December 2003 - cypherpunks-legacy

Re: Golden Key Campaign
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Bill Frantz writes: > At 1:11 AM 4/25/96 -0700, Bill Stewart wrote: [...why do people continue to promote the RSA method?...] > > > >Sure. Because 1) it's a good algorithm for the job, And there are other equally good algorithms which can also do the job. > >2) we've learned it, and have a PGP base behind our inertia, A pretty insignificant base actually (at least compared to the internet as a whole) and supposedly PGP 3.0 will support multiple encryption methods so maybe the RSA reliance can die the ignoble death it deserves. One point left out from the original posting is that a Rabin exchange can use a RSA public key provided that the p and q in the public key are Blum integers (which also lets you use the public key for probabalistic PKE, as well as a few other neat tricks), so changing PGP to support Rabin would not be much of an inconvenience... > >3) The legalities of RSA are well-defined, Yes, and the most well-defined point is that until September in the year 2000 you will pay an arm and both legs to use RSA. > >4) the Stanford patents mostly run out in 1997, unless Roger's suit > > succeeds first, A point in favor of non-RSA public-key methods. > >5) the price of RSA is fairly low, once free RSAREF came out You must be joking. Have you ever tried to deal with RSA lawyers? > >6) the price of licensing Cylink patents is high and/or unpredictable True, but Cylink needs to milk their patents for all they are worth for the remaining 481 days they have left. In a little more than one year they will not be left with much more than a footnote in the crypto history books. > > I will add to Bill's list: > > 7) RSA is the best known and vetted of the Public Key algorithms. Best known perhaps, but ElGamal and Rabin have also been studied in depth (in fact, Rabin is provably as secure as factoring, RSA has not been proven this secure, it is only assumed that it is.) Most public key methods fall back to only a handful of real trap-doors, so there is only a limited amount of vetting to be done (esp. when compared to symmetric encryption methods.) > Some people say that the millennium comes on Jan 1, 2000. Others say it > comes on January 1, 2001. I say it comes on September 20, 2000 when the > RSA patent expires. Nope, it starts on August 19, 1997. After that point it becomes possible to deploy systems using secure public-key crypto worldwide without needing to pay someone royalties... :) jim

1 0

Re: [NOISE] What is "laser material"?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>> The Washington Post, April 25, 1996, p. A12. >> >> Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. At 09:05 PM 4/25/96 -0700, Bill Frantz wrote: > Does anyone have any idea what "more laser material" means? It is a chemically pumped laser. The lasing material is driven to population inversion by a shock wave passing through explosive material. There is a loud bang, and all the optics go to hell for a while. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

RE: Mindshare and Java
by James Childers 17 Dec '03

17 Dec '03

> > As cool as many of the people on the Java team are, though, I am dubious > > that Java is going to live up to the hype. Same here. If someone writes a secure electronic-wallet type system with Java, then I'll be impressed. Until then, all I've seen implemented is kEWL text graphics. > There was an official announcement at their Professional Developers Conference > a few weeks back. In short, full support in the browsers (and apparently MS > is now the keeper of the reference implementation on Win32) and also > a full blown Java development environment code-named 'Jakarta'. Didn't MS ditch their proprietary Java-like language? Interesting, if so...

1 0

Re: [NOISE] What is "laser material"?
by Peter Monta 17 Dec '03

17 Dec '03

> Does anyone have any idea what "more laser material" means? Well, you see, the lasing species is set in an argon matrix (yes, it's an excimer!); once the argon has evaporated, you need another rod. :-) Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

1 0

Mixmaster message formats
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was thinking about how Mixmaster needs a separate message format so it can make messages a fixed size and add a packet ID. However, couldn't all this be done with PGP? With PGP, the length of the file being encrypted is encrypted itself, so it would be possible to append random data to the end of the file to make the message a fixed length like Mixmaster. Also, the packet-ID could be implemented by putting a line such as the following in the message: :: Packet-ID: foobar The only other thing that would have to be taken care of is chaining. The way I could see this working is to have a header in the encrypted message that tells the remailer whether it should de-armor the message at the next layer, append random data, then re-armor, and pass it to the next remailer. Am I missing something? - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 "The concept of normalcy is just a conspiracy of the majority" -me -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMYAXxLZc+sv5siulAQG5CwP/Qbgune3sjNyB7Y8xNxNW6hCahtgBNJDk oT+hZHdlmcB6CZXjgDUSczIfAnygS71PBBysB4DJnugluMTMTGfqmgeikXdvL1zt vnwx5xlG0HQeTbVE2+c1uW4uamkdb0MZmNLR06S9M+2i0ROaWzGwNO6WEHqoEL3W qwXZ7zPtId0= =MaO4 -----END PGP SIGNATURE-----

2 1

ROC_poc
by John Young 17 Dec '03

17 Dec '03

4-25-96. WaPo: "Israelis Eye U.S. Laser As Anti-Rocket Defense. Nautilus High-Energy Laser Beam Burns Surface of Weapon." Two months ago, in a test at the White Sands Missile Range in New Mexico, the U.S. Army used the laser to shoot down two Katyusha rockets that earlier had been seized by Israel. The test caught the attention of the aerospace community because it offered evidence of Nautilus's efficacy, especially its new tracking system upgraded with more sophisticated computer software. The laser, beamed at a rocket for only a second or two, disables it by melting its surface, causing it to explode and crash to Earth. "Spy Chief's Grasp Reaches Other Pockets." The Senate intelligence committee yesterday approved a major expansion in power for the director of central intelligence (DCI) by giving the director authority not only over the CIA budget but also over all intelligence spending, most of which currently is controlled by the Pentagon. Such a radical change is likely to run into strong opposition not only from the military services themselves, but also from other congressional committees with Pentagon oversight. ROC_poc

1 0

Capability Security in Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:38 PM 4/25/96 -0700, Simon Spero wrote: >One thing that could be retroactively added to the vm pretty easily would >be the ability to add capability requirements to methods, and have the >class loader automatically generate code to check for those requirements >before executing the body of the method Now there is a statement that makes me sit up and take notice. I certainly havn't thought this subject thru carefully, but to start, I think I would like capabilities to be held by a specific object, so if I give a Java object permission to read a file, that permission is not automatically inherited by other objects, or instances of the same object which use the common method. There would also have to be a technique where capabilities could be passed from object to object to allow subcontracting. Having the capabilities held by objects means that access the objects needs to be controled as well. I notice some items on Hal's list of Java security problems which indicate weaknesses in this area, but it is not clear if they are bugs (which will be fixed) or "features". Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

RE: Mindshare and Java
by Blake Coverett 17 Dec '03

17 Dec '03

> Yes, I had the misfortune to post that skeptical bit at precisely the same > moment that the public press releases were proving me wrong :-( [shrug] Happens to all of us. Sometimes just keeping up on press releases seems to be a full time job. > My source at the PDC indicated that Microsoft was still pushing Visual > Basic, but I'll accept that there's been a change... They are, but not exclusively. They are supporting both JavaScript and VBScript in IE3. For that sort of work I think Basic might be more appropriate anyway. (Added to the fact that they have committed to making the reference source for VBScript available online with a free for whatever you want type of license.) The spin at TechEd last week seemed to be a complete spectrum running C++ -- Java -- VB depending on the desired speed/control vs. easy of development. > Still, integrating Java and Internet browsing into the OS does not bode > well for Netscape. <CRYSTALBALL> My bet is that five years from now Netscape will be remembered as the company that forced MS to give it away for free. </CRYSTALBALL> -Blake (who's keeping all his irons in the fire anyway :-)

1 0

VENONA followup
by John Young 17 Dec '03

17 Dec '03

Last year DCI Deutch said that as part of the new "openness" for intelligence archives and as followup to the release of VENONA documents, a conference was planned on Soviet intelligence attempts to penetrate the USG in the 1940s and 1950s. (See excerpt below.) Has anyone heard more on this conference? ---------- http://www.odci.gov/cia/public_affairs/speeches/dci_speech_71195. html DCI Speech 7/11/95 DCI John M. Deutch at VENONA Press Conference [Snip] Next year we will sponsor a conference on Soviet Intelligence attempts to penetrate the United States government during the 1940s and 1950s and our efforts to counter those efforts. We hope that all scholars will attend, including Russian scholars.

1 0

Re: Golden Key Campaign
by Lou Zirko 17 Dec '03

17 Dec '03

Ok! OK! I expect to get hit for this, but maybe we could set up a graphic on our pages with the "broken Key" from the lower left corner of Netscape to commersate the RSA date. > Date: Thu, 25 Apr 1996 12:08:08 -0700 > From: Hal <hfinney(a)shell.portal.com> > To: cypherpunks(a)toad.com > Subject: Re: Golden Key Campaign > From: frantz(a)netcom.com (Bill Frantz) > > Some people say that the millennium comes on Jan 1, 2000. Others say it > > comes on January 1, 2001. I say it comes on September 20, 2000 when the > > RSA patent expires. > > It is traditional to commemorate big events with annual observances. I > say there's no reason the observances can't predate the event when it is > known in advance. > > So I propose that September 20 be known as Crypto Freedom Day, and an > annual celebration be held on that day. With each year closer to 2000 > the party gets bigger, culminating on the day that the patent actually > expires. We can all run our RSA in three lines of Java that Adam Back > will have prepared, and taste for the first time the freedom which the > rest of the world will have known for the past 17 years. > > Hal > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

Another thing Baker said in that report about Japanese crypto policy was interesting. He was talking about key escrow and how he thought the Japanese discussions about it were on the wrong track. Apparently the Japanese idea of key escrow combines it with a government Certification Authority (CA) infrastructure. You get certified keys which you will use in commerce, and these keys are escrowed. (Japan is not showing much enthusiasm for the escrow idea, to Baker's displeasure, but they are discussing it.) Baker's problem was that the keys would be used for signing as well as for encryption. He said that in the U.S. they had been careful to separate these functions in their plans. That's why we have DSS for signatures and Clipper (Capstone, Skipjack, etc.) for encryption. Only the Clipper keys get escrowed. The DSS keys are kept private. The problem with using one set of keys for both functions (as for example when RSA keys are used for both encryption and signing a la PGP) is that the escrow people can not only defeat encryption, they can forge signatures. If escrowed keys were stolen, not only would privacy be lost but also the reliability of signatures. Now at first this seems strange. Why would it be more of a problem that a broken escrow could forge signatures than break privacy? Well, from the corporate point of view it could be a lot worse. When you get a signature on a business document you want to be able to trust it. If a company can hope to get out of a commitment by saying that hackers must have broken in and stolen the keys, the value of digial signatures is much reduced. Privacy, on the other hand, at least from the point of view of someone like Baker, is not as important. His people eavesdropped all the time, and it wasn't that bad. So from his perspective it is reasonable that a possibly insecure escrow system is acceptable for encryption, but not for signatures. And that is apparently a principle behind the US crypto policies as they have unfolded over the last few years. This may shed light on the battle a few years back over whether RSA signatures would be adopted as the digital signature standard rather than the discrete log system which was finally chosen. It also suggests that the government has long realized the difficulties of keeping the escrowed key database secure. Hal

1 0

RE: Mindshare and Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:45 AM 4/26/96, Blake Coverett wrote: >> Still, integrating Java and Internet browsing into the OS does not bode >> well for Netscape. > ><CRYSTALBALL> >My bet is that five years from now Netscape will be remembered as the >company that forced MS to give it away for free. ></CRYSTALBALL> > >-Blake (who's keeping all his irons in the fire anyway :-) I tend to agree with Blake on this, as one might expect. Speaking as a longterm Mac user, I certainly feel no compulsion to drop my Mac/Netscape package and switch to Microsoft. Bundling Java in with Windows (which actually was reported as long ago as last Friday, on C/NET's page, http://www.cnet.com/) may be a near-necessity for Microsoft, and for other OS vendors. Apple is also reported to be planning to make its next OS major release, "Copeland," an "Internet-savvy" release. Its "CyberDog" (dumb name) will be bundled with Java as part of Copeland. Metrowerks (the Code Warrior people) is said to be a partner in this. Symantec's "Cafe" JIT compiler for Java is reported to have a 13x speedup over JDK code, and is only slightly slower than compiled C code. Borland is also working on JIT stuff, reportedly for Sun itself. How it all shakes out remains unclear, but I stand by my "mindshare" point of view, that Java is fast-becoming a lingua franca for Web-centric use. (C certainly was, in a different sense, not for cross-platform easy use.) I'll bet, however, that Microsoft will not be "winner-take-all" in this. They're doing some impressively nimble rearrangements of plans, but there is little indication they'll be able to dominate things. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

[NOISE] What is "laser material"?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

> The Washington Post, April 25, 1996, p. A12. > > > Israelis Eye U.S. Laser As Anti-Rocket Defense > > 'Nautilus' Beam Burns Surface of Weapon > > By John Mintz > >... > Moreover, a laser shot costs $3,000, compared to several > million dollars for a missile. Army officials envision the > Nautilus would be beamed from a truck capable of firing 50 > shots before requiring more laser material. Does anyone have any idea what "more laser material" means? ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 2

Re: Capability Security in Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:58 AM 4/26/96, Bill Frantz wrote: >At 4:38 PM 4/25/96 -0700, Simon Spero wrote: >>One thing that could be retroactively added to the vm pretty easily would >>be the ability to add capability requirements to methods, and have the >>class loader automatically generate code to check for those requirements >>before executing the body of the method > >Now there is a statement that makes me sit up and take notice. I certainly >havn't thought this subject thru carefully, but to start, I think I would >like capabilities to be held by a specific object, so if I give a Java >object permission to read a file, that permission is not automatically >inherited by other objects, or instances of the same object which use the >common method. > >There would also have to be a technique where capabilities could be passed >from object to object to allow subcontracting. ... There are two major security enhancements of a "fundamental nature" that are being discussd, that I know of: 1. Sun and JavaSoft are talking about "signed classes," using full-blown digital signatures, in a future release. Some of the Java developers talked at a Cypherpunks meeting last June or so about this (before Java became so hot and they would only speak at Moscone Center before crowds of 1000 and up). 2. Electric Communities has developed a superset of Java called E, available for downloading and whatnot at http://www.communities.com/. It offers a set of capability-based security features which are quite interesting. (Several Cypherpunks work at EC, of course.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: US law - World Law - Secret Banking
by tcmay＠got.net 17 Dec '03

17 Dec '03

On the issue of "money leaving the country illegally" (the general notion that people taking money out of the country in suitcases or in charged-up smartcards are doing something Evil and Unclean). Just as we (and Phil Zimmermann, who widely made this point) were able to convince a lot of people about strong crypto by talking about "sealed letters" vs. "postcards," so, too, do we need to make the same points about "untraceable cash flows" and even about "taking money out of the country." I imagine this conversation with my father: Dad: "But if the government needs to trace the spending of illegal money, then these anonymous transfers you've been telling me about need to be outlawed." Me: "Can the government track that $100 you spent last week? Should it?" Dad: "Well, no, that's my money and it's none of the government's damned business what I spend it on." Me: "So, we agree." Dad: "Well, but the drug dealers have to be tracked." Me: "First, the drug dealers are likely dealing in such mega-quantities that they'll simply find compliant banks and other ways to hide the transfers. It's unlikely that any of the proposed tracking schemes will be effective. Second, how can the government possibly know which funds are drug-related and which are not? Their scheme involves sacrificing fundamental liberties for the dubious possibility that _some_ drug dealers will be caught. Random raids on houses would probably work better, but of course would be just as unconstitutional." Dad: "But then what do we do about the drug dealers?" Me: "You and me don't do drugs. So what's the problem?" Dad: "But..." Me: "Name a drug that kills more people per year than alcohol. Or nicotine." Dad: "Well...." [My father, at age 72, has come around to the "legalize all drugs" position, a view also supported by noted thinkers and former politicians, including former Secretary of State George Schulz (or Shultz, or some variant).] I 'm convinced that a similar argument applies to those transferring funds. Many funds transfers are not even tax evasion; I am one of many people who are researching ways to expatriate some or all of my funds to jurisdictions friendlier than the U.S. So long as I fill out the proper boxes on my 1040, and pay appropriate taxes, I am committing no crime by moving my wealth to some other country. Those on the list about a year or so ago may recall that there are proposals to in fact impose a "capital flight tax." This would make the U.S. a country very much like the former Soviet Union, which forbade such transfers of wealth without payment of heavy taxes. The recent FinCEN-friendly conference in San Francisco raised the alarm about digital cash and smartcards being used to make money transfers easier. Horrors! --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 7

PGP + Pegasus Mail
by G Ackerman 17 Dec '03

17 Dec '03

Hi, I want to know if it is possible - and how to use PGP from within Pmail. (I want to use the Encrypt option in PMail with a method PGP - is it possible and what must I do to get it to work) (including Digital Signature, etc) Thanks |\/\/\/| | | | | | (o)(o) G Ackerman C _) Free State Education Department | ,____| gerhard(a)pyrod.ovsod.co.za | / +27 +(0)51 4074127 /__\ / \ DISCLAIMER: EXPRESSED OPINIONS ARE MY OWN AND MIGHT NOT BE SHARED BY MY EMPLOYER OR ANYONE ELSE.

