December 2003 - cypherpunks-legacy

Microsoft Explorer security hole (fwd)
by Ben Holiday 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 01:35:07 GMT Subject: Microsoft Explorer security hole (fwd) On Sun, 25 Aug 1996 13:55:30 -0600 (MDT), Carl Nation <carl(a)iserver.com> wrote: To our Resellers/Customers, Our sysadmin received this security alert, and we thought we should pass it along... ------- Forwarded Message Date: Wed, 21 Aug 1996 13:12:59 -0400 From: felten(a)CS.Princeton.EDU (Ed Felten) Subject: Internet Explorer Security Problem We have discovered a security flaw in the current version (3.0) of Microsoft's Internet Explorer browser running under Windows 95. An attacker could exploit the flaw to run any DOS command on the machine of an Explorer user who visits the attacker's page. For example, the attacker could read, modify, or delete the victim's files, or insert a virus or backdoor entrance into the victim's machine. We have verified our discovery by creating a Web page that deletes a file on the machine of any Explorer user who visits the page. The core of the attack is a technique for delivering a document to the victim's browser while bypassing the security checks that would normally be applied to the document. If the document is, for example, a Microsoft Word template, it could contain a macro that executes any DOS command. Normally, before Explorer downloads a dangerous file like a Word document, it displays a dialog box warning that the file might contain a virus or other dangerous content, and asking the user whether to abort the download or to proceed with the download anyway. This gives the user a chance to avoid the risk of a malicious document. However, our technique allows an attacker to deliver a document without triggering the dialog box. Microsoft has been notified and they are working on fixing the problem. Until a remedy is widely available, we will not disclose further details about the flaw. For more information, contact Ed Felten at felten(a)cs.princeton.edu or 609-258-5906. Dirk Balfanz and Ed Felten Dept. of Computer Science, Princeton University http://www.cs.princeton.edu/sip/ ------- End of Forwarded Message

2 1

New type2.list/pubring.mix
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, There is a new type2.list/pubring.mix update for Mixmaster on jpunix.com. The update reflects the temporary retirement of the anon Mixmaster remailer. Please update your files accordingly. The files can be obtained by WWW at www.jpunix.com and by anonymous FTP at ftp.jpunix.com. - -- John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMiIqVlOTpEThrthvAQE4QwQAhFWK/mkfi7ucQq4xdnRJKiezeVr7tuT6 j0RYV+mnmiBjYX7jMtsEA4dSuEoTqG0IzXtihbu91qNk7mTyNfNmIegyIDfneD4M bJh3jpUK6d2zHJ8Bo8+dwVd6e+etZZ+0+CC9AULfuWC0AKUpkoF5ussjWf2L8thB WuSJQTT72UM= =DcDL -----END PGP SIGNATURE-----

2 1

Sen. Leahy's "impeccable cyberspace credentials"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 12:23:57 -0400 From: Jonah Seiger <jseiger(a)cdt.org> To: Declan McCullagh <declan(a)eff.org> Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, telstar(a)wired.com Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) Declan: What are you thinking?! In a world where we have very few real friends, I simply don't understand what you are trying to accomplish. It's fine (and healthy) to raise concerns about the particular positions a member of Congress takes (hell, I don't agree with everything Leahy does), but to simply dismiss Leahy as a 'no friend of the Net' is naive and counterproductive. Look at the record. Leahy is hands down the strongest supporter of the Net in Congress. Period. No other Member (including our small but growing handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has been a more forceful or consistent advocate for your causes for as long as Leahy has. What exactly do you want? Perhaps we should elect you to Congress and see how well you can do. Of course we are not going to agree with our friends on every issue. If Leahy takes a position you don't like, I'd suggest you talk to his office. I have found in my experience that Leahy's staff (and him personally) will take the time to listen when presented with a well presented argument. I'm also confused about another thing: which hat were you wearing when you wrote this? If it is your "advocate" hat I think it must covering your eyes. If it's your "journalist" hat, you need to do a bit better job of checking your facts in the future. Go a head and reject the "Beltway politicians". It's fashionable, sure, but what does it really accomplish? Some of them are dangerous. Others are sympathetic. The fact is that short of armed rebellion they are going to be here for a while. I shudder to think of the wrath our opponents could wage if we all threw up our hands packed up our bags and left town. Face the facts. Members of Congress have a lot of constituencies to deal with, and we are a small and relatively powerless faction. We can do a lot to change the outcomes of policy debates (if I didn't believe that I wouldn't be doing what I do everyday), but we have to be realistic, recognize where we fit in to the process and who are friends are. One thing's for sure - we have A LOT more enemies than we have friends. Most members of Congress don't really understand us or our issues. Many are willing to learn, and some have been real champions for our causes. But none of them are gong to continue reaching out a hand to us if we bark and bite when we don't get 100% of our way. Zealots rarely win (though it sure is fun to throw bombs). Sorry for the public thrashing, but this kind of attitude REALLY gets under my skin. Flames welcome (though response is not guaranteed <g>), Jonah At 6:45 PM 8/25/96, Declan McCullagh wrote: >On Sun, 25 Aug 1996, Voters Telecommunications Watch wrote: >> [Notably missing from this schedule are Senators Patrick J. Leahy (D-VT) >> and Russell Feingold (D-WI) and House member Jerrold Nadler (D-NY). All >> three have impeccable cyberspace credentials and we look forward to seeing >> them online.] > >As Shabbir and Steve know, I'm a huge fan of VTW and congratulate them for >their successful efforts to keep netizens up-to-date on what's happening >in the meatspace body politic. > >But VTW's statement above is, unfortunately, untrue and misleading. > >Even though Sen. Leahy opposed the CDA, his stance on privacy illustrates >that his "cyberspace credentials" are anything but impeccable. His crypto >bill, introduced before Pro-CODE, would liberalize some export controls >but impose new and unprecedented criminal penalties for the use of crypto >associated with a crime. Worse yet, as recently as this month Leahy has >been clamoring to fund the invasive wiretapping legislation ("Digital >Telephony") he shepherded through Congress two years ago. > >Equally distressingly, Leahy demonstrated his "impeccable cyberspace >credentials" by cosponsoring the Senate online copyright bill -- aka the >Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious >folks who are demanding that the Boy Scouts and summer camps pay cash to >sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the >American Library Association, EFF, and teachers' organizations, Leahy's >bill would slam fair use rights online and could make it a crime to >browse the Net without a license. > >When VTW heralds Leahy as a friend of the Net with "impeccable cyberspace >credentials," they do the Net a disservice. Leahy is in no way a true >friend of the Net; I don't know of any Beltway politican who is. > >-Declan > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com / ** THE FIGHT FOR FREE SPEECH ONLINE CONTINUES TO THE SUPREME COURT ** It's not too late to be a part of history -- Join the Lawsuit <http://www.cdt.org/ciec> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Policy Analyst Center for Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP Key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger/

1 0

Re: Cypherpunk voting - ITAR or CDA
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Aug 26 14:32:37 1996 I sent this earlier, but evidently toad.com ate it, so I am sending again, despite Bill Stewart's excellent post on the subject. BTW, Bill is one of the nicest guys you would ever want to meet, and all cypherpunks should try to meet him if they get a chance. Apologies if you get this twice, and I would only add that in any election there are winners and losers, and the sets of losers on cypherpunks if Harry Browne wins or does does well are: 1. Lawyers. If laws are simpler and better-written in something approaching the English language and judges who respect the constitution are selected-for, lawyers and law-professors would feel the economic effects of less demand for their services. 2. Accountants. If the tax laws are simplified and the IRS is eliminated, there will be less need for accountants to figure out what people actually owe in taxes. 3. Offshore dataheaven providers. ;) If the above happens, running businesses from the US will be relatively more attractive than running them from Anguilla, all other things being equal. Vincent Cate wrote: > Dole says he would fix the ITAR problem, but try to keep something like > CDA. He would say anything to get elected. > Clinton is keeping ITAR and signed CDA. But not having the religious > right he might soften on CDA. Lame ducks don't have to soften, on anything. That's what's so fun about being a lame duck. > The courts seem to be throwing out CDA much faster than ITAR (some fast > track to the supreme court built into the law). It also seems like > ITAR > is the more important thing to fix (it is easier to move pornography > etc > out of the US than major software companies). > > So it seems Dole is the better vote. Is this important enough to many > cypherpunks to actually determine their vote? If the Republican candidate had been Forbes, there might have been a "don't let the great be the enemy of the good" argument against voting for a Libertarian. As it stands now, Dole is, at best, arguably the "lesser of 2 evils," which still comes out evil in my book. As the designated partisan Libertarian on the list, I urge all cypherpunks to vote their consciences and pick Harry Browne and Jo Jorgensen. The mere fact that the media is [grudgingly] covering us suggests we are finally doing something right, and Harry is winning many Internet polls despite much fawning, hopeful coverage for the big-eared billionaire hypocrite stealth-candidate, who has no position on much of anything, but certainly would enjoy having the TLAs investigate his enemies. I fully accept that it is likely Dole or Clinton will win, but I think it will fill an important cypherpunk goal if the Libertarian Party candidates get a vote large enough to be the margin of victory, and I will be very proud of my vote, no matter who wins this election. Vote your consciences for your own sake, and the sake of the children who, no matter what, will inherit the debt of the irresponsible statists in power now. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "'Filegate' is starting to make _Ed_ _Meese_ look ethical." -- me Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray C Ross Perot is now on welfare.<sigh> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMiHtzG1lp8bpvW01AQFxxAP9GW/NizRkEqW0y4b0vGF5npoOGQj4jSVQ wBz8toN78LUY1xKyEj2y0WWqjfl3WQOMk2dCMlRskHZU8C8+nqLS3FgHaWCwrVF+ Th7LA3hvErvoVNKsrRTKAuGUkIm8XFQLfmPi8L6z94OXY5qXXRvVS9exRwlbH/DZ gpwGznNDjw0= =t8M2 -----END PGP SIGNATURE-----

1 0

GIFs of Observer [UK] anti-Net, anti-Remailer fear-mongering
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 09:44:24 -0700 (PDT) From: Rich Graves <rich(a)c2.org> To: fight-censorship(a)vorlon.mit.edu Subject: Observer anti-Net story on the web Blatant copyright violation at: http://scallywag.com/ It's a couple of 105K GIFs. US Copyright terrorists may wish to mirror this information lest the intrepid Scallywag melt down. -rich

1 0

bot at anon.penet.fi
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

C'punks, I posted the contents of a web site containing netspam stuff to cypherpunks. In the transaction a bot at anon.penet.fi caught my mail (thought it was a copy of the infamous Make Money Fast chain) and posted me a FAQ and bounced my message. (Though it seems to have reached cypherpunks already) -Vipul

1 0

Cypherpunks at InfowarCon '96
by Mark O. Aldrich 17 Dec '03

17 Dec '03

There've been a couple of posts mentioning that there will be a Cypherpunk presence at InfowarCon '96. Besides the more public figures (Eric Hughes and Phil Zimmermann, among them), I'm sure that the audience will have a fair number of list participants in attendance. If anyone wants to say "howdy" or swap key fingerprints, I'll be there both days and for the reception on the 4th. I'm the panel moderator for "B1 - Emergency/Disaster Planning for the Effects of Information Warfare" affair on the 5th (stop by if you want to see FEMA and the Red Cross go at it). If you're at the "schmooze and booze" reception on the evening of the fourth, please come up and introduce yourself. I'll be the guy who's 6'2", 200lbs, shoulder-length brown hair in a red bandanna headband, full beard, jeans, boots, and my leather biker vest. I should be fairly easy to spot :) ------------------------------------------------------------------------- |Just as the strength of the Internet is |Mark Aldrich | |chaos, so the strength of our liberty |GRCI INFOSEC Engineering | |depends upon the chaos and cacophony of |maldrich(a)grci.com | |the unfettered speech the First Amendment|MAldrich(a)dockmaster.ncsc.mil | |protects - District Judge Stewart Dalzell| | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Nuke attack? No, bug in DNS! (fwd)
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

I think this is the main cause of all strange things happening on the net for last few days. Vipul Rishab A. Ghosh Wrote : > Was I the only one nuked by the DNS/BIND crash yesterday? I hope > I've not been automatically unsubscribed from the list. As not > everyone here reads c.p.tcp-ip.d I've attached Karl Denninger's > analysis. For those who were luckily immune, my ISP (best.com) like > many others, had it's DNS crash for _local_ domain names (belonging > to the ISP and customers like me) through most of yesterday. No, > not a virus, but bad DNS records "floating around" as Karl puts it, > that happened to expose a bug in the latest version of BIND. > > So much for immunity to nuclear war! > > Rishab > > > From: karl(a)MCS.COM (Karl Denninger) > > Newsgroups: comp.protocols.tcp-ip.domains > > Subject: SERIOUS PROBLEM WITH DNS SERVERS AND BAD RECORDS - Rev 4.9.4 > > Date: 23 Aug 1996 10:10:39 -0500 > > Organization: MCSNet Ops, Chicago, IL > > Message-ID: <4vkhlf$u4(a)Jupiter.mcs.net> > > > > CAUTION! > > > > There are a series of bad nameserver records floating around on the net > > which are blowing up BIND versions 4.9.4 (REL and T5B) and possibly other > > releases as well. > > > > This has been VERIFIED to be impacting multiple ISPs and their DNS servers. > > > > We are shutting off updates from ANY DNS server which presents bogus data, > > which stops it from killing our code, but is of no help to the large number > > of domains which are presumably rendered unreachable. > > > > At present, this list is: > > > > bogusns 204.94.129.65 158.43.192.7 > > ; > > bogusns 199.3.12.2 38.241.98.5 199.71.224.105 206.215.3.10 > > bogusns 134.75.30.253 198.41.0.4 128.63.2.53 198.41.0.4 > > bogusns 206.66.184.11 206.66.104.37 > > ; > > bogusns 163.173.128.6 163.173.128.254 200.6.39.1 192.33.4.12 128.174.36.254 > > bogusns 129.79.1.9 128.174.5.58 > > > > > > All of these have presented at least one malformed record to us in the > > last two hours! > > > > Folks, if you run one of these servers, start tracking down the problem on > > your end. If this is bad cached data, THOSE AFFECTED MUST FLUSH IT > > AS SOON AS POSSIBLE TO TRY TO PREVENT PROPAGATION. > > > > This problem started as an isolated set of incidents yesterday, and is now > > spreading like wildfire. > > > > The actual bad data appears to be a domain name being returned in an > > authority record which is of the form "domain.com<tab>com". We have not > > yet caught a bad returned record in a debug file; that is being attempted > > now. > > > > When this goes through "dn_expand" in the BIND code, it causes memory > > arena corruption and subsequent failure to resolve VALID zones which you > > are authoritative for. First signs are reports of "corrupted authority data" > > if you are using "dig" to check zones which you hold authority records for. > > > > We are working on a way to "harden" the code against this kind of junk data, > > but until we can get one deployed our defense is to shut down communication > > from those who are presenting us the garbage. > > > > PLEASE CHECK YOUR NAMESERVERS OUT AND TAKE NECESSARY STEPS YOURSELF! This > > is a serious problem which has the possibility of melting significant parts > > of the Internet infrastructure. > > > > -- > > -- > > Karl Denninger (karl(a)MCS.Net)| MCSNet - The Finest Internet Connectivity > > http://www.mcs.net/~karl | T1 from $600 monthly; speeds to DS-3 available > > | 23 Chicagoland Prefixes, 13 ISDN, much more > > Voice: [+1 312 803-MCS1 x219]| Email to "info(a)mcs.net" WWW: http://www.mcs.net/ > > Fax: [+1 312 248-9865] | Home of Chicago's only FULL Clarinet feed! > > > > > > -- > > bryant durrell http://www.innocence.com/~durrell > > durrell(a)innocence.com http://www.innocence.com/fengshui > > durrell(a)bofh.net http://www.innocence.com/shadowfist > > big black nemesis parthenogenesis no one move a muscle as the dead come home > > > >

2 1

Re: USPS
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:54 PM 8/26/96, Bruce M. wrote: >On Fri, 23 Aug 1996, William H. Geiger III wrote: > >> Once in place all the goverment needs to do is ban all e-mail not sent >> through their system. Add this to the outlawing of all non-keyescrowed >> encryption, and the ability to archive all messages sent through their >> system. Now the goverment would have total access to everything you >> wright. > > Why not? I believe it is already illegal to place anything in a >person's physical mail box that the post office hasn't processed. For >the sake of preserving the 'integrity and security' of the Internet I >can see the govt. taking such future actions. I'm skeptical of this analogy (that it could be used to take control of e-mail). The postal mailboxes that the Postal Service claims to control are those that are either marked "U.S. Mail" or fit the form and function typically associated with a "mailbox." A box standing on a post by the side of the road near one's house, for example. Often saying something about "Approved by the U.S. Postal Service," blah blah. The Postal Service has nominal ownership of these boxes, even when installed by customers (as is the norm, of course). (This comes up in one major way: non-Postal Service deliveries are not supposed to be made into such boxes. Secondly, there are limits on what customers can do to "defend" these boxes against vandals...this has come up in discussions of placing a small box inside a large box and filling the space between with cement, to break the arms of hooligans who play "mailbox baseball.") Anyone is free to place boxes on their property marked "For Federal Express Deliveries," "For Packages from Neighbors," etc. Or to rent "Mailboxes, Etc."-type boxes. These latter examples are analogous to e-mail accounts folks have at various ISPs. Or to Mailboxes, Etc.-type rental boxes. The Postal Service has limited jurisdiction over rental mailboxes, and even less authority over my placing of a "UPS leave stuff here" box on my porch. Thus, I don't seen the analogy as giving the Postal Service more sweeping powers over e-mail than they already have over physical deliveries. And given the already-anarchic and already-distributed nature of e-mail, it's hopeless. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

The Observer [UK] editorializes against online freedoms (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

Information longs to be free, even if some forums aren't... We've put scans of the full story onto www.scallywag.com. The source is a reporter for a competing newspaper. ---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 09:40:43 -0700 (PDT) From: Rich Graves <rich(a)c2.org> To: fight-censorship(a)vorlon.mit.edu Subject: Re: The Observer [UK] editorializes against online freedoms Attribution for the forward deleted on request. Richardson's included PGP-signed letter, though, is public. I hope this reassures US activists that *even the British* know the story is wrong. -rich ---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 12:24:05 +0100 Subject: Response to Observer A nice technical response to some of the factual innacuracies in The Observer piece. Not quite the way I would have done it . . . but good nonetheless. -----BEGIN PGP SIGNED MESSAGE----- I. T. Consultancy Limited Our reference L2217 The Editor The Observer 119 Farringdon Road London EC1R 3ER 26 August 1996 AN OPEN LETTER - FOR PUBLICATION Sir, I read with some interest the article by David Connett and Jon Henley in yesterday's edition regarding the Internet and child pornography. I was particularly interested as I am a computer consultant advising clients on Internet issues. In my professional opinion, the technical standard of the reporting was sufficiently poor as to be both inaccurate and misleading. The purpose of this letter is to clarify certain technical issues which might cause your readers to reach unfounded or incorrect conclusions. It is important to be aware of the various methods by which information generally (which can include pornography) is distributed around the Internet. Your article focuses on one particular route, namely Newsgroups. It is Newsgroups which are detailed in the Metropolitan Police's letter to Internet Providers and which are concentrated upon by your article. There are several other means of distributing information. I believe however that the Police letter lists fewer than the 150 groups referred to by the authors. Interestingly enough Newsgroups only offer the means of broadcasting information to anyone who wants to retrieve it. The authors do not appear to have a sufficient grasp of what a "remailer" does. For example they seem to draw a direct link between the use of such remailers and people being able to "log on and participate in 'live' and 'interactive' filmed sessions". A lay reader would perhaps draw the inference that the remailer is somehow involved in any such live participation. Unfortunately this could not be further from the truth. Remailers simply allow people to post messages, either as email to other people or to Newsgroups for general reading. Nothing more. Remailers are generally incapable of being "logged on" to. Your article also refers to "remailing companies", from which the lay reader might infer that remailers are operated for commercial profit. Such an inference would again be wholly incorrect. I know of no organisation operating a remailer for profit, indeed none of them even charge for their services. They are generally run by individuals on a voluntary basis who consider them as a service to the Internet community. Your article appears not to mention any of the purposes of such remailers other than in terms of the distribution of pornography. In my view it would be difficult to present a balanced article without doing so. Different remailers take different steps to prevent whatever their operators consider as "abuse". My understanding is that Mr. Helsingius' service restricts messages to 48k bytes (or characters) and prohibits postings to the "binaries" newsgroups designated for images. I also understand that it only allows 30 messages per user per day. At a technical level these restrictions would make it almost impossible to use his service for mass distribution of any binary data, not just pornography. It therefore appears surprising to me that your article should allege that Mr. Helsingius' remailer is responsible for handling "90 per cent of all child pornography" on the Internet. I wonder what substantiating evidence The Observer has to this effect other than the alleged claim by Toby Tyler. Indeed it appears from your article that the words "is supplied through this remailer" may not be a direct quote from Toby Tyler. Your article alleges that "the photographs made available to Demon's subscribers through the Internet are supplied anonymously by remailing companies". The lay reader might infer from this that all photographs therefore come via remailers. Again this would be far from the truth. Finally I hope this letter offers some assistance to your readers in clarifying a number of issues which were perhaps less than clear in your article. Given your newspaper's difficulties with technical issues, I would be grateful if you would kindly refer any editing of this letter to me prior to publication. Yours faithfully, Matthew Richardson -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAgUBMiFvEAKwLwcHEv69AQGjIQP+IGR9rhvdYXe7CuCcwPl/tIrIBryikTM2 IVOpygTF2nCPf3WEJ8czRvs1emp9d9d++69XiG1f6QAeP9Jv/h9KzVtV7mjjuqCX LhlhXBYjLIiGCcxljKZ07zHFlCeZWCzuAmIFnZbz2fNNjqyicheIMlxI2tDrGgjp dlaGZuAI2XY= =dkXg -----END PGP SIGNATURE-----

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by James A. Donald 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. Not true, some of them are merely less dangerous and harmful than others. As to whether Leahy is one of the less dangerous and harmful ones, that is seriously questionable. > The fact is that short of armed rebellion they are going to be > here for a while.I shudder to think of the wrath our opponents > could wage if we all threw up our hands packed up our bags and left town. Bad cop, good cop. You cooperate with the "good" cop, you go to jail. You tell them both to go to hell, then maybe you will not go to jail, and if you do go to jail, at least you will have the satisfaction of screaming injustice all the way: Re read what our "good" cop has been up to: > > Worse yet, as recently as this month Leahy has > > been clamoring to fund the invasive wiretapping legislation ("Digital > > Telephony") he shepherded through Congress two years ago. > > > > Equally distressingly, Leahy demonstrated his "impeccable cyberspace > > credentials" by cosponsoring the Senate online copyright bill -- aka the > > Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious > > folks who are demanding that the Boy Scouts and summer camps pay cash to > > sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the > > American Library Association, EFF, and teachers' organizations, Leahy's > > bill would slam fair use rights online and could make it a crime to > > browse the Net without a license. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Credit enforcement
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:43 PM 8/17/96 -0400, you wrote: >I thought that classical libertarians agree that the enforcement of >contracts is a proper function of the government. The minarchists generally do, the anarchists generally don't, at least if you're talking about last-resort contract enforcement. The primary mechanisms always have been to use the market, whether through reputations, insurance companies, bonding agencies, boycotts, or (often the most powerful) the sheer value of repeat business. Much of the development of commercial law from the Romans through the Middle Ages been to find peaceful and efficient ways to do business without the King helping. There are historical alternatives to having government do it; the Irish, Icelandic, Somali, and American Arbitration Association non-state-based justice systems had/have various sets of social pressure to do the job. (For instance, Somali dispute resolutions usually end up with some number of cows or other money getting paid to a winning plaintiff, and if you don't pay, your extended family has to. Rarely, the family also refuses and bringing in a higher-reputation judge fails, and a brief feud ensues...) On the "should the government or the free market do this" scale, most people put last-resort contract enforcement at the "we don't mind too much if the government does it" end rather than the "overthrow the government if they even think about touching it" end, which is for issues like sex, drugs, rock&roll, freedom to travel, etc. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Whistleblowing on the Internet
by Geoffrey Gussis 17 Dec '03

17 Dec '03

I'm writing a paper for my ethics class on Whistleblowing, and specifically how it has been aided by the Internet. If anyone knows of any resources, pointers, etc., I would greatly appreciate it. The results will be published on-line, and I can send a copy to anyone who is interested as well. I am interested in information covering both the private sector and the government as well. I do know that the Federal Government has an online BBS where you can send in information on fraud, etc. What I have uncovered so far: + As far as a Lexis/Nexis search goes, I only found a few articles, and they centered around the Tobacco Papers, and the Scientology debate. + I located the Whistleblowing FAQ and contacted its author, but its last update was in 1994 and it is no longer being maitained. + I visited a couple of other related Internet sites (I searched using many search engines), but they don't really have examples of using the Internet for whistleblowing purposes. + I am also aware of the majority of Anonymity/Privacy sites on the Internet, and will definitely be utilizing them in the paper. Overall, I am quite surprised that there isn't a whistleblowing clearinghouse on the Internet; a site sponsored by a non-profit that lists email addresses and secure forms for sending anonymized email to those areas of the public and private sector that deal with whistleblowing. As the Internet is a great medium for information dissemination, and offers significant privacy advantages, I really expected to find much more. Is anyone else working in this area? Any help would be greatly appreciated. Cheers, Geoffrey Gussis 2L - Washington University School of Law ___________________________________________________________________ Internet Law Projects at http://www.digidem.com/legal/ + Worldwide Top-Level Domain/Trademark Dispute Resolution Policies + Businesses on the Internet (BOTI) Legal Research Initiative + Legal Links in Electronic Commerce and Interactive Entertainment

