngDXl6+cw4Z5xXvenu5MpEW zpZpwDK5/XwuvCIexQP2eHIb2Ms6vna7fUoaHGrrV4844KIVg+E36ZgWT1ZP2efc Ox/junkABRGwAYe0I01pY2hhZWwgRC4gV2hpdGUgPG1lcmNAc3VjY2Vzcy5uZXQ+ sAED =ZbPJ -----END PGP MESSAGE-----

1 0

New crypto bill to be introduced
by Declan B. McCullagh 17 Dec '03

17 Dec '03

At CFP today, we heard about a new crypto bill being introduced tomorrow, which will be similar to Leahy's bill with the crypto-being-used-in-furtherance-of-crime portion removed and an explicit no-government-mandated-escrow provision added. John Gilmore asked wonderful questions after the moot Supreme Court session. We have put our "List of Shame" numbers on our nametags. -Declan

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:49 AM 03/28/96 -0800, frantz(a)netcom.com (Bill Frantz) wrote: >I, at least, want to know something of the language of the countries I >travel in. Being able to get a meal or a room for the night is useful. As >a rock bottom minimum, I want to know the phrases: Hello, Good by, Please, >Thank You, More beer please, and Where's the bathroom. Indeed, I've found that pretty much covers the essentials :-) First things I've always tried to learn in a foreign language are "please" and "thank you". > >The look of pleased surprise on the face of the Budapest resident when I >said "Thank you" to in Hungarian as he gave up his seat to me because I was >loaded down with caving equipment is something I still treasure. > Sounds much similar to the reaction I got in Japan, speaking broken Japanese. Atrocious accent, of course; abysmal grammar, and a fair share of mispronunciation tossed in - but I was *trying*, and that counted for a _lot_. I also have to concur with the point about the language/point-of-view argument. I never have learned to _think_ in a foreign language (a prerequisite for fluency, I believe :-), but have gotten sufficiently skilled to be able to understand some of the subtleties of the languages I've (kind of) learned. Regarding the notoriety of British (and, yes, Americans), I met up with a Brit in Japan who complained about the 'bloody foreigners that don't understand proper English'. I pointed out to him that *we* were the foreigners, and that the Japanese had a nicely organized society about the same time that his ancestors and mine were still smearing themselves with blue mud. That earned me an Evil Look. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVpW7MVrTvyYOzAZAQE/xQP/WhYi/LAT2M/QYJ+b2PW7sOrRg2r0ZNcU gl3gk50RWY7AOUeEaifNM2ZWMl5oqqKSjA+eV5pnFZBlQBgrbnuzRHLi2F9IigZ6 Uu2V3/DHaTGY9ZVdWok0deU8DnkoY0W07pafggB9qpTCgqTGhU0NNOVxeWlU2HsT 6Yu9l5QduHM= =XMSb -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: PolicyMaker paper available
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:15 PM 3/28/96 -0500, Ted Anderson wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >"Perry E. Metzger" <perry(a)piermont.com> writes: >> Huh? Postscript an "obscure printer code"? > >I now work from a paperless office and find postscript an "obscure >printer code". It has taken an annoying amount of hacking to view this >postscript file on my PC. A paperless office is about as useful as a paperless bathroom. Try using Ghostscript and Ghostview. There are versions for both 16 bit and 32 bit Windows. (As well as about every other platform on the planet.) They will allow you to display PostScript files to your screen, as well as print them to non-postscript printers. (But being a paperless office, you probibly don't have printers...) Information on Ghostview and GhostScript can be found at: http://www.cs.wisc.edu/~ghost/index.html --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Mad_Software_Disease
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Path: newsfeed.internetmci.com!howland.reston.ans.net!news-e2a.gnn.com!pop.gnn.com!JDonth From: JDonth(a)gnn.com (Joseph L. Donth) Newsgroups: comp.sources.testers Subject: Beta Testers Wanted Date: Tue, 26 Mar 1996 13:09:55 Organization: InfoBook Technology Lines: 251 Message-ID: <4j9fer$sr1(a)news-e2c.gnn.com> NNTP-Posting-Host: www-31-240.gnn.com Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-GNN-NewsServer-Posting-Date: 26 Mar 1996 19:10:19 GMT X-Mailer: GNNmessenger 1.2 InfoBook Technology is looking for Beta Testers for our latest product called ONE-PHONE-CALL. This post is in four parts: 1) What does a Beta tester do? 2) How Do I Sign-up? 3) How do I get chosen? 