2 1

Re: [NOISE] What is "laser material"?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:05 AM 4/26/96, Bill Frantz wrote: >> Moreover, a laser shot costs $3,000, compared to several >> million dollars for a missile. Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. > >Does anyone have any idea what "more laser material" means? > Sure, most high-power lasers like this are chemical lasers, consuming reactive materials. (This is not the same as "gas lasers," a la the early CO2 lasers. And of course ruby and Nd-YAG lasers are not what is meant here, either.) P.S. I don't place much faith in laser weaponry. Some obvious countermeasures are: spin the projectile to minimize heating of any one spot, determine the wavelength of the planned laser and coat the projectile with a suitably reflective coating, apply ablative layers that can burn off without harm, etc. Such countermeasures are of course well-known to the laser builders, but they still make the game much tougher. All a matter of attack and counter-attack, and the costs of each. Like castles and siege engines. Or like crypto. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Guardian angels, anonymity, and the decency brigade
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Attached is a message from the CyberAngels asking for rating volunteers. Jim Thomas published a fascinating and illuminating article documenting the seamier side of these self-appointed net.vigilantes in the Computer underground Digest earlier this year. (I vaguely remember some legal threats soon afterwards.) Their authoritarian and anti-privacy leanings are clear in their FAQ, at <http://www.safesurf.com/cyberangels/>: 9) What kinds of changes would the Guardian Angels / CyberAngels like to see? a) We would like to see an improvement in User identification. User ID is impossible to verify or trace back. The very anonymity of Users is itself causing an increase in rudeness, sexual abuse, flaming, and crimes like pedophile activity. We the Net Users must take responsibility for the problem ourselves. One of our demands is for more accountable User IDs on the Net. When people are anonymous they are also free to be criminals. In a riot you see rioters wearing masks to disguise their true identity. So much for anonymous remailers! But the CyberAngels, in a fit of almost painful hypocrisy, use anonymous remailers themselves, as Charles Platt recounts in his book _Anarchy Online_ (their web page also says how these virtues remain anonymous online): How would this decency crusade actually work in practice? Well, later in 1995, one net user received the following not-very-friendly, not-very-literate warning, sent via an anonymous remailer: The Net is out of control, sex crimes, hate crimes and felonies. Just as on the streets, CyberCrime is committed by a minority of criminals who destroy the quality of life for an innocent majority. And just like on the streets the Guardian Angels will combat it. We have good reason to believe that you are involved in unlawful, harmful, hateful, threatening and/or harassment, particularly relating to minors. We will be watching you. The netizen who found this in her mailbox was baffled and irritated. She had no idea what she'd done to provoke the warning, and since the message was anonymous, there was no way to _find out_ what she was supposed to have done. By November, the Angels claimed they had 200 volunteers working for them, busily searching for bad guys on the net. "We have reported a number of Child Pornographers (50) to Sysadmins [system administrators] this month," Colin Hatcher noted, although he was no longer signing his real name to his progress reports, perhaps in fear of reprisals from angry pedophiles. "Letters we have received back all share our concern and promise stern action. Remember, each electronic image represents a real life destroyed." [...] Some net users wondered, though, if Hatcher was qualified to draw a dividing line between good and bad, let alone ugly. They also worried that decency vigilantes might have a chilling effect on freedom of speech. A student at Rutgers University complained that some of the Angels' public statements "are threats to violate the civil liberties of users of the Internet." In addition, he said, "the record of the Guardian Angels suggests that they will step over even the bounds that they publicly set for themselves." And, as Steven Levy wrote in Newsweek last October: "After the issue of child safety in cyberspace came up on his radio talk show, [Curtis] Sliwa decided to pursue in his usual high-profile fashion... Though the CyberAngels cannot document a single case where one of their numerous reports led directly to an arrest, they have compiled a fat file of press clippings." In the attached piece, the Angels hold themselves up as the arbiter of what is appropriate for kids or not under the Safesurf system. So far so good -- but what criteria do they use when checking to see if a site is "genuinely kidsafe?" Where is it documented and published? What training do their self-selected vigilantes have? Will the cypherpunks list be blocked when we have messages like this one on it: http://www.cs.cmu.edu/~declan/rimm/asst/anti_porn_group_11_22_94.letter -------------------------------------------------------------------------- Those orphan kids in the terminally ill section of the hospital are so fun at night when they are drugged out. I love sucking on their tiny finger-sized cocks and probing their tight holes. Their slender little bodies are completely smooth. They're going to die pretty soon so they won't come back to me several years from now as hairy grown up men blaming me for why they are all mentally messed up. And since they are orphans with no one to look over them except for overworked staff, I could get away with just about anything. Since blocking software like Safesurf and SurfWatch is central to our case challenging the CDA, I believe we should support that software and PICS-like third paty rating systems. Fortunately, that doesn't mean we have to accept or support the efforts of their unfortunate and intemperate net-vigilante allies. But I still want to help rate some web pages, so ---- "Gabriel," I want to be a CyberAngel. Sign me up! -Declan (now a CyberSeraphim) ---------- Forwarded message ---------- Date: Thu, 25 Apr 1996 19:11:16 -0700 From: angels(a)wavenet.com Subject: ALERT FOR 20 VOLUNTEERS! APPEAL FOR VOLUNTEERS Hi again everyone. I have a project that requires 20 volunteers. Read on! Most of you I hope are familiar with Safesurf - if not go visit them at http://www.safesurf.com Safesurf are not a commercial software company but are a kidsafe organization who are very involved in the ratings issue for kids and adult material on the Net. Safesurf are also our allies, and it is thanks to them that we have our website at all as it was a donation from Ray and Wendy at Safesurf. Safesurf have a very positive approach to the screening debate - they have developed a rating system whereby instead of spending time rating adult sites you focus instead on rating the kids sites. Then your screening software only allows you to visit sites with the Safesurf rating on it. This is an excellent concept, not least because it doesn't then matter if new sites come onto the web that are not rated yet, because nothing can be included in your screened browser unless it registers itself as kidsafe by marking its site with a safesurf rating mark. Don't worry about my ramblings - just go to their site and read up on it. It's a really positive concept and has been adopted by a lot of sites already. Adopting the Safesurf mark is voluntary and means that you are identifying your site as suitable for e.g. kids. Now here comes the appeal. Several thousand sites have already marked themselves as Safesurf rated - and more are registering every day. The question is - what is to stop a site registering as a kidsafe site, but in reality being an adult site? The Safesurf rating method is that sites can obtain the rating from the Safesurf site and then write in and register themselves. Isn't it possible that a site could claim to be kidsafe but in reality was adult? The answer is yes. So how can Safesurf be sure that sites registered with them are indeed genuinely kidsafe? Simple - someone has to go and check out all the sites who register with Safesurf. Ray had a proposal for me. How about if we could say that all these sites were "Rated by Safesurf, and patrolled by CyberAngels"? I thought that was a great idea - for we CyberAngels to help Safesurf in this way, by checking their sites for them. Ray is proposing to send me 200 sites a week to check out and we will share them out to a CyberAngels team of 20 volunteers - that means that each one of us would volunteer to check out 10 sites per week. Easy right? I want to make something very clear - Safesurf are not a rich commercial company making money from rating sites. They are not selling software and their rating code is free to anyone who wants it. So it's not like they can hire 20 people and pay them to patrol the Safesurf Intranet - it's a volunteer job. So there you are - I am looking for 20 CyberAngel volunteers to make up a regular Safesurf "Intranet" Patrol, with the mission to visit 10 URLs a week and make sure that they are what they say they are. Who's ready? Once I have the team established I will then brief you all on how we do this. Write to me as soon as possible if this interests you. Let's show Safesurf how much we support their positive stand for our InterNet kids! I will take the first 20 volunteers who contact me (yes you will be suitably honored - publicly if you so choose!) Gabriel

1 0

Re: [NOISE] What is "laser material"?
by jim bell 17 Dec '03

17 Dec '03

At 09:05 PM 4/25/96 -0700, Bill Frantz wrote: >> The Washington Post, April 25, 1996, p. A12. >> >> >> Israelis Eye U.S. Laser As Anti-Rocket Defense >> >> 'Nautilus' Beam Burns Surface of Weapon >> >> By John Mintz >> >>... >> Moreover, a laser shot costs $3,000, compared to several >> million dollars for a missile. Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. > >Does anyone have any idea what "more laser material" means? Hydrogen and fluorine, possibly. Some of the more energetic lasers use this combination. Jim "He only talks about one thing" Bell jimbell(a)pacifier.com

1 0

[fight-censorship] Guardian Angels v. anonymous remailers
by Rich Graves 17 Dec '03

17 Dec '03

Interesting and well-written piece. Followups, if any, will be at http://fight-censorship.dementia.org/fight-censorship/top/ I assume that Declan is just observing how Safesurf operates. My view is that these private "decency" registries are a healthy part of the free market. Of course the "Angels" are a bunch of hypocrites, but the part about rating sites I support. Let the prudes censor themselves; it's a free net. If anyone tries to sabotage Safesurf by rating things the "wrong" way, then they're an asshole. (I am *not* accusing Declan of advocating this, because he isn't -- it's just something that crossed my mind. Tempting, but highly counterproductive.) -rich ---------- Forwarded message ---------- Date: Fri, 26 Apr 1996 01:43:25 -0400 (EDT) From: "Declan B. McCullagh" <declan+(a)CMU.EDU> To: Fight Censorship Mailing List <fight-censorship+(a)andrew.cmu.edu> Cc: angels(a)wavenet.com, mnemonic(a)well.com, cp(a)panix.com Subject: Guardian angels, the decency brigade, and cyberseraphim Attached is a message from the CyberAngels asking for rating volunteers. Jim Thomas published a fascinating and illuminating article documenting the seamier side of these self-appointed net.vigilantes in the Computer underground Digest earlier this year. (I vaguely remember some legal threats soon afterwards.) Their authoritarian and anti-privacy leanings are clear in their FAQ, at <http://www.safesurf.com/cyberangels/>: 9) What kinds of changes would the Guardian Angels / CyberAngels like to see? a) We would like to see an improvement in User identification. User ID is impossible to verify or trace back. The very anonymity of Users is itself causing an increase in rudeness, sexual abuse, flaming, and crimes like pedophile activity. We the Net Users must take responsibility for the problem ourselves. One of our demands is for more accountable User IDs on the Net. When people are anonymous they are also free to be criminals. In a riot you see rioters wearing masks to disguise their true identity. So much for anonymous remailers! But the CyberAngels, in a fit of almost painful hypocrisy, use anonymous remailers themselves, as Charles Platt recounts in his book _Anarchy Online_: How would this decency crusade actually work in practice? Well, later in 1995, one net user received the following not-very-friendly, not-very-literate warning, sent via an anonymous remailer: The Net is out of control, sex crimes, hate crimes and felonies. Just as on the streets, CyberCrime is committed by a minority of criminals who destroy the quality of life for an innocent majority. And just like on the streets the Guardian Angels will combat it. We have good reason to believe that you are involved in unlawful, harmful, hateful, threatening and/or harassment, particularly relating to minors. We will be watching you. The netizen who found this in her mailbox was baffled and irritated. She had no idea what she'd done to provoke the warning, and since the message was anonymous, there was no way to _find out_ what she was supposed to have done. By November, the Angels claimed they had 200 volunteers working for them, busily searching for bad guys on the net. "We have reported a number of Child Pornographers (50) to Sysadmins [system administrators] this month," Colin Hatcher noted, although he was no longer signing his real name to his progress reports, perhaps in fear of reprisals from angry pedophiles. "Letters we have received back all share our concern and promise stern action. Remember, each electronic image represents a real life destroyed." [...] Some net users wondered, though, if Hatcher was qualified to draw a dividing line between good and bad, let alone ugly. They also worried that decency vigilantes might have a chilling effect on freedom of speech. A student at Rutgers University complained that some of the Angels' public statements "are threats to violate the civil liberties of users of the Internet." In addition, he said, "the record of the Guardian Angels suggests that they will step over even the bounds that they publicly set for themselves." And, as Steven Levy wrote in Newsweek last October: "After the issue of child safety in cyberspace came up on his radio talk show, [Curtis] Sliwa decided to pursue in his usual high-profile fashion... Though the CyberAngels cannot