December 2003 - cypherpunks-legacy

Re: russia_1.html
by S. M. Halloran 17 Dec '03

17 Dec '03

> I think this comment is in error. Plutonium has a half life on the > order of 250,000 years, so very little decay products would build up > in 6 years. The tritium used in thermonuclear weapons has a much > shorter half life, and would need to be replaced about that often. Since radioactive decay is first-order, the following equation applies: N = N exp(-kt) 0 where N=amount of material at time 't'; N = amount of material at time t; k=decay rate constant; t=time of interest. The decay rate constant (k) for first-order decay processes can be expressed as k = ln(2)/half-life. Hence the equation can be expressed as follows: N / N = exp(-[ln(2)/half-life]*t) 0 N / N will express the amount of substance remaining as a percentage 0 of the original. Plugging in the numbers: exp(-[ln(2)/250,000y]*6y) = 99.998% Hence, ca. 0.002% (actually less than that) of the material has decayed. It may be the case that even this minute amount of "impurity" could poison something like weapons-grade material, but I am not a radioactive materials expert. Mitch Halloran Research Biochemist/C programmer/Sequioa's (dob 12-20-95) daddy Duzen Laboratories Group mitch(a)duzen.com.tr

1 0

Non-US or US-exportable secure modems or RS232 crypto/authentication
by Bill Stewart 17 Dec '03

17 Dec '03

I'm looking for a source of modems that can be used in non-US sites that support built-in encryption or at least strong authentication (e.g. token cards would be great, or something stronger than simple password+dialback.) A box sitting on the RS232 side of the modem would probably work fine too, as long as it didn't interfere much with regular traffic. One of my customers would like a managed router network, but they're paranoid (probably reasonably so :-), and our router management folks insist on modem access to the router console port so they can do things like reconfigure routers or reboot them when they're hosed. The customer views dialback as cute but crackable, and would probably accept one-time passwords like S/Key but not basic reusable passwords. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Immigration & Green Cards
by billy＠bingo.edu.win.net 17 Dec '03

17 Dec '03

U.S. IMMIGRATION INFORMATION (GREEN CARDS) This is a one time message. This had to be done because of the urgency. Please forgive us if you are offended. If you dont respond you will never hear from us again, unless your address appears more than once in our database. Thanks. IMMIGRATION AGENTS WANTED (See end of document) GREEN CARD INFORMATION You dont need this if you are a U.S. citizen or permanent resident. We send you this information so that you can print & pass it to your friends or relatives who may need it. GREEN CARD LOTTERY (DV-99) The U.S. Government will be selecting another 100,000 people as winners of the next Green Card lottery (DV-99). The deadline to participate in this lottery is November 24, 1997. If you know of any people who need Green Cards, this could be their only opportunity. If they dont already have the instructions and regulations from the U.S. government, please tell them to contact the American Immigration Information Center and request for free information. Email to usvisa(a)aol.com or greencard1(a)consular.com Or call 202-429-5523. You may also write to American Immigration Information Center, 1825 Eye Street, NW Suite 400, Washington, DC 20006. VOLUNTEERS WANTED IMMEDIATELY Because of the recent changes in the immigration laws affecting millions of people living in the U.S., AIIC is currently recruiting as many volunteers as possible to help distribute immigration information to communities, schools, colleges, universities, churches, businesses, organizations, embassies, consulates, mosques, etc. If you are interested to become a volunteer please email to usvisa(a)aol.com or call 202-429-5523. Thank you. SOME OTHER EASY WAYS TO GET A GREEN CARD. If you know of anybody who may qualify for any of the following categories of Green Cards, please kindly relay the following announcements to that person: GREEN CARDS THROUGH THE NATIONAL INTEREST If you are a professional or researcher, or if you have a graduate degree and you intend to practice your profession or do research in the U.S. you may be able to qualify for a Green Card. You do not need an employer to file for you. You do not need Labor Certification. You can obtain your approval within 60 days, depending on where in the U.S. you will be practicing or doing research. For more information Contact the American Immigration Information Center and ask for Publication I-400. Email to usvisa(a)aol.com or greencard1(a)consular.com Phone:202-429-5523 Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006 GREEN CARDS FOR MULTINATIONAL EXECUTIVES & MANAGERS If you are employed as an executive or manager by a qualified company outside the U.S. for at least one out of the past three years, and you are going to take a similar position with a branch, affiliate or subsidiary of the same company in the U.S., you may qualify for a green card as a priority worker. If you currently hold an L-1 visa you may also qualify for a Green Card under this category. For more information please email to: usvisa(a)aol.com or greencard1(a)consular.com. Phone: 202-429-5523. Fax: 301-587-9776 Ask for publication I-450. GREEN CARDS FOR OUTSTANDING PROFESSORS & RESEARCHERS If you are a professor or researcher with an international reputation for being outstanding in a particular academic field, and you have been offered a teaching or research position at a university in the U.S., or a research position in a company or research organization in the U.S., you may qualify for a Green Card as a priority worker. For more information email to usvisa(a)aol.com or greencard1(a)consular.com and order Publication I-420. GREEN CARDS FOR RELIGIOUS WORKERS You may be able to qualify for a Green Card as a Special Immigrant if you are a minister, priest, rabbi, Buddhist, monk, or a religious worker authorized by a recognized Religious Institution to conduct religious activities and duties, whether or not you are considered a clergy. For more Information contact the American Immigration Information Center and ask for publication I-500. Email: usvisa(a)aol.com or greencard1(a)consular.com GREEN CARDS THROUGH INVESTMENTS Invest at least $500,000 in the U.S. and get a Green Card. For details on how to get a Green Card through investments, contact the American Immigration Information Center and order publication I-600. Email: greencard1(a)consular.com or usvisa(a)aol.com Phone: 202-429-5523. Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006 USA. MONEY BACK GUARANTEED GREEN CARDS (MBG PROGRAM) Are you looking for an Immigration Lawyer that can guarantee you a Green Card? Would you be willing to pay the cost of guaranteeing a Green Card? While nobody can actually guarantee you a Green Card, the MBG Program gives you the next best alternative. The MBG Program, developed and offered by the American Immigration Information Center, guarantees your money back if your Green Card Application is not approved within a specified period of time. That means if you apply for a Green Card through the MBG program, you pay nothing unless you get the Green Card. The Center assumes the financial risk of your effort to get the Green Card. Of course you pay for that risk when you end up receiving the Green Card. Because of the high risk involved the MBG program is relatively expensive. But you have nothing to lose through this program. You get a Green Card or you spend nothing. The MBG-1 program, for example, guarantees you an approved petition within One Year or all your money back! . Other MBG categories include MBG -2, MBG-3, MