December 2003 - cypherpunks-legacy

Re: The return of the IPG Unbreakable System
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- No copy of this program has arrived in my mailbox, which is a good thing. I am no cryptography expert. Even _I_, however, see massive problems in letting _others_ generate my crypto-keys for me. If this egomaniac gets the respected experts on this list to review his software at no cost, & if the experts actually say, "he's right, it's unbreakable," the system will still have this weakness. This is even worse than the "Power One Time Pad" snakeoil. Am I missing something? JMR Regards, Jim Ray <liberty(a)gate.net> "The era of big government is over." -- Bill Clinton "Prepare for the era of _HUGE_ government." -- Jim Ray _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 -- http://www.shopmiami.com/prs/jimray _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMU8JKW1lp8bpvW01AQFK2gQAlxTZlfC9Dwx6nbbliSMxYqMp9Uvf9y0r ntFZfobQQ4OZsX0cNGDYIvwWMDztV+07d/seEqqEnGVvk8yFqcKPuFIo/WyFqxEc TqDzCp/i1XtndHDrfJb4hZDgizJKHXXrHO2dfuTecxS9uTgFvT3bUuTOfJme2hOx DNZz/Sm5rfs= =SaSo -----END PGP SIGNATURE-----

1 0

Mac Crypto Conference
by vinnie＠webstuff.apple.com 17 Dec '03

17 Dec '03

hey all; I am interested in putting together a Macintosh crypto conference for folks who do or want to write crypto on the mac. I was thinking about a one or two day thing..real tech stuff. (not so much the users), but I am flexable. I plan to hold it here at apple, cupertino. (so as to make it real cheep) If you have any ideas on what you would like to see there, either drop me an email, at <vinnie(a)webstuff.apple.com> or if you think it is worthy of a public discussion reply at cypherpunks. ------------- Vinnie Moscaritolo Apple DTS Sniper "One Shot..One Kill" http://webstuff.apple.com/~vinnie/ Fingerprint = 4F A3 29 81 50 E4 04 F2 78 25 01 87 6E A2 14 6A --------------

1 0

RE: Mac Crypto Conference
by vinnie＠webstuff.apple.com 17 Dec '03

17 Dec '03

hey all; I setup a mac-crypto mailing list at majordomo(a)thumper.vmeng.com the ususal: to: majordomo(a)thumper.vmeng.com subscribe mac-crypto will get you on board. I't purpose is to discuss the specifics of macintosh based cryptography, save the politics for cyhperpunks. my first topic of discussion is the idea of a mac crypto conference, here at apple, cupertino. I wsa thinking of a one day afair, a few sessions, mostly tech, open to the developer public. ------------- Vinnie Moscaritolo Apple DTS Sniper "One Shot..One Kill" http://webstuff.apple.com/~vinnie/ Fingerprint = 4F A3 29 81 50 E4 04 F2 78 25 01 87 6E A2 14 6A --------------

1 0

Re: Judge blocks French ISPs from connecting to revisionist sites
by Rich Graves 17 Dec '03

17 Dec '03

At 01:07 PM 3/18/96 +0100, Anonymous wrote: > >So that y'all can see what the fuss is about, try the following sites : A far better site that is not being censored is: http://members.aol.com/ironfrog/ubootwaffe/brown.html > Institute for Holocaust Revisionism > <a href="http://www.kaiwan.com/~ihrgreg"> This site is not blocked. Greg Raven is a serious Neo-Nazi wacko who took over the IHR by force. The police were called in to break up the fight, and the Nazis spent some time suing each other for control. See the Willis Carto/IHR FAQ for alt.revisionism. > Committee for Open Debate On the Holocaust > <a href="http://www.valleynet.com/~brsmith/"> This site is not blocked. The "censorship" page is full of events that never happened. Brian acknowledges that the errors I pointed out are errors, but complains that he "doesn't have time" to go back and correct them. He has had time, though, to add more events that never happened. See the URL below [sic]. See also http://www.stormfront.org/, which has widely been reported to have been "censored." It's not. That front page is just Don Black's idea of a joke. See http://www.stormfront.org/stormfront/, http://www2.stormfront.org/default.htm, and http://www3.stormfront.org/. The Nazis are quite well-connected. IHR uses AOL because they *want* to be censored so that they can play victim, and get more support from the otherwise reasonable people here. Even Steve Case knows this, which is why, uncharacteristically, he isn't booting them off. -rich http://www.c2.org/~rich/Press/Swedish/

1 0

FORTUNE666 - AOL postings blamed for Iomega stock troubles (fwd)
by Bruce Zambini 17 Dec '03

17 Dec '03

An interesting question of reputations, plus a kneejerk reaction against anonymity... "It must be true; I read it on AOL..." Jon ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA. ---------- Forwarded message ---------- Date: Sun, 17 Mar 96 23:42:34 From: FringeWare Daily <email(a)fringeware.com> Subject: FORTUNE666 - AOL postings blamed for Iomega stock troubles Sent from: sentry(a)utxvms.cc.utexas.edu () This may be of interest to lovers and haters of chaos, alike- >From Edupage: IOMEGA STOCK VOLATILITY BLAMED ON AOL POSTINGS Iomega, maker of high-capacity removable disk drives, is the focus of controversy on America Online's Motley Fool bulletin board. Company officials have complained to the SEC that postings on Motley Fool and other BBSs have contained false information and may be contributing to the volatility of its stock. Online exposure has "raised the visibility of some stocks as well as the interest in those stocks," says an outside spokesman for Iomega. "At the same time, we're very concerned about how online services can be used to attempt to drive stock prices higher or lower through misinformation." Postings about Iomega escalated to flaming and physical threats last month, causing Motley Fool to pull some of the more offensive ones, but critics of online BBSs note Iomega's problems are a result of the practice of using "screen names" and the lack of verification of information that's posted. "You don't know if the person is a Ph.D. or in Sing Sing," says one critic. (Wall Street Journal 15 Mar 96 A5C)

1 0

Re: The Leahy Crypto Bill is Rancid Sausage
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Excerpted from a message to fight-censorship. For the full thread, check out: http://fight-censorship.dementia.org/fight-censorship/dl?thread =The+Leahy+Crypto+Bill+is+Rancid+Sausage&after=1795&type=short (On one line, of course.) -Declan ---------- Forwarded message begins here ---------- From: Stanton McCandlish <mech(a)eff.org> Message-Id: <199603190315.TAA05777(a)eff.org> To: declan+(a)CMU.EDU (Declan B. McCullagh) Date: Mon, 18 Mar 1996 19:15:09 -0800 (PST) Cc: fight-censorship+(a)andrew.cmu.edu, junger(a)pdj2-ra.F-REMOTE.CWRU.Edu, tcmay(a)got.net [...] As our statement on the bill made clear, *EFF does not support the Leahy bill*, nor do we endorse it, like it, find it useful or any other synonym. We're happy to see the issues raise again, a la Cantwell, but we specifically recommended simple and complete deregulation. As our co-founder John Gilmore points out, the Leahy bill as written pre-supposes Congressional authority to legislate in this are, and Executive authority to regulate under that legislation. These are notions that we, and Phil Karn, are challenging in court with Constitutional tests we are throwing at the ITAR export regs. [...]

2 1

If you can't take the heat... (Was Re: Keep the pressure!)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 12:05 PM 3/20/96, Perry E. Metzger is rumored to have typed: > anonymous-remailer(a)shell.portal.com writes: > > Some people have wondered why I am anonymous and attack me. > > I am not ashamed of my views. > > Well, then you should be. > > > I write this thread anonymous as a form of protest. > > Why is it a form of protest? If you aren't ashamed, post it under your > name. What amuses me most about this series of rantings by whomever, other than the paranoid and baseless claims made by the anonymous poster, is the number of people who have been complaining about the author doing so anonymously through a remailer. The irony of such a situation is too rich to pass up. It seems that cypherpunks can dish it out when other newsgroups and mailing lists suffer such problems ("well, the remailers do nothing that telneting to port 25 cannot do..." or "internet identity is such a fiction anyway, get used to it" seem to be common responses), but when the cypherpunks lists is the victim of unpleasant anonymous messages we fall back to the tired refrain of "if you have nothing to hide why are you posting anonymously." How sad. So, why the hypocrisy here? If you don't want to be bothered by these messages there is a simple solution, use a mail agent that can filter out remailer postings and trash them. Of course this would also kill interesting messages from others who use remailers, but that's the price we pay for having remailers that do not support anonymous identity upon which reputation can be built. Oh yeah, I forgot...cypherpunks write code (snicker). So why not stop bitching and write a bit of code that provides for useful anonymous reputations and/or fix the glaringly obvious problems with current remailers. jim, who is sorry that he is not the one posting such trolls to the list just to make the puppets dance...

3 2

ANNOUNCE: Donut: Web Basic Interpreter. (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

I just received this as the moderator for comp.os.ms-windows.announce. Would that be "Donut" as in "big hole"? -rich ---------- Forwarded message ---------- Date: Wed, 20 Mar 1996 19:56:54 +0000 (GMT) From: Michael Burford <mj_burford(a)pnl.gov> To: comp-os-ms-windows-announce(a)cs.washington.edu Newgroups: comp.os.ms-windows.announce Subject: ANNOUNCE: Donut: Web Basic Interpreter. ----------------------------------------------------------------------------- Richland, WA. March 20, 1996. Battelle Memorial Institute today released Donut (1.00 Alpha 1), a Visual Basic form Interpreter for the Web. Donut is a program that allows a Visual Basic form file to be transmitted over the internet and viewed on a user's computer as a form. This form will then interact with the user and their web browser to send or request information just like a normal Visual Basic program. Donut does not require any Visual Basic files or DLLs in order to work. This will allow creation of web forms that give the author more control over exactly what the form will look like, allows interaction between the Donut applet and the user's browser, and allows processing of form information on the user's computer instead of on the server. And it allows you to use existing expertise with the very popular and common Visual Basic programming language to do so. Currently Donut is available for the Microsoft Windows operating system (Windows 3.x, Windows 95 or NT). It works with any Windows web browser that supports the standard interprocess (DDE) communication for web browsers. It has been tested and works with Netscape Navigator, Microsoft Internet Explorer, and several variations of Mosaic. Donut should be able to run most simple Visual Basic programs with few if any modifications. (Unlike VBScript where you must now cut and paste the source code into a HTML page.) Donut is available without charge to end users. For more information or to obtain Donut and development information: http://apc.pnl.gov:2080/donut/ Microsoft, Windows and Visual Basic are trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners. -----------------------------------------------------------------------------

1 0

Re: A MODEST PROPOSAL
by Brad Shantz 17 Dec '03

17 Dec '03

Sandy SandFort wrote: > A CYPHERPUNK CALL TO ARMS!!! > > (Did I get the style right?) C'punks, if you feels as I do, > please take a few moments to sign up for the LIST OF SHAME? > Let's show Bill, Bruce, Matt and all the others what most > Cypherpunks really think about them and Mr/Ms Anonymous. This effectively gets the right point across, but might turn Cypherpunks into a USENET newsgroup mass posting of "me too" sentiments. As I agree with Sandy on every point, I reluctantly choose to start.... "Please add me to your list of shame, Mr. Anonymous." Brad Shantz

1 0

IPG and "Free Samples"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:42 PM 3/20/96, Michael Froomkin wrote: >correct me if I'm wrong, but don't the federal direct mail marketing laws >say that any unsolicited merchandise sent to a person becomes their >property, regardless of any disclaimers to the contrary included in the >package? The _physical_ item, e.g., a box of soap or a free copy of "Newsweek," but presumably not the _intellectual property_, e.g, the contents of "Newsweek." (Just because I get free samples of magazines does not mean I now can do with the contents whatever I wish, such as post them on the Net; copyright law is presumably involved.) This may be more analogous to what IDG has done. Disclaimers: IANAL, I am not defending IDG or their "broken in less than one day" tub of snake oil, nor am I defending copyright and direct mail marketing laws. And I might be wrong about the intellectual property issue, though I doubt it. Copyright laws are such that rights are not waived even if free samples are given out, and so forth. IDG can hardly claim their algorithm has trade secret status when they've distributed it to many people. Which leaves them with only trying to enforce copyright protections, a la the Church of Scientology. Maybe IDG will now seek to collect the only bucks they'll ever get by suing various Cypherpunks who are distributing their so-called system? Helena Kobrin can become their lawyer. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

NT's C2 rating
by Brad Shantz 17 Dec '03

17 Dec '03

I have been working for some time on a project that involves doing proactive file authorization/authentication under Windows NT. In the process, I've been working on an extension to the Kernel layer of the operating system because we need to be able to catch read/writes to the disk. (All perfectly legal according to the DDK, just ot documented worth a damn.) All of this is designed to work directly with the functionality given to us by the NT-Security layer. Basically, I'm now questioning the C2 rating of Windows NT. The entire security layer is modular to the Kernel. As a modular driver, it can be removed, rewritten, and replaced. So, what makes it secure? What gives it the C2 Rating? How would one go about getting a C2 rating? Brad

2 1

What's wrong with this picture??
by Michael Peponis 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- From: <Deleted to protect the guilty> To: anonymous-remailer(a)shell.portal.com Copies to: cypherpunks(a)toad.com --------------------------------------------------------------------------- Look above, note the "To:" Field, hmmmm, the offending l party mailed a responce to an anon remailer. I have noticed a couple people do this latley. Please people - THINK, you have just proved beond a shadow of a doubt that you are crypto illiterate. The message is not sent back to the origional sender, it is either qued in the remailer's In basket, till the remailer administrator cleans it out, or it is trashed upon reciept since it does not have the required Request-Remailing-To: format. *sigh*, I will spare the offending parties the well deserved "Come back when you get a clue" flame. Regards, Michael Peponis PGP Key Avalible from MIT Key Server

1 0

Re: The return of the IPG Unbreakable System (fwd)
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 1:24 AM 03/20/96, IPG Sales wrote: >Perhaps a battle has been lost, maybe even probably? But the war is not >over, not by a long shot - with minor modifications this system is >absolutely secure as events will prove. However, be assured that we >will not sell our product to anyone until that can be definitively >established. We greatly appreciate the contribution of some of those on You used to claim "our system is absolutely safe, we're sure of it, but we can't tell you the algorithm cause it's secret." People said that was stupid, so you finally agreed to show people the algorithm (apparently sending it to them unsolicited, and then expecting them to be bound to some sort of non-disclosure agreement? You might want to hire a lawyer to familiarize you with how trade secrets work legally, cause they don't work like you think they work). The people you showed the algorithm to pointed out flaws in it. Now you say "Yeah, okay so there were flaws, but we'll fix them and then it will be perfect, except you can't see the code or algorithm cause it's secret." Sounds like we're back where we started, eh? No one was willing to trust the algorithm before without it being reviewed publically. No one will be willing to trust it now either, _especially_ after the previous concerns that the algorithm wasn't secure were _confirmed_. The cypherpunks list doesn't have to provide free cryptanalysis to you. I doubt anyone will want to waste their time looking at future iterations of your algorithm, if you deign to show it to them. The fact that people on the cypherpunks list don't want to waste their time doing free cryptanalysis for you doesn't mean that your code is secure, or endorsed by anyone. It means that even those who may have thought it possible that your algorithm was secure after all have given up on that thought, or at least decided that it's unlikely enough not to be worth much further consideration, at least until you start behaving reasonably.