4) The product description The product description is quite lengthy. Feel free to bail on it when you have decided to be a tester or have decided not to be one. Note: Since the program includes encryption software, we are restricting our testing (and possible distribution of the commercial release) to people living in the USA. I will restrain from comment on governments, export licenses, the NSA and the like. If you decide not to be a tester, would you drop me a post and tell me why? This is our second posting of this request - our goal is to have at least one hundred testers - so far we have less than two dozen. If you have any thoughts on where else I might post this beta test request and meet with a favorable response please let me know that as well. Thanks and without further delay... ****************************************************************************** ** What Does a Beta Tester Do? Although we will not ask you to sign any agreements, we do ask that you honor the following conditions of our Beta Test Program: 1. The software being tested is not for commercial use. If you use it in a commercial fashion, you do so at your own risk. The software may have 'bugs' in it. The purpose of the beta test program is to identify those problems. 2. Don't give copies of the software (except when authorized) to other people. If you know of someone that you think might be a good beta tester, let us know and we will look at adding him or her to the beta list. 3. Please let us know when you have problems with the software. Don't assume that someone else has reported it. A written response sent to JDONTH(a)GNN.COM, is the requested communication method. 4. We also ask for comments on the whole package you received from us. Did it create a good first impression? Was it complete? Is the User's Guide clear? What would you change? Why? ****************************************************************************** ** How Do I Sign up? Please reply by EMail (JDonth(a)gnn.com) with the following information: 1. Full Name 2. Surface mail and preferred email address 3. City, State and Zip code 4. Attention Line 5. Telephone number 6. An "I agree to the terms of the Beta Test Program" statement 7. Computer system information 8. Computer expertise (optional) 9. Experience as a Beta Tester (no previous experience is required) 10. Why you want to test this product ****************************************************************************** ** How Do I Get Chosen? We will be choosing testers on a first-come, first-serve basis. You are not guaranteed a position as a tester of ONE-PHONE-CALL. If you are chosen you will receive an email confirmation, followed by the software, sent via fist class mail. The software will be a 30+ day version with all features and capabilities. You will be sent an email questionnaire about 30 days after shipment of the software. Your reply to the questionnaire will insure you a FREE copy of the software after it is released into retail sales. If you are not chosen you will be notified by email. If you have any questions, please contact me at JDonth(a)gnn.com or Joseph L. Donth InfoBook Technology 7660 Reed Rd. Azle, Texas 76020 ****************************************************************************** ** What is ONE-PHONE-CALL? ONE-PHONE-CALL is a PC-based software product that enables you to transfer electronic information such as a program, a scanned fax, a word-processing document or a spreadsheet to someone, in a secure environment, with just one telephone call. It features a simple installation, user-friendly interface, mouse support, a menu system, and easy-to-remember commands. First, Some Background More and more of our correspondence is electronic in nature. We use word processors to compose letters and reports. We use spreadsheets to do budgets and financial analysis and we use accounting programs to keep track of everything from the corporate books to our personal checking accounts. The power of these software tools is easily appreciated and the trend is to use our computers in meeting more and more of our daily needs. What is lacking, however, is a simple, easy-to-use method of sharing our electronic information with each other. Using the facilities of fax, EMail or floppy disks has problems. A fax can only transmit printed information, EMail is difficult to use and can be expensive, and mailing floppy disks is very slow. Also, none of these methods is very secure. The wrong people can read a fax, open business mail, or gain access to voice-mail or EMail accounts. Now with your modem equipped computer and ONE-PHONE-CALL you can addresses all of these issues. Let's illustrate with three examples: The first example demonstrates the simplest issue: sharing electronic information with someone else. You are working on a report at home and need to confer with a co-worker in the office. You place a telephone call to your co-worker and discuss the report. You decide he needs to see a copy of the report. Without ONE-PHONE-CALL it might go like this: To fax a copy of the report you might: ... Print out the report on your printer ... Dial his fax number ... Fax the report ... Call him back to tell him the fax has been sent ... Wait for him to get the fax and call you back! The result - at least three phone calls and who knows how much time wasted in printing, faxing, perhaps getting busy signals and so on. Or perhaps you decide to send him an electronic version of the report, via