document a single case where one of their numerous reports led directly to an arrest, they have compiled a fat file of press clippings." In the attached piece, the Angels hold themselves up as the arbiter of what is appropriate for kids or not under the Safesurf system. So far so good -- but what criteria do they use when checking to see if a site is "genuinely kidsafe?" Where is it documented and published? What training do their self-selected vigilantes have? Will the fight-censorship list be blocked when we have messages like this one on it: http://www.cs.cmu.edu/~declan/rimm/asst/anti_porn_group_11_22_94.letter -------------------------------------------------------------------------- Those orphan kids in the terminally ill section of the hospital are so fun at night when they are drugged out. I love sucking on their tiny finger-sized cocks and probing their tight holes. Their slender little bodies are completely smooth. They're going to die pretty soon so they won't come back to me several years from now as hairy grown up men blaming me for why they are all mentally messed up. And since they are orphans with no one to look over them except for overworked staff, I could get away with just about anything. Since blocking software like Safesurf and SurfWatch is central to our case challenging the CDA, I believe we should support that software and PICS-like third paty rating systems. Fortunately, that doesn't mean we have to accept or support the efforts of their unfortunate and intemperate net-vigilante allies. But I still want to help rate some web pages, so ---- "Gabriel," I want to be a CyberAngel. Sign me up! -Declan (now a CyberSeraphim) ---------- Forwarded message ---------- Date: Thu, 25 Apr 1996 19:11:16 -0700 From: angels(a)wavenet.com Subject: ALERT FOR 20 VOLUNTEERS! APPEAL FOR VOLUNTEERS Hi again everyone. I have a project that requires 20 volunteers. Read on! Most of you I hope are familiar with Safesurf - if not go visit them at http://www.safesurf.com Safesurf are not a commercial software company but are a kidsafe organization who are very involved in the ratings issue for kids and adult material on the Net. Safesurf are also our allies, and it is thanks to them that we have our website at all as it was a donation from Ray and Wendy at Safesurf. Safesurf have a very positive approach to the screening debate - they have developed a rating system whereby instead of spending time rating adult sites you focus instead on rating the kids sites. Then your screening software only allows you to visit sites with the Safesurf rating on it. This is an excellent concept, not least because it doesn't then matter if new sites come onto the web that are not rated yet, because nothing can be included in your screened browser unless it registers itself as kidsafe by marking its site with a safesurf rating mark. Don't worry about my ramblings - just go to their site and read up on it. It's a really positive concept and has been adopted by a lot of sites already. Adopting the Safesurf mark is voluntary and means that you are identifying your site as suitable for e.g. kids. Now here comes the appeal. Several thousand sites have already marked themselves as Safesurf rated - and more are registering every day. The question is - what is to stop a site registering as a kidsafe site, but in reality being an adult site? The Safesurf rating method is that sites can obtain the rating from the Safesurf site and then write in and register themselves. Isn't it possible that a site could claim to be kidsafe but in reality was adult? The answer is yes. So how can Safesurf be sure that sites registered with them are indeed genuinely kidsafe? Simple - someone has to go and check out all the sites who register with Safesurf. Ray had a proposal for me. How about if we could say that all these sites were "Rated by Safesurf, and patrolled by CyberAngels"? I thought that was a great idea - for we CyberAngels to help Safesurf in this way, by checking their sites for them. Ray is proposing to send me 200 sites a week to check out and we will share them out to a CyberAngels team of 20 volunteers - that means that each one of us would volunteer to check out 10 sites per week. Easy right? I want to make something very clear - Safesurf are not a rich commercial company making money from rating sites. They are not selling software and their rating code is free to anyone who wants it. So it's not like they can hire 20 people and pay them to patrol the Safesurf Intranet - it's a volunteer job. So there you are - I am looking for 20 CyberAngel volunteers to make up a regular Safesurf "Intranet" Patrol, with the mission to visit 10 URLs a week and make sure that they are what they say they are. Who's ready? Once I have the team established I will then brief you all on how we do this. Write to me as soon as possible if this interests you. Let's show Safesurf how much we support their positive stand for our InterNet kids! I will take the first 20 volunteers who contact me (yes you will be suitably honored - publicly if you so choose!) Gabriel