1 0

CDA court challenge begins tomorrow
by Declan McCullagh 17 Dec '03

17 Dec '03

Read on for more information on the details of the court challenge. I'm very happy to know that Donna Hoffman and Howard Rheingold will be testifying. They and other ACLU/CIEC witnesses and plaintiffs have been deposed by the DoJ over the last two weeks in Washington, DC. During the weeks separating the two sets of hearing dates, we will be deposing witnesses that the DoJ plans to call. I would expect those witnesses to dispute, among other things, the effectiveness of filtering software and other forms of indecency-blocking. -Declan // declan(a)eff.org // I do not represent the EFF // declan(a)well.com // March 20, 1996 _________________________________________________________________ News from the ACLU National Headquarters ACLU V. RENO: Background Briefing Three-Judge Panel to Hear ACLU Testimony in Landmark Challenge to Internet Censorship Law PHILADELPHIA, PA--Beginning tomorrow, a three-judge panel in federal district court in Philadelphia will hear testimony in the consolidated cases of ACLU et al v. Reno and American Library Association et al v. Reno, the landmark challenge to censorship provisions of the Telecommunications Law of 1996. Free speech in cyberspace is at stake as the first major legal challenge to censorship on the Internet gets underway. The case began when the ACLU filed a motion for a temporary restraining order against indecency provisions of the Telecommunications Bill immediately after it was signed into law by President Clinton on February 8. The suit challenges provisions of the law that criminalize making available to minors "indecent" or "patently offensive" speech. Acting on behalf of 20 individuals and organizations that provide information via the Internet -- including itself -- the ACLU said it was moving quickly because it feared that the telecommunications legislation would have an immediate impact on the Internet. Following this action, a second legal challenge was filed on February 26 by a coalition of more than 20 corporate and trade organizations known as the Citizens Internet Empowerment Coalition (CIEC). The CIEC suit, organized by the American Library Association, America Online and the Center for Democracy and Technology, was formally consolidated with ACLU v. Reno. The CIEC lawsuit, which addresses essentially the same issues as the ACLU challenge, further illustrates the broad spectrum of individuals and organizations that would be affected by the censorship provisions, and strengthens the case for a finding that the law is unconstitutional. The Court Case According to procedures laid out by the judges, direct testimony in ACLU v. Reno is to be submitted via affidavit. During the three days of testimony allowed, which will take place over March 21 and 22 and April 1, lawyers for the Department of Justice will cross-examine coalition witnesses, after which lawyers for the ACLU and ALA coalitions will have an opportunity to redirect, i.e., question their witnesses in response to the government's cross-examination. In preparation for the case, lawyers for the Department of Justice have been deposing all the ACLU and CIEC witnesses it may choose to cross-examine. So far, government lawyers have declined to cross- examine only two witnesses: Christine Soto and Hunter Allen, teenagers whose affidavits attest to the importance of uncensored access to the Internet by minors. The government is scheduled to present its witnesses for cross- examination on April 11 and 12, 1996. A fourth day of testimony has been scheduled for April 26, to allow the ACLU and ALA coalitions to present witnesses rebutting the government's testimony. Following these six days of trial, the judges will issue a ruling. Depending on the outcome, either side may seek an appeal to the U.S. Supreme Court. The Witnesses Thursday, March 21: --Scott O. Bradner, senior technical consultant, Information Technology Services, Harvard University (ALA) --Ann W. Duvall, president, SurfWatch Inc. (ALA) --Patricia Nell Warren, author and publisher, WildCat Press (ACLU) Friday, March 22 --Donna Hoffman, associate professor of management, Owen Graduate School of Management, Vanderbilt University (ACLU) --William Stayton, psychologist and Baptist minister (ACLU) --Robert B. Cronenberger, director, Carnegie Library of Pittsburgh Professor (ALA) --Kiyoshi Kuromiya, director, Critical Path AIDS Project (ACLU) Monday, April 1 --Howard Rheingold, author and cyberspace expert --Barry Steinhardt, associate director, ACLU --Stephen Donaldson, Stop Prisoner Rape (*Note: schedule is subject to change) Chronology February 7 -- At a news conference in Washington, D.C., the ACLU announces plans to seek a temporary restraining order against indecency provisions of the Telecommunications Bill immediately after it is signed into law by President Clinton on February 8. --The ACLU announces the launch of its new "Freedom Network" World Wide Web site, <http://www.aclu.org>, with a home page declaring, "Keep Cyberspace Free." Over 200,000 hits are recorded in the first 48 hours of the launch. February 8 --The ACLU files its legal challenge in federal district court in Philadelphia before Judge Ronald L. Buckwalter. -- In the first court action over the constitutionality of the Communications Decency Act , Judge Buckwalter directs the government to refrain from prosecuting for so-called indecent or patently offensive material online until the motion for a TRO is decided. -- The judge instructs the government to file a reply brief to the ACLU's request for a TRO within one week. --Government lawyers conceded that the abortion speech restrictions of the CDA are unconstitutional. February 15 -- Judge Buckwalter grants a temporary restraining order on the indecency provisions of the Communications Decency Act, and denies the TRO motions on prosecution for "patently offensive material" and on the "Comstock Law" abortion speech provisions of the CDA. --A three-judge panel is convened to hear the case: Chief Judge Dolores K. Sloviter, Judge Stuart Dalzell, and Judge Ronald L. Buckwalter. February 21 --More than 5,000 visitors to the ACLU website use the "instant action" feature to e-mail or fax Attorney General Janet Reno, urging her not to prosecute under the new law. February 23 -- ACLU announces that government lawyers have agreed not to initiate investigations or prosecute Internet "indecency" until three-judge court rules on the case. --Hearing dates set for the case; the ACLU will present its evidence on March 21 and 22, with April 1 reserved. The government's dates are April 11 and 12, 1996. The total trial is scheduled to last five days. February 26 --More than 20 corporate and trade organizations, known as the Citizens Internet Empowerment Coalition (CIEC), initiate a second legal challenge to the Communications Decency Act. February 27 --The CIEC suit, organized by the American Library Association, America Online and the Center for Democracy and Technology, is formally consolidated with ACLU v. Reno. March 21 --Trial opens at 9:30 a.m. in the ceremonial courtroom in federal district court in Philadelphia. ### Contact: Emily Whitfield, (212) 944-9800 ext.426 _________________________________________________________________ Media Relations Office 132 W 43rd Street, NYC 10036 (212) 944-9800 ext. 414