his EMail account. You might: ... Format the document properly for the EMail service to accept ... Dial the EMail service, connect, log-in, and all the rest ... Transmit the report ... Call him back to tell him the report is on the EMail service ... Your co-worker connects to the EMail service ... He downloads the report ... He calls you back. At least four phone calls! And who knows how much money and effort? Now with ONE-PHONE-CALL, you can accomplish the same task with your original phone call. You and your co-worker can stay on the phone and transfer the information back and forth as many times as necessary, without having to make another phone call! A second example demonstrates a more complex problem. The ability to transfer information when you don't know exactly what information needs to be transferred. You have just received a copy of a great new shareware game from the XYZ Software Company. Your brother shares your liking for this company's software and you have exchanged previous shareware games with him. It's a great game and you're pretty sure he'll want a copy too. Without ONE-PHONE-CALL, you have two obvious choices. First, you could upload all the software to his EMail account (see above!) and maybe call him to tell him it's there, or you could copy the software to a floppy disk and mail it to him. If you go the EMail route, you're out the upload time and several dollars. (So is he, on the other end.) If you go with the Postal Service, you're out a buck or so for a floppy and some postage and the software gets there days later. With ONE-PHONE-CALL, it's as simple as calling him, finding out if he wants the software, and sending it right then and there! ONE-PHONE-CALL will even figure out what software he needs (perhaps several of the files are the same as in previous games) and will only send the new files that he doesn't have, and update any files that are out-of-date. We can extend this example to many specific problem areas: You own a software company that operates a customer service line for help with your products. If your customer needs an updated version of the software, you can upload the new software to him immediately, sending him only what he needs, during the one phone call the customer has made to your company. Result! a happy customer. A friend is having a problem with his computer. You suspect he may have a problem with one of his configuration files such as CONFIG.SYS, AUTOEXEC.BAT or one of his Windows INI files. Without using the capabilities of ONE-PHONE-CALL he is either reading you the text of the file over the phone (yea, right!) or he is printing it out to fax it or mail it to you. You get the listing (maybe days from now) and find the problem. You need him to edit his CONFIG.SYS file to fix the problem. "How do I do that?" he asks. You get the idea. With ONE-PHONE-CALL, he simply sends you the files, you edit them on your computer, and send them back, he reboots, and the problem is solved. All with ONE-PHONE-CALL. Our final example highlights the security aspects of electronic information transfer. Have you ever sent a fax and wondered if it went to the wrong machine? Did you dial that number correctly? Or did you wonder if it was "eaten" by the machine? or was read by the wrong people? or fell into the "black hole" of cyberspace? Have you ever wanted to send some confidential information but didn't "quite trust" your on-line service? Have you ever wanted to make sure the right person and ONLY that person sees your communication? Without ONE-PHONE-CALL, the electronic exchange of confidential information can be very difficult. With ONE-PHONE-CALL, your life just got much easier. Here's a hyperbolic example but it makes the point: You have been away at your summer retreat working on the company annual report and budget. It is FULL of confidential information. You need to send it to your CFO back at the office for review and the insertion of some background information that he has in his computer. How do you get it to him? With ONE-PHONE-CALL, you call his office, get him on the phone, and send the document! You KNOW you dialed the right number. You KNOW you have the right person on the line. And by using the encryption feature of the software, you can even deter access to your information in the event of a wiretap. How do you do that without ONE-PHONE-CALL? Minimum System Requirements ONE-PHONE-CALL runs under Windows 95, Windows 3.1 or MS-DOS. System Requirements: For operation under Windows 3.1 or higher: IBM-compatible PC (386 or higher) 4 mb of RAM memory, 8 mb recommended Mouse Hard drive with at least 1 MB of free space 1200, 2400, 9600, 14.4K, 28.8K modem For operation under MS-DOS 3.11 or higher IBM-compatible PC (8088 or higher, 80286 or higher recommended) 640 kb of RAM memory Mouse recommended Hard drive with at least 1 MB of free space 1200, 2400, 9600, 14.4K, 28.8K modem Best Regards, Joe JDonth(a)gnn.com

1 0

Re[2]: Crypto CD UpDate
by Adam Pingitore 17 Dec '03

17 Dec '03

Um, why am I getting mail from you people.

1 0

CDT Policy Post 2.12 - Sen. Burns Announces New Bill To Lift Crypto ExportControls
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 12 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 12 March 28, 1996 CONTENTS: (1) Sen. Burns Announces New Bill To Lift Crypto Export Controls (2) Subscription Information (3) About CDT, contacting us This document may be redistributed freely provided it remains in its entirety ** Excerpts may be re-posted by permission (editor(a)cdt.org) ** ----------------------------------------------------------------------------- (1) SENATOR BURNS ANNOUNCES BILL TO LIFT CRYPTO EXPORT CONTROLS The battle to roll back the Clinton Administration's encryption policy escalated on Thursday when Senator Conrad Burns (R-MT) announced that he will introduce a new proposal to repeal restrictions on encryption exports and to encourage the growth of electronic commerce. Senator Burns announced the bill via a teleconference during a special session at the Computers, Freedom, and Privacy Conference in Boston, MA. The bill, titled the "Promoting Commerce On-Line in the Digital Age Act" (PROCODE), joins two recent bills introduced earlier this month (S. 1587 and HR 3011) designed to encourage the development of strong, easy-to-use privacy and security products for the Internet. The Burns bill is different from the other proposals in several respects. Specifically, the latest bill does not contain any new criminal provisions or provisions imposing liability on third party key holders. In his presentation today at CFP, Sen. Burns outlined his new bill. Among other things, the "Promoting Commerce On-Line in the Digital Age Act" would: * Allow for the unrestricted export of "mass-market" or "public-domain" encryption programs, including such products as Pretty Good Privacy and popular World Wide Web software. Encryption software and hardware for sale in local software stores or widely available on the Internet would all be exportable under the proposed Act. * Require the Secretary of Commerce to allow the unrestricted export of other encryption technologies if products of similar strength are generally available outside the United States. * Prohibit the Federal Government from imposing mandatory key-escrow encryption policies on the domestic market. * Limit the authority of the Secretary of Commerce to set standards for encryption products. CDT applauds this effort by Senator Burns to put strong privacy and security technologies in the hands of individuals and businesses. CDT is also pleased that the Senator chose the Computers, Freedom, and Privacy Conference as a forum to announce this proposal. The choice of CFP demonstrates that the Internet community is becoming an increasingly important political constituency. CDT looks forward to working with Senator Burns and other members of Congress interested in policies which encourage the development and widespread use of strong privacy protecting technologies for the Global Information Infrastructure. FOR MORE INFORMATION For more information on the cryptography policy debate, including the text of Senator Burns' proposal when available, visit CDT's Cryptography Issues Web Page: http://www.cdt.org/crypto/ Contacts: Center for Democracy and Technology +1.202.637.9800 Daniel Weitzner, Deputy Director, <djw(a)cdt.org> Alan Davidson, Staff Counsel, <abd(a)cdt.org> ------------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.12 3/28/96 -----------------------------------------------------------------------