1 0

Re: Guardian angels, the decency brigade, and cyberseraphim
by angels＠wavenet.com 17 Dec '03

17 Dec '03

Thanks Declan for forwarding your letter to me. I'll answer some of the points you refer to: >So much for anonymous remailers! But the CyberAngels, in a fit of almost > painful hypocrisy, use anonymous remailers themselves, as Charles Platt >recounts in his book _Anarchy Online_: Some of our members use anon remailers (although strictly speaking they are pseudo anon remailers and therefore the user can be traced). These are members who are also supporters of privacy and anonymity online. I do myself use an anon remailer. There is nothing hypocritical about it at all. We are not proposing to ban anon remailers, we are simply concerned about the abuse of them. > > How would this decency crusade actually work in > practice? Well, later in 1995, one net user received the > following not-very-friendly, not-very-literate warning, sent > via an anonymous remailer: > > The Net is out of control, sex crimes, hate crimes > and felonies. > Just as on the streets, CyberCrime is committed by > a minority of criminals who destroy the quality of life > for an innocent majority. And just like on the streets > the Guardian Angels will combat it. > We have good reason to believe that you are > involved in unlawful, harmful, hateful, threatening > and/or harassment, particularly relating to minors. We > will be watching you. This message was not from our organization at all. Surely you have heard of impersonation? The oldest trick in thebook. > > The netizen who found this in her mailbox was baffled > and irritated. She had no idea what she'd done to provoke the > warning, and since the message was anonymous, there was no > way to _find out_ what she was supposed to have done. Just goes to show what happens when people abuse anon remailers, right? But it was not me. > By November, the Angels claimed they had 200 volunteers > working for them, busily searching for bad guys on the net. > "We have reported a number of Child Pornographers (50) to > Sysadmins [system administrators] this month," Colin Hatcher > noted, although he was no longer signing his real name to his > progress reports, perhaps in fear of reprisals from angry > pedophiles. LOL, Gabriel is my nickname! I think the writer is thinking too hard about conspiracies... >And, as Steven Levy wrote in Newsweek last October: "After the issue of >child safety in cyberspace came up on his radio talk show, [Curtis] >Sliwa decided to pursue in his usual high-profile fashion... Though the >CyberAngels cannot document a single case where one of their numerous >reports led directly to an arrest, they have compiled a fat file of >press clippings." People also wish to evaluate the work of the Guardian Angels by asking how many arrests we have made. But this misses the point of the work entirely. We do not patrol to make arrests. We patrol to help others. And a good patrol means that nothing happens. As for press, we didnt even send a press release until 4 months after we started, and then only to announce our website. And we've only sent one more press release out since then. We do believe however that we have helped to bring the issue of children and the Internet to the forefront and that is a good thing too. > >In the attached piece, the Angels hold themselves up as the arbiter of >what is appropriate for kids or not under the Safesurf system. >So far so >good -- but what criteria do they use when checking to see if a site is >"genuinely kidsafe?" Where is it documented and published? What training >do their self-selected vigilantes have? The Safesurf system is a voluntary rating system that URLs undertake themselves. If you want to know more about the criteria you should check out Safesurf themselves at http://www.safesurf.com >Will the fight-censorship list >be blocked when we have messages like this one on it: > > http://www.cs.cmu.edu/~declan/rimm/asst/anti_porn_group_11_22_94.letter > -------------------------------------------------------------------------- > Those orphan kids in the terminally ill section of the hospital are so fun > at night when they are drugged out. I love sucking on their tiny > finger-sized cocks and probing their tight holes. Their slender little > bodies are completely smooth. They're going to die pretty soon so they > won't come back to me several years from now as hairy grown up men blaming > me for why they are all mentally messed up. And since they are orphans > with no one to look over them except for overworked staff, I could get > away with just about anything. Why ask? Clearly a site with a message like this would not be suitable for children to read. That would be an adult site rating. > >Since blocking software like Safesurf and SurfWatch is central to our >case challenging the CDA... Safesurf does not make software. It's not a software manufacturer at all. >Fortunately, that doesn't mean we >have to accept or support the efforts of their unfortunate and >intemperate net-vigilante allies. >But I still want to help rate some web pages, so ---- "Gabriel," I want >to be a CyberAngel. Sign me up! > >-Declan (now a CyberSeraphim) Declan I'm sorry to be the bearer of bad news but since you clearly are hostile to our mission I see no reason why we should invite you to help us. Of course you could always sign up as an anonymous volunteer from an anon remailer , or from another account, and pretend to believe in what we are doing ;) CyberAngels is about self-regulation. Let us not confuse the fight against internet crime with the criminalization of free speech. We propose the former not the latter. Gabriel ************************************************************************* "All that is required for the triumph of evil is that good men and women remain silent and do nothing" (Edmund Burke) "Congress shall make no law respecting an establishment of religion or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble and to petition the Government for a redress of grievances." (US First Amendment to the Constitution) "Those who sacrifice security for freedom, will have neither" **************************************************************************

1 0

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:27 AM 4/26/96, Mike Duvos wrote: >I completely agree with this. Java incorporates the type of >automatic corruption-proof memory management found in languages >like APL, the basic notions of object oriented programming, fast >dynamic linking, and a C-like program structure. > >This is powerful combination of features and gives Java the >potential to do all the platform-independent things that were >advertised for C before the rude reality of thousand line >makefiles reared its ugly head. . The complete specification of >the Java Virtual Machine means that the behavior of Java programs >is perfectly well-defined, and one does not have to tweek >anything which is processor or operating system dependent. Let's hope that this is really true. Your point about C is an excellent one, as certainly the "lingua franca" of C pretty much failed, except when enough work was done to properly port an application. (However, the bytecode/JVM approach exacts some performance penalty, albeit partially ameliorated with JIT compilers that are likely to be widely available. Some apps will just have to be tuned for speed. But when I look at most crypto apps such as we are ultimately interested in--digital money, mixes, crypto protocol building blocks, etc.--I see that first and foremost they aren't getting done and distributed. The applet model looks pretty good here.) >In the future, I expect Java bytecode to become a significant >channel for the distribution of popular applications, with >compilation to fast native code on numerous platforms. One interesting remark I read from someone was that the Java distribution model returns us to an era of easier distribution of small programs. The "application bloat" of very large programs may be at least partly fixed. We'll see. >Java is clean, and its concepts are easily understandable even by >persons whose eyes glaze over after the first 30 pages of the C++ >manual. My background in programming was in Lisp when I was with Intel (I started Intel's AI lab and was the first person to look at neural nets for them), and then Smalltalk for "fun." But, like I said recently, I knew that Smalltalk had about zero chance of becoming widely used, despite fairly impressive year-to-year growth rates. (I also got Lightspeed C in '86, but barely played with it over the years...good intentions, though.) Anyway, Mike is right that Java is a lot of fun. Enough good OO stuff to keep Smalltalk folks happy, but with familiar C syntax. And going to garbage collection/eliminating pointers is a major plus for reducing errors and headaches. A huge number of books are hitting the shelves. Besides the "Teach Yourself Java in 21 Days" book, I really like "Core Java," a hefty tome with lots of asides about how Java compares to C, C++, Lisp, and Smalltalk, and with more of the "rationale" than most of the other books. The "Java in a Nutshell" book is also well-regarded. And Peter van der Linden's "Just Java" is good. (These are the four I have, and my eyes haven't been glazing over yet.) Gosling's book arrives soon. I looked at an advanced draft and it looks excellent, too. >Java Applets, mobile crypto agents, and the new Web-centric view >of cyberspace will go a long way towards encouraging the >planet-wide use of strong crypto, as well as effectively swatting >annoying mosquitos like ITAR. > >Indeed, with Java, I can put up a Web page which teaches someone >about a cryptographic algorithm, allows him to try it out and run >sample data through it, and provides him with a >platform-independent implementation of it to use as he wishes. >All in one fell swoop. That's a pretty powerful concept. > >Java has come at the right time, and it will produce chaotic >change in the existing order. > >Should be interesting. I agree with all of Mike's points. Interestingly, I've been having an e-mail dialog with a friend who avers that Java is just another temporary fad, just another ho-hum interpreted language. He claims that Perl and TCL were similar fads, and didn't change the world. I disagree with him, of course. I think the flood of books, compilers, incorporations into browsers and operating systems, etc. is strong evidence that Java is a bit more than just this year's version of TCL. But, the great thing about a market anarchy is that people get to vote. By deciding what to buy, what to work on, what to build applications with, and so forth. The first "killer applet" (tm) will be what? (There's a fair chance it could be a digital commerce applet, something to exploit correctly the pent-up demand for online purchases....I can imagine folks on this very list becoming the Scott Cook's of this market....) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 11:14 PM 4/25/96 -0700, Paul S. Penrod wrote: > > >On Thu, 25 Apr 1996, jim bell wrote: >? >> >> This analysis seems to assume that the entire production run of a standard >> product is subverted. More likely,I think, an organization like the NSA >> might build a pin-compatible version of an existing, commonly-used product >> like a keyboard encoder chip that is designed to transmit (by RFI signals) >> the contents of what is typed at the keyboard. It's simple, it's hard to >> detect, and it gets what they want. >> >> Jim Bell >> jimbell(a)pacifier.com >> >> > >This is getting more rediculous by the minute. If NSA wanted to find out >what you were typing, they dont need to subvert microcode or chips on the >board. Unless you have a tempest device - all they have to do is pull RF >from your vicinty and they can *see* just exactly what your typing. You don't understand the subject, do you? While it is possible to determine a great deal of information from RF, there is an enormous difference in effort between analyzing the output of an uncooperative, inadvertent transmitter and a "cooperative" one. The most commonly understood source of RF signals come from CRT's, called Van Eck radiation. But passwords don't generally appear on CRT displays, so that is of limited value. I don't doubt that standard keyboards produce RF that might be analyzed, their output is probably not particularly easy to detect against a background of processor RFI. (It's short and low-amplitude) Far easier to analyze would be a chip that loudly and longly transmitted the current typed keyboard character, perhaps in some sort of serial binary code, possibly by driving the keyboard scanning lines according to a pre-arranged pattern designed to emit RF at a particular rate based on the clock oscillator. This transmission would be just about undetectable to anyone who didn't have a whole raft of sophisticated detection equipment. However, to those who know what to look for, it would probably be relatively easy to see. One particularly important reason for using such a chip, which you entirely overlooked, is that many computers are at sites with more than one, and in some cases many more than one computer. Their signals will mix, obviously, and will be very hard to separate. If it is possible to replace a keyboard chip with a Trojan Horse, the one desired target will be far more identifiable. Jim "He only talks about one thing" Bell jimbell(a)pacifier.com

2 1