2 1

CLE_nup
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-26-96. FiTi: "Cleaning up the global economy. Policymakers must ponder the effects of money laundering." Is money laundering - as opposed to the crimes which produce it - necessarily such a bad thing? As Vito Tanzi notes in his IMF paper, the fact that money launderers are not fussy about economic fundamentals can help governments continue to pursue lax fiscal and monetary policies if they are equally unfussy about the origin of capital inflows. A pact with the devil, perhaps. But for many countries it may seem more attractive than signing up to a global financial market equivalent of Neighbourhood Watch. + Money Laundering and the International Financial System, IMF working paper, May 1996. ----- http://jya.com/clenup.txt (7 kb) CLE_nup

1 0

Re: Cypherpunk voting - ITAR or CDA
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:37 AM 8/25/96 -0400, Vincent Cate wrote: >So it seems Dole is the better vote. Is this important enough to many >cypherpunks to actually determine their vote? Every time I think about voting for Dole, I read something in the papers that convinces me it is a bad idea. The most recent is that he wants to raise the intensity of the disastrous, failed war on drugs. You know the war. The one that has forced suppliers to enforce their contracts with violence because the courts won't help them. The one that eliminated the concept of responsible use which has worked so well with alcohol. The one that has eliminated reputation from the drug market, leading to overdoses and poisonings. The one that is responsible for most of the wire taps authorized in the USA. The one that has turned the USA into the prison capitol of the world. Don't get me started. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

RSA/Security Dynamics filings are on the web
by John Gilmore 17 Dec '03

17 Dec '03

The RSA/SDTI merger may be the only chance we ever get to see RSA's financial info. Previously it was a privately held company, which didn't report its finances publicly; now it'll be reported as part of SDI (a much bigger company), so its finances will be hidden in their larger business. You can also see what RSA and SDTI are saying about the RSA/Cylink/Schlafly lawsuits, the origins of VeriSign, how Addison Fisher bankrolled RSA and owned 55% of it, etc. Look on the SEC's EDGAR system, which contains copies of reports that the government requires publicly traded companies to file. Go to http://www.sec.gov/cgi-bin/srch-edgar?security+dynamics+technologies and view the various forms. The most fun is probably the big one, the 1.5MB S-4 form from the merger itself. These documents will require a tolerance for legalese, but there are lots of gems in there for the patient. John Gilmore

1 0

ADMIN: Problems with the list goto the owner, not the list!
by Hugh Daniel 17 Dec '03

17 Dec '03

In the future please send all messages of the form ~something is wrong with the list~ to owner-cypherpunks(a)toad.com and NOT the list its self. We already have enough off topic and puerile traffic cluttering up the list. If you think you see a _very_ major problem then please do email me directly. Now please get back to building the better world we sometimes still talk about building... ||ugh Daniel Majordomo Owner & Potty Trainer hugh(a)toad.com

2 1

Code Review Guidelines (draft)
by Adam Shostack 17 Dec '03

17 Dec '03

A few weeks back, I posted a request for source code review guidelines. I got about 50 me-toos, but no guidelines. So I wrote some I think are decent. They're still in draft format. I'd appreciate feedback & commentary on them. http://www.homeport.org/~adam/review.html Adam PS: Someone did pay me to do this, but doesn't want their name associated with it, because there are shoulds and musts in it. I have their permission to post the anonymized document. -- "It is seldom that liberty of any kind is lost all at once." -Hume

5 8

The POUCH
by JOHN E. HOLT 17 Dec '03

17 Dec '03

The Pouch uses a 64 x 64 block product cipher, a 1024 bit random initialization vector and the CBC technique. Most experts agree that such an implementation is highly resistant to all forms of cryptographic attack. Hellman and Dilfie rely on knowing the algorithm for their known plain text attacks An unpublished algorithm forces them into reverse engineering the computer programs to learn the algorithm. The POUCH has many roadblocks built in to prevent this. I refer to Cummings, Cryptography and Data Security pages 150 and 98 in this regard. John Holt