1 0

If I were the NSA...
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

If I were the NSA, I would start threads such as the one on the IPG system. They are very valuable to them in assessing and mapping the cryptanalysis capabilities of the CPunks lurkers and regulars members. Just a thought... JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.alias.net> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono nymrod) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 18 Mar 96 6:46:10 PST remailer email address history latency uptime ----------------------------------------------------------------------- ecafe cpunk(a)remail.ecafe.org ##-++####### 3:40 100.00% alpha alias(a)alpha.c2.org ++++++++++++ 50:30 99.99% exon remailer(a)remailer.nl.com *-*++--++*** 18:54 99.99% portal hfinney(a)shell.portal.com ##-**#*#-**# 11:12 99.99% haystack haystack(a)holy.cow.net +#-+-**##**# 6:30 99.99% pamphlet pamphlet(a)idiom.com --+-------++ 5:49:56 99.98% nymrod nymrod(a)nym.alias.net **-++*****+* 8:47 99.98% flame remailer(a)flame.alias.net -----------+ 4:03:33 99.97% hacktic remailer(a)utopia.hacktic.nl **-++******* 13:46 99.97% replay remailer(a)replay.com **-++***+*** 10:42 99.97% mix mixmaster(a)remail.obscura.com . - *--...+- 21:59:57 99.97% c2 remail(a)c2.org -+*++++-++++ 44:35 99.96% tjava remailer(a)tjava.com ###++####### 1:08 99.96% vishnu mixmaster(a)vishnu.alias.net **--+*+*--++ 53:01 99.94% nemesis remailer(a)meaning.com -+-+ **+**** 36:11 99.86% gondolin mix(a)remail.gondolin.org .__.-----.- 9:38:20 99.66% gondonym alias(a)nym.gondolin.org .__.-----.. 9:42:41 99.63% extropia remail(a)extropia.wimsey.com .-.-+-+---- 11:49:50 99.57% shinobi remailer(a)shinobi.alias.net **#++##-+#++ 6:52 99.53% lead mix(a)zifi.genetics.utah.edu ++ ++ +*+++ 35:26 99.39% vegas remailer(a)vegas.gateway.com ** +-- * *** 15:07 99.36% alumni hal(a)alumni.caltech.edu ** ++# *-+## 1:34:05 98.76% amnesia amnesia(a)chardos.connix.com +--- 2:30:51 97.82% treehole remailer(a)mockingbird.alias.net ---- -++-+ 2:50:06 96.47% penet anon(a)anon.penet.fi _-._.. _.. 38:20:41 95.24% spook remailer(a)spook.alias.net **-+-**- + 46:36 93.05% ncognito ncognito(a)gate.net ##* 1:21 87.38% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

No Subject
by Gary Lee Jeffers 17 Dec '03

17 Dec '03

>From STRATEGIC INVESTMENT March 20, 1996 Strategic Investment 1217 St. Paul St. Baltimore, MD 21202 It is published monthly for US$159 per year for U.S. residents (C$190 for Canadian residents and US$200 for other non-U.S. residents). behind the lines - by Jack Wheeler Is the IRS a paper tiger? One definition of a pioneer is a guy with an arrow in his back. So notice the above headline is a question, not an assertion. But it is nonetheless a question being asked by a lot of folks these days, from Bill Archer, Chairman of House Ways & Means, to a number of smart tax attorneys. The federal tax code has mutated into this gigantically in- comprehensible Rube Goldberg monstrosity that day by day gets closer to collapsing under its own weight. Couple that with the fact that the IRS computer system is about to go belly up. The IRS originally computerized itself AD HOC, with the regional centers getting various platforms and software that can't communicate with each other very well. The agency has now spent over $8 billion on the TSM project to re-computerize, which an independent review recently concluded is a colossal failure. As the IRS teeters on the brink, a fellow named Eddie Kahn has stepped forward and may be about to push the whole creaking mess over the edge. He hasn't got an arrow in his back yet, so he might just succeed. Dis- dainful of "tax protests" such as 5th Amendment or legal tender arguments that quickly get their advocates behind bars, Eddie looked into the stru- ture of federal law. When Congress passes a law, codified as a statute, it then delegates to a regulatory agency the authority to issue the im- plementing regulations specifiying to whom and under what circumstances the statute applies. These regulations must, by law, be published in the Federal Register. Lacking these implementing regulations, the law cannot be applied and has no force. Well, it turns out that the implementing re- gulations for IRS' enforcement statutes-things like the requirement to file a tax return and the authority to place a lien-cannot be found in the Federal Register. When queried on this, the General Counsel for the Office of the Federal Register, Michael White, replied in writing, "Our records indicate that the Internal Revenue Service has not incorporated by reference in the Federal Register a requirement to make an income tax return." This is starting to get interesting, isn't it? And yes, I see that big smile on your face. If Eddie is right, the IRS has no assessment autho- rity, no collection athority to enforce a lien or seize property, no au- thority to pursue criminal penalties for failure to file a return or make a false/fraudulent return. I am not at all suggesting you be a pioneer. But if you should have any difficulty with the lovable folks at the IRS, you might consider making an appointment to see them in person at their nearest office, and tell them face to face that you need to see a copy of the implementing regs published in the Federal Register that show they have the authority to require you to do what they want. Not one of the close to a thousand people who, following Eddie's advice, have done so received a copy-and not one has been further harassed. Better to let these folks drop out of the system quietly than risk a negative decision in court, which would be for them an ultimate catastrophe. You can get more info from Eddie at: 1-800-419-7512. --------------------------------------------------------------------- PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCK! BBBEEEAAATTTT STATE! Gary Jeffers P.S. This reminds me of something else that I read a few months ago. There is a book with the title The Law that Never Was - the 16th Amendment (this was the title or close) that had a similar affect on the IRS. I believe it was the SPOTLIGHT that said that when the then Commissioner of the IRS found that the book was published, he gave gave instructions that people citing the book in arguments with the IRS be left alone. The 16th Amendment created the IRS.

1 0

No Subject
by mixmaster＠vishnu.alias.net 17 Dec '03

17 Dec '03

ipgsales(a)cyberstation.net wrote: >Those of you who have had all of the materials will understand the >foregoing. With the information provided heretofore, you can determine >the effect on the other two systems. Also, those people will know my >expressed fear of a premature announcement, such as that which has >now been made, would have. This was the reason, that I resisted >so strongly the release of the materials to the C'punks list >though a few of you recommended that I do so. Perhaps we should have >released everything? Who knows. However, in any case, that is water >over the dam and IPG must go on from here. It is only another of the many >mistakes that we will undoubtedly make along the way. > >Having said that though, we must go back to our prior >evaluation method, a strict confidential mode. However, I believe that we >have added several very good additional people who can help to analyze >the system. English translation: We didn't want to release our algorithm because we were afraid somebody might find a weakness. Sure enough, somebody did. So I guess we're going to keep it a secret after all. Hey, kids, security through obscurity just doesn't work.

1 0

Re: Would the FTC crack down on snake oil someday?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 19 Mar 96 at 19:10, Bill Stewart wrote: > Sure, they'll be happy to, if we really want. The NSA will advise them > on what's good crypto, and what's snake-oil. Certainly any system that > didn't provide for back-up key access doesn't rate...... > > No, I didn't think you wanted that either.... Maybe the NSA will advise them, maybe not... since there is a conflict of interest (not unusual in regulatory circumstances, though). Then again, it would be awkward if the NSA hypothetically said product A is crap and product B is secure but non-NSA people said differently, esp. if the NSA wouldn't let product A be exported. They're a governmental organization, with all the flaws of any organization/bureaucracy, let alone the government. So yes, I've pondered them asking the NSA for advice... but keep in mind it puts the NSA in a double-bind, because they aren't the only experts, and because they'll look bad if they contradict themselves. They (FTC) might go by something different, though. If a company claims their product uses an "unbreakable cipher" when there are cracking programs (commercial or free) available, then obviously its false advertising. Indeed anything that advertises itself as "unbreakable" is a lie. There's also other consumer groups that are non-governmental, like Consumer Reports, PIRGs, and even various state and county consumer advoctates who won't tow the federal line (look at bovine growth hormone for one example... hm, maybe a bad parallel.) Part of it is a public learning curve. After a while more people (though not enough to eliminate snake oil's market) will recognize "PGP", "RSA", 'IDEA", "3DES" and other strong algorithms. (Ascom Tech could do themselves a nice turn by pushing for products with "IDEA Inside" type of messages...) Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Spare CFP '96 student reservation
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

A friend of mine registered as a student for the CFP '96 conference next week, but is unable to go. Registration is transferable, so he can send another student in his place. If anyone is interested, please mail him (not me) at tew2(a)cornell.edu.

1 0

Mr Emmett Page, Asst. Sect. Defense, CCCI
by Tim Fulbright 17 Dec '03

17 Dec '03

I think you or someone here recently remarked the U.S.Government has the only _real_ capability to wage world terrorism on the internet, and after I read Frank Sowa's feb. Boardwatch article I'm beginning to wonder. I suppose quoting the article at length will be at least as good as some of the other traffic around here... just in case anybody missed it, Sowa reviewed 35 federal reports, and quotes Page saying "As a result, we've had no choice but to create an offensive capability in cyberspace. I can't discuss it ... However, you'd feel good and feel safe and secure if you knew about it" (yeah, really) Further, Sowa reports the Natl Defense U is forming an elite Information Corps, 'a F0rce whose scope is to fight the battles of "Information Warfare from the Pentagon war room to the home PCs" according to DOD' (p90-92).... And further, RAND corp is using an "all out cyberwar simulator at their research center in Santa Monica" and... oh well, the whole article is just crammed with stuff! Yikes! I would sure like to know what people think about it. thanks.

2 1

Re: The return of the IPG Unbreakable System (fwd)
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:24 PM 03/19/96 -0600, you wrote: ... <sniveling excuses deleted> ... >Accordingly, this will be the last letter posted to the entire >cypherpunks list for the time being. If any reader posts something to the >entire Cypherpunks list, do not expect any response to from IPG, there >will be none. Thank you, thank you, thank you! (see? there *is* a God!) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU7xkcVrTvyYOzAZAQGCSAQAj3wI2g4R6W8/iEhRaYn1y3SwfhS5g2UT 0BpdsUqNbJXA3Qbj4OlrT2SSWp7Glm4uymlJVM1AjXo36Jjo3XTZilMeTaVed5DW idH8gfV/Wp6DJIPv3RqwtYysBur1pXgqmsEIEovIHhY7uP5yhW7JJL2NrZ/Dht4T 3DvZ/On3cdk= =+acg -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by jim bell 17 Dec '03

17 Dec '03

At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: >I may have to adjust my position on Leahy's bill. Any legislation that >Dorothy Denning attacks so virulently must be worth passing. That position would be a serious mistake. Denning knows that she is a negative barometer: Her position will be looked on with contempt by most of us. That, ironically, makes her "useful" to the government should they want to sneak one past us. I think we've already established that this bill sucks, although it could become good with major repairs. Problem is, nothing that Denning wants to do to the bill constitutes an improvement, except not passing it in the first place! ----------------------------------------------------------------- > >Date: Tue, 19 Mar 96 14:53:35 EST >From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >To: farber(a)central.cis.upenn.edu > March 14, 1996 > >The Honorable Patrick Leahy >United States Senate >Russell Building, Room 433 >1st and C Streets, NE >Washington, DC 20510 > >Dear Senator Leahy: > >As author, scholar, lecturer, researcher, and consultant to the >government and industry in cryptography and information security, I am >concerned that S.1587, the "Encrypted Communications Privacy Act of >1996," is not in balance with society's needs. By removing practically >all export controls on encryption, the bill will make it far easier for >criminals, terrorists, and foreign adversaries to obtain and use >encryption that is impenetrable by our government. "Far easier"? That's an odd statement, because the export of encryption is easy with or without restrictive laws. How much trouble is a "criminal or terrorist" going to risk by violating a few measly export laws? Besides, Denning hasn't established that encryption will be any better inside the country than without; this means that export controls will have no effect even in the most optimistic scenario. >The likely effect >will be to erode the ability of our law enforcement and intelligence >agencies to carry out their missions. Since when is this news? Freedom costs. But it also pays. > This is not consistent with your >own findings in the bill which recognize the need for a "national >encryption policy that advances the development of the national and >global information infrastructure, and preserves Americans' right to >privacy and the Nation's public safety and national security." > >I am concerned that the proposed legislation responds only to a loud >cry for assistance and is not the reasoned and practiced position of >our multinational corporations. Of what significance is the "practised position of our multinational corporations"? They'd sell us out if it preserved THEIR rights. I'm more concerned with the rights of the individual. > At the International Cryptography >Institute, which I chaired in September 1994 and 1995, our discussions >did not find that this unrestricted distribution of encryption >technology was required to satisfy business objectives. Notice that we've already established that this bill in no way produces an "unrestriction distribution of encryption technology." Wish it did, but it doesn't. [much Denning-crap deleted] >The Commerce/NSA study did acknowledge that the existence of foreign >products claiming strong encryption could have a negative effect on >U.S. competitiveness. However, by allowing encryption services to be >sold separately from the applications software that uses them, CAPIs >will make it extremely unlikely that general-purpose software will be >substantially effected by export controls. That's odd. Most people around here seem to be of the opposite opinion: CAPI's seem to be used by the government to justify controls even on software that has no encryption capability. Even security-specific >products, which are a growing industry, can use CAPIs to separate out >the encryption component from the main product (e.g., firewall). >Moreover, if keys can be held in other countries under appropriate >bilateral agreements as noted earlier, export controls need not >substantially impact encryption products. Notice that she seems to be making policy for the government, yet again. > >Export controls are often blamed for the lack of security in our public >infrastructure. The Commerce/NSA study found "little evidence that >U.S. export controls have had a negative effect on the availability of >products in the U.S. marketplace," although they "may have hindered >incorporation of strong encryption algorithms in some domestic >mass-market, general-purpose products." There are many factors which >have played an even larger role in the general lack of security we find >on the Internet: the high cost and low demand for security, the >difficulty of designing systems that are secure, pressure to bring new >products to market before their security implications are understood, >the willingness of users to take risks in favor of acquiring new tools >and services, and lack of a public key infrastructure to support >encryption on a national and international basis. Many systems are so >riddled with security holes that any would-be attacker can gain access >to the system itself, and from there access to plaintext data and >keys. Malicious code can be injected into a victim's system through >electronic mail, documents, images, and web browsers; once there, it >can transmit sensitive data back to its owner. Keyboard sniffers can >capture a user's keystrokes before they are ever encrypted. Thus, >while export controls have played a part in the slow integration of >strong encryption into software and systems, they are not responsible >for most of the security vulnerabilities we see today. Moreover, most >of these vulnerabilities are remedied with non-cryptographic controls >(e.g., process confinement, trusted systems engineering, biometrics, >and location-based authentication) or with cryptographic techniques for >authentication, data integrity, and non-repudiation, which are exempt >from State Department export controls. I do not mean to suggest that >encryption is not important. In fact, it is essential to protect >against certain threats. However, it must be kept in perspective. The >use of encryption for confidentiality protection is but one small, >albeit important, piece of an information security program. > >The provisions is S.1587 regarding trusted key holders could have the >benefit of increasing public trust in key holders. However, I have >some concern that the current provisions may be overly restrictive. >Thus far, we have practically no experience with the operation of third >party key holders and the circumstances under which they will be called >upon to provide keys or decryption assistance. It will be extremely >important that the provisions allow enough flexibility to accommodate >legitimate use of the data recovery services of key holders for >criminal investigations, civil litigation, and intelligence >operations. The liability risks to key holders should not be onerous. >The definition of key holder and exact wording in the bill may also >need some refinement in order to accommodate existing and proposed >methods of trusted third party encryption. > >Encryption policy is a difficult and often emotional issue. It's only emotional because of malicious and counter-productive efforts by government, and government suck-ups like Denning. It is >important that Congress work closely with the Administration, industry, >and other interested parties to develop the best legislative strategy >for promoting information security on the national and global >information infrastructure without diminishing the ability of our law >enforcement and intelligence agencies to protect the public safety and >national security. Export liberalization should proceed cautiously, >tied to key escrow or other methods that accommodate the needs of the >government as well as those of users and industry. The >Administration's plans to liberalize export controls on software key >escrow is a good next step. As trust and confidence in key escrow >grows, the export of virtually unlimited strength encryption systems >may be possible. Because export controls are our only lever for >controlling the spread of encryption, they should be used to their full >advantage. Decisions to liberalize these controls must be fully >informed by classified national security information as well as by >economic analysis and market studies. > >Law enforcement agencies are encountering encryption with ever greater >frequency. Excellent! It means they're being held back! > Within a few years, the successful execution of practically >all court-ordered intercepts and searches and seizures is likely to >depend on their ability to decrypt communications and stored >information. If the encryption cannot be broken, it could be >impossible to successfully investigate or prosecute those cases. Bullshit! [more Denning-shit deleted] >I will be pleased to meet with you and the committee for comment and >questioning, or to assist in any way I can with the development of a >balanced approach to encryption legislation. > >Yours respectfully, > >Dr. Dorothy E. Denning >Professor of Computer Sciences >Georgetown University >denning(a)cs.georgetown.edu >http://www.cosc.georgetown.edu/~denning I refuse to be used by Denning. If we make the mistake of supporting this bill merely because she claims to oppose it, we would merely be falling into her (and the government's) trap.