1 0

Re: Crypto CD
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

At 01:52 AM 3/24/96 -0500, Ben Holiday wrote: >I would plan to put unix/dos/mac all on one CD. I'm thinking that >realistically I can expect 50 megs or so. Possibly as much as 100 if I >find a TON of wonderful text. I burned one such CD this last fall. Oh, well, it wasn't for publishing, although I thought of that at the time. It was mainly to be able to move with me all my data when I switched positions. I included all the Cypherpunks archives, and several international FTP crypto sites in full (ya know, the italian, australian, english, pgp, etc... places). It was well over your "50 megs". And I would find that pretty more useful (if I hadn't it already). :-) Oh, I'm lying. I also did a "purged" version to remove duplicated packages first, when I didn't know if I would have enough sapce in the few CDs I had to burn in the few days I had left. I seem to remember that wasn't as big and maybe in the range that you mentioned. But it was compressed, and hence its usefulnes now is somewhat less since I have to expand everything if I want to get it. I was filling the CDs with other "important to me" stuff, and wanted to save space, but having the space available I don't see any reason not to expand the material. What I'd suggest is a compilation of all main archives, purged from duplications, rearranged rationally (I have it just in the original hierarchies) and all expanded for direct access. If you add to that executables for most packages compiled for a few popular platforms (Mac, PC, Linux and FreeBSD come to mind), I'd bet that you'd get a far greater amount of space. But that's a lot of additional work though. I know from experience. It might do for a very nice cypherpunk project. Although, there still remains the "trustfulness" of the product: how can the final user know that the sources, executables, key databases, etc... have not been tampered with? From the original archives one has the truth one poses on them, but from a copy, one needs to trust the copier. And if it became a multi-person project, all the people involved... But it's well worth a thought o two. If it helps you, my CDs are probing now invaluable to me. jr

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

os <os(a)cs.strath.ac.uk> writes: > >There is not a single foreign language I can think of it that would help me > >in my goals or help anyone I know. > > I have never known anyone being disadvantaged by knowing another language tha > tongue. Tim (and others) miss out the pleasure of using an exotic language in the presense of people who won't understand it. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Crypto CD
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:53 PM 3/27/96 -0800, Matthew Ghio wrote: >alano(a)teleport.com (Alan Olsen) wrote: > >>It would be a nice thing to have if it is reletivly complete. Hopefully it >>can be created with a minimum of government interfearence. (But then, I >>have been xpecting alt.binaries.crypto to be created as well...) > >alt.binaries.warez.crypto has existed for a long time (at least on Netcom), >although I haven't seen any posts lately. I suspect many sites deliberately >exclude alt.binaries.warez.* to save disk space. I notice that Netcom takes *EVERYTHING*. (Including the incredibly bogus and silly groups.) Teleport has never, to my knowledge, taken that group. Teleport has since removed all of the remaining warez groups in an effort of moral excess. (After taking all of the groups in existance, including the forign ones that nobody on Teleport reads, and claiming they did not censor groups.) Personally I could care less about the warez groups (it is not as if you could ever find a complete program), but the crypto one would have been nice to see... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: What backs up digital money?
by Hal 17 Dec '03

17 Dec '03

I have to disagree somewhat with a few points Mike made. I would say that gold and diamonds do have intrinsic value, based on their beauty and the desire of people to own them. I think it is too simplistic to denigrate these desires as the product of advertising. The feelings that people have which make them desire these things are as legitimate as other forms of desire. Along these lines, I think one of the factors which made gold and silver coins accepted as money was their intrinsic value. Even without being certain that another person would take the coin, a person might accept payment in such a coin because of its inherent value to him. Other early forms of money, such as beads or tobacco, also had intrinsic value in their time and place. One area I would agree with Mike is that these items may not always retain their value, since part of it is psychological. And as with any other commodity, if new supplies became available their value would fall. This might be especially pronounced with gold and diamonds since part of their value is due to their intrinsic rarity. Diamonds as common as glass would not be worth much more. (Of course, government money as common as paper is worth the same as well, as hard experience has taught us.) A particular issue of "digital cash" could be denominated or backed by anything the issuer thinks there is a market for. Gold backed digital currency would have certain advantages and disadvantages. Currency could be backed by a basket of commodities, or a synthetic average of several countries' currencies. You would not exchange your dcash for a bushel of wheat and a barrel of oil, but rather for dollars or pounds equal to the market value of these commodities. These and more elaborate possibilites are no more difficult to imagine than mutual funds or stock market index futures, not to mention the more complex synthetic investments. Hal