6 5

Re: Sen. Leahy's "impeccable cyberspace credentials"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 18:52:40 -0700 (PDT) From: Declan McCullagh <declan(a)eff.org> To: Jonah Seiger <jseiger(a)cdt.org> Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, telstar(a)wired.com Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) Jonah, I had expected some negative feedback from CDT, but I should say I was surprised by the tenor of your response. Unfortunately, you don't address the substance of my criticisms of Leahy: how can you defend Leahy's avowed support for Digital Telephony and the copyright legislation? How do his actions make him a "forceful" and "consistent advocate" with "impeccable cyberspace credentials?" (Hint: They don't. He isn't.) You write that: "Of course we are not going to agree with our friends on every issue." But I disagree with your underlying assumption; if a senator is our "friend," they won't do what Leahy does. Being familiar with technology does not a Net-advocate make -- take Al Gore, for instance, who net-surfs in an Old Executive Office building cluster... If I'm wearing any hat at all right now, it's my cypherpunk one. And that prompts me to say that we'll have more freedom online not by relying on the legislative process, but by deploying pro-freedom technology like anonymous remailers and PGP. We can't rely on an ossified Beltway Bureaucracy to preserve our freedoms. (In fact, we need to shrink the size of the Federal bureaucracy drastically to make it less susceptible to special-interest lobbying and to reduce its ability to encroach upon our civil liberties.) We've argued about this before, of course. I recognize that we have core philosophical disagreements. You want to work the legislative process and compromise, while I believe that some rights can't be negotiated away. I recall you supported White's "Harmful to Minors" CDA compromise that would have created a new and unprecedented category of speech crimes online. (The ACLU's Barry Steinhardt wrote on this list last fall that "no true civil liberties organization" would support such language.) You joined Leahy in supporting the Bennett bill, which would have permitted Equifax to create a national medical database with few privacy safeguards. Not to mention your defense of Leahy's pet Digital Telephony project... You write: "But none of them [members of Congress] are gong to continue reaching out a hand to us if we bark and bite when we don't get 100% of our way." I'm confused by this. Does it mean we shouldn't slam Leahy when he fucks with the Net? More disturbingly, the incorrect and misleading label of "impeccable cyberspace credentials" makes it more difficult to criticize Leahy when he does something (like DT funding or copyright) that harms netizens. I suppose you'd like to champion Leahy as a "Friend of the Net." But I'd rather not ignore his attempts to pass legislation that would hinder the development of the Net and intrude on our privacy. I reiterate my earlier statement: "Leahy is in no way a true friend of the Net; I don't know of any Beltway politican who is." -Declan On Mon, 26 Aug 1996, Jonah Seiger wrote: > Declan: > > What are you thinking?! > > In a world where we have very few real friends, I simply don't understand > what you are trying to accomplish. It's fine (and healthy) to raise > concerns about the particular positions a member of Congress takes (hell, I > don't agree with everything Leahy does), but to simply dismiss Leahy as a > 'no friend of the Net' is naive and counterproductive. > > Look at the record. Leahy is hands down the strongest supporter of the Net > in Congress. Period. No other Member (including our small but growing > handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has > been a more forceful or consistent advocate for your causes for as long as > Leahy has. What exactly do you want? Perhaps we should elect you to > Congress and see how well you can do. > > Of course we are not going to agree with our friends on every issue. If > Leahy takes a position you don't like, I'd suggest you talk to his office. > I have found in my experience that Leahy's staff (and him personally) will > take the time to listen when presented with a well presented argument. > > I'm also confused about another thing: which hat were you wearing when you > wrote this? If it is your "advocate" hat I think it must covering your > eyes. If it's your "journalist" hat, you need to do a bit better job of > checking your facts in the future. > > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. The fact is that short of armed rebellion they are going to be > here for a while. > I shudder to think of the wrath our opponents could wage if we all threw up > our hands packed up our bags and left town. > > Face the facts. Members of Congress have a lot of constituencies to deal > with, and we are a small and relatively powerless faction. We can do a lot > to change the outcomes of policy debates (if I didn't believe that I > wouldn't be doing what I do everyday), but we have to be realistic, > recognize where we fit in to the process and who are friends are. One > thing's for sure - we have A LOT more enemies than we have friends. > > Most members of Congress don't really understand us or our issues. Many > are willing to learn, and some have been real champions for our causes. > But none of them are gong to continue reaching out a hand to us if we bark > and bite when we don't get 100% of our way. Zealots rarely win (though it > sure is fun to throw bombs). > > Sorry for the public thrashing, but this kind of attitude REALLY gets under > my skin. > > Flames welcome (though response is not guaranteed <g>), > > Jonah // declan(a)eff.org // I do not represent the EFF // declan(a)well.com //

1 0

Scan the Web for Live News, Sports, & Music (Talking E-mail)
by RealAudio Talking E-mail 17 Dec '03

17 Dec '03

-------------------------------------- | Make this e-mail talk! | | Load this URL into your Web browser: | | http://www.realaudio.com/tmh.ram | -------------------------------------- Dear RealAudio Customer, Since you downloaded our free RealAudio Player a while back, you have heard some pretty amazing things on the Web. Now you can hear even more with RealAudio Player Plus, an enhanced version of the RealAudio Player. RealAudio Player Plus has a scan feature that lets you scan the Web for live music, radio, sports, and news. It also has Preset Buttons, like a car radio, that take you straight to your favorite RealAudio sites. Please visit our Web site to find out more: http://www.realaudio.com/tmhplus/index.html We hope you enjoy RealAudio Player Plus, Rob Glaser Bruce Jacobsen Chairman & CEO, President & COO, Progressive Networks Progressive Networks

1 0

cryptocd grabbing material
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Aug 27 09:01:57 1996 If anyone out there knows of anything I should (and am allowed to) put on the cryptocd (check www.rpini.com/crypto/cryptocd.html) let me know. If anyone out there knows of anything I MUSTN'T put on the cryptocd (due to copyright, law or whatsnot), let me know also. Thanks, Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiKdZhFhy5sz+bTpAQEg9gf9EY+SvhGMW1iKB+2U0JVNs3zDqGPNkYpJ zM9WW2oxTtTWn4znjMTXWEVAbGzmdZCkmgHsN3tFWwkWxIYxXrfFcInPNqCzxcXG DZHcQ2nNkH1MOnQ0Wzp9l9riz8TBCzbZNtJsPoVKMup6qAGLV6ninCrAKBGaQJmY 1KR3yez3OVq04SkRXUjXKQRjwtKH2OWmZfzSormEwphHvjgE0nPJhLB9gnVDevTw lSY3YP2NBPtIlaJbxohkvro8Mm+FGIk2vVoOY6cXwFcpZWONtyiwZPiYQzFfcOzw yjbIzGU8qU5MH58MeS/wZuTVzHhtmRl7lCLYS2xPH73ZpgvUh3ZDsw== =LGSU -----END PGP SIGNATURE-----