1 0

RE: Microsoft's "answer" to Java
by Blake Coverett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Commenting on a quote from a magazine about MS's new code-download/wintrust stuff Alan Olsen wrote: >As a web developer, I have some problems with this scheme. Giving Microsoft >access to virtually every OLE control on the Web does not make me more >secure. Sounds like a way to rip off ideas from the rest of the development >world. If someone has a control that might compete with a Microsoft >product, it could be shelved and/or delayed for "further security testing". I think you've been badly misled on this one. I've just been through all of the related specs from the MS INetSDK. While they are still incomplete in places, they look pretty workable to me. In particular the certainly don't suggest that MS would be involved in signing anything. To quote from the beta docs: The present tools therefore allow any user of this development release to authorize themselves as a "Software Publisher" for test purposes and to sign their code, allowing for extensive testing of the tools and code used but not actually providing a secure infrastructure. In future releases, the tools will require software publishers to obtain certificates from companies whose function is to verify the identity of the publishers, providing end-users with a high level of assurance about the authenticity and origin of code that they receive. >Java has a decentralized mechanism for security. No one group controls what >is a "certified" control and what is not. You write the code and compile it >and that is that. Furthermore, you are not stuck with Microsoft approved >platforms. (I wonder if there will ever be a version of Explorer for the Mac.) The current version (2.0) is already available on the Mac and the 3.0 alpha versions appear to be about equally buggy on both the Win32 and Mac platforms. (I haven't, on the other hand, heard any news of Unix versions. Perhaps Bristol and/or Mainsoft will cover that port.) ================ Here's my quick overview of the specifications in question for those interested. Microsoft is providing the following components: - - A generic trust management called (ever originally) WinTrust. WinTrust provides an API to ask whether a given subject is trusted to perform a specific action. The API is extensible in that multiple 'Trust Providers' can be installed and each can define the types of subjects and actions they manage. The docs define the role of a 'Trust Administrator' who can configure the rules used by the trust provider services be neglect the give the details. - - An implementation of a trust provider called the 'Windows Software Publishing Trust Provider' This provider supports subjects which are executable images and the action of 'being published software'. The decision to trust is based on a PKCS #7 embedded within the executable containing a signed digest from the author and a chain of X.507 certs back to some configurable set of CAs. If the executable is not verified the user is prompted with the offer to approve it manually. - - A set of developer tools for creating your certificate and signing executables. Note that the beta includes a hard-coded root CA key and all certs must trace back to it. The existing library for munging executable images has also been enhanced to support adding, removing, enumerating and retrieving certs from an image as well as reading the stream that should be included in digest calculations. - - A single function solution for browsers and other applications to download, verify, install, and create a class factory for an OLE object given an URL. In the web case the HTML <OBJECT> tag is used to embed an OLE object in a page. The browser tries to create it based on the CLSID attribute (which contains a DCE-ish uuid.) If it fails it calls CoGetClassObjectFromURL() passing in the URL from the CODE attribute of the same tag. This function does all the magic including the WinTrust call from above. (Apparently there will also be support for an 'Internet Search Path' if the CODE attribute isn't specified.) Then of course there is the MS CryptoAPI but that's a discussion for another day. - -Blake (who hasn't worked for Microsoft for years now) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMU/Dirmr67p11D8rAQGHnQP/YI+EjCIcpBF3HQznruVBUkGsZls1ZVTf SRvPJN7n+HrtvQ4WFSyAawsPnhRH183GTrtWAy+yhmmuzA6/Br/+rNJ/q0jSIlZw w+RUsni9H9a7NsO1Y9xPQq//SHODYC0K+1vB6tU8XE56lZf9F0IZ4iP4El4PUWxD 7kXMboN1Nf0= =5eH2 -----END PGP SIGNATURE-----

1 0

re: monsters et al
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On Mon, 18 Mar 1996 jamesd(a)echeque.com wrote: > > Those who defend totalitarianism, regardless of the brand name of > > totalitarianism, simply lie. It is as uncomplicated as that. At 02:21 PM 3/18/96 -0800, Charles Bell wrote: > Not very good point. > > Monsters come in many hues and `totalitarianism' is rarely total. > Simplicity is in the mind of the beholder. George Bernard Shaw, leader of the Fabian socialists, visited the Soviet Union during Stalin's artificial famine and said "Where do you see any food shortage", gesturing around. He was sitting in a restaurant reserved exclusively for foreigners at the time, and there was indeed excellent and abundant food in the restaurant. Monsters, plain enough. Very simple. The complications only exist in the clouded minds of those who employ doublethink. Shaw also visited the Gulag, as did many famous English leftists: Here is his report on it: "Whereas in Britain a man enters prison a human being, and leaves prison a criminal type, in Russia he entered prison a criminal type and would come out an ordinary man but for the difficulty of inducing him to come out at all. As far as I could make out they could all stay as long as they liked. " >From which I reasonably conclude that if people like him gained power, they would murder everybody like me. I have heard many very similar tales from folk on Usenet concerning Cuba and the like. In addition to eradicating everyone like me, they would also eradicate their dupes, their useful fools, such as H.G. Wells, who wrote of Stalin: "[...] never met a man more candid, fair and honest, [...] no one is afraid of him and everybody trusts him. " Since they did not give H.G. Wells a tour of the Gulag, I guess they suspected that he might not have approved. Such a suspicion would doubtless have proved fatal had his pals amongst the Fabian socialists gained power. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0