2 1

Re: Why Americans feel no compulsion to learn foreign languages
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Mar 27, 1:05pm, Rich Graves wrote: > Undeniably true. I think Tim's point was more, "Who cares? Everyone *I* > want to talk to speaks English." Maybe; & who someone talks to & how they do it is of no particular interest to me. However, he said something else: that foreign language speakers were unavailable to most Americans. This is easily shown to be false. That many other people in our English-speaking community also believe it is interesting. Often, they can provide counterexamples themselves without too much trouble (& you may recall that Tim May did). This says something about this culture. What, I don't know, but it's some kind of cognitive dissonance. It occurs to me that members of certain large language groups in the US, who don't speak English, sometimes make the same statement -- "Everyone I want to talk to speaks X". I don't know why this disclaimer is necessary, but please note that I don't think for a moment that you all are "bad" if your beliefs are in accord with what Tim May wrote. Nor do I think you should go out & learn some random language. > One may quibble with the wisdom or morality of such a statement, but if > the second statement is true in your case, then there is no reason you > should have to learn another language. Most upper-income Americans have no I'm not sure what the "second statement" is you're referring to. Anyway, there are a lot of reasons one might choose to study a foreign language, and many levels of fluency. There are many economic issues that could apply, & some non - economic arguments as well. There are very good reasons not to bother, as well.

1 0

Re: National speed limits and expansion of federal power...
by Chevelle 17 Dec '03

17 Dec '03

let me tell ya' I live in Central Texas and regularly use I-35, which was the primary highway considerd for the bill. The speed limits were raised to 75 mph at increments of every 4 to 5 miles. By that I mean the minute you pass the sign that says 75 with good eyes you can see the one up ahead that says 65 or 55 and you might even catch a glimpse of the state trooper parked beside it. I personally think its a joke and an inconvience, I was totally for the the bill as it was stated but this "red light, green light" game is very disapointing. Just goes to show the government still can't do anything right. Chevelle out.... At 06:52 PM 3/28/96 -0500, Deven T. Corzine wrote: >At 06:06 PM 3/27/96 -0500, Deven T. Corzine wrote: >>Actually, the national government didn't even *pretend* it had jurisdiction >>here. Instead, they used an indirect approach -- they passed laws which >>denied some of the existing highway funding to states with higher speed >>limits than 55 MPH. (Later this limit was raised to 65 MPH, given some >>additional restrictions such as proximity to population centers.) > >At 03:12 AM 3/28/96 -0500, Chevelle wrote: >>It was only months ago that they passed a bill raising alot of speed limits >>to the 75mph range. > >To be precise, Congress repealed the laws which had pressured states into the >55/65 MPH speed limits. Once this happened, a number of states either took >advantage of it immediately to raise speed limits, or are considering it... >Other states don't intend to raise the limits. In Montana, you can now drive >at *any* speed legally, in the daytime. So if you want to go 100 MPH, head to >Montana... :-) > >Deven > >

1 0

Re: WSJ on Big Java Flaw
by dmacfarlane＠zip.sbi.com 17 Dec '03

17 Dec '03

[snip] > > Mr. Felten said that unscrupulous people who discovered the > > flaw could boobytrap a Web page on the Internet, > > essentially seizing control of the browser software of any > > PC that tapped into that page. At that point, the hackers > > could read or delete an entire hard disk of data files. > > "The consequences of this flaw are as bad as they can be," > > he said.[..] > > The generalized halting problem comes to mind... > > Since it can be proved that there's no complete set of heuristics > to tell if a given program has a characteristic (such as "secureness") > then sooner or later someone will discover another security flaw. > > A question is whether a simple patch is made or if the set of heuristics > is widened (ie, learn from mistakes) so that similar flaws can be found > based on knowledge of that one flaw. Since this Java error is probably deep in the bytecode interpreter, the question is will Sun patch this *particular* problem, still allowing others, or will it have to rewrite the interpreter so that it enforces the language more rigorously? They are under pressure to make a "quick fix" (they've promised something in two days), but real security needs to be built in to a system from the ground up, with disciplline and thorough design. If they need to redesign their approach to implementing the bytecode interpreter, that could take weeks, months? BTW, its a testament to security through code review, as the Princeton team probably could not have discovered this deep flaw without looking through the code. David Macfarlane.

2 1