1 0

Re: Spamming
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 26 Aug 1996 13:26:04 -0500, John Deters wrote: >>What do cypherpunks think about the following practice or law (I realize >>that it may be impossible to implement): each email message should carry >>a little digicash check for, say, 20 cents. Mail reading programs should >>reject (send back unread) all messages not carrying these digital >>checks, unless the senders are in the "friends list". The MUAs should >>ask users whether they want to "cash" the digital check or not. > >I do not believe it is possible to have a secure executable that exists on >an uncontrolled user's machine. "Tamperproof" encryption chips still >require communications in and out from the user's program. A determined >attacker could continue to use the pieces of their code that talk to the >encryption chip. >Never underestimate the allure of "free money" when you're planning to >give >it away. Methinks you don't understand e-cash. It's not executable, and uses public key crypto to prevent "minting". It uses records to prevent replays. In other words, it'd be like Ed McMahon including a quarter in the envelope. You'd only be able to use it once.... / If you think education is expensive, try ignorance. / Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp / Autoresponder: send email w/subject of "send resume" or "send PGPKEY" / Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 / Member in good standing of the GNU whirled hors d'oeuvre

1 0

File System Encryption
by drifter＠c2.net 17 Dec '03

17 Dec '03

I'm aware of the three main disk encryption programs SFS, SECDRV, and SECDEV, but I need to find a solution that works with Windows 95 32bit or Windows NT 4.0. I'm currently using SFS 1.17 and Secure Drive under Win-95, but am unable to continue to work in dos compatability mode due to severe performance hits. I am open to commercial products that have passed peer review, but know of none. If anyone could suggest a solution (outside of switching OS's), I would be *most* gratefull. Please respond to the list, as I am a subscriber under another account. The Drifter

6 7

Re: libelous action
by C Matthew Curtin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "JOHN" == JOHN E HOLT <76473.1732(a)CompuServe.COM> writes: JOHN> Dear Mr. Curtin JOHN> Your statements about myself and my product, The JOHN> POUCH are defamatory. Since they have been made in writing and JOHN> shown to and seen by other parties on the Internet, they JOHN> constitute libel. Please admit to all parties that you have no JOHN> personal knowledge of my product capabilities or my personal JOHN> character or reputation. Failure to do so at once will result JOHN> in legal action against you personally and Megasoft. As my signature said, I speak only for myself. I am not a representative of Megasoft in any official capacity. That which I have posted does not represent the views of Megasoft, its employees, its shareholders, its customers, its business partners, its landlord, its employees' mothers, and is in no way representative of any person living or dead, other than myself. I have no knowledge of JOHN E HOLT <76473.1732(a)CompuServe.COM>. The only knowledge I have of THE POUCH is its web site, found at http://www.flagler.com/security.html On 18 August 1996, I posted to the Cypherpunks mailing list, a note regarding THE POUCH, which included this paragraph: If it is any good, there's no way for us to know. But your marketing of the product has every indication that it's nothing more than smoke and mirrors. To coin a phrase, "pseudocrypto." I, speaking only on behalf of myself, stand by this statement. I do not apologize for my comments. If you, Mr. Holt, feel that this is a personal attack against you, I regret that you've misunderstood the tone and nature of my post. My statement is hardly libelous; I simply observed that if your product is truly secure, there is no means by which security experts can verify such claims. Study of computer security has shown that obscurity (using unpublished algorithms, for example) is not "security." By perpetuating confusion between the two terms, nonexpert users of crypographic software are hard pressed to make good decisions about what they use, and the risks of the software they're using. Hiding the internals of such software, claiming that it is "highly resistant to all known forms of cryptographic attack," is, in my opinion, irresponsible marketing. It is my hope that future marketing endeavors of THE POUCH will be more open and straightforward in its approach to security, providing evidence of a crystal-box architecture, whose security can be more objectively determined by potential customers. Hiding a paper from me by putting it somewhere in New York City is obscurity. If you hide a paper from me by putting it in a safe, and then give me the safe, and the technical documentation of the safe's locking mechanism, and I still can't get the paper, then *that* is security. (And, by the way, I think you'll find insisting that I somehow retract my statements, rather than prove me wrong by showing the quality of your product, will likely further add to the suspicion that the security of THE POUCH cannot be proven.) - -- C Mattew Curtin cmcurtin(a)ee.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQCVAwUBMiJEYRhyYuO2QvP9AQFPmwQAgimf3IhoX4wMPPNk7JY9nlFDJG2K/gO3 Xnd7ygPYAhz4BRaEl6SAaOOWiKjBA1l5EI5GhZdTL0WIWdKQv5MJROElzTVcY7nx Tq1wysgTRTLjt7XQS2FyIa1S7OSvyhJttAslbJjpl+PqCwT18bhr3Oh9Cp2g1LRq sNxdtB1BtQQ= =I28g -----END PGP SIGNATURE-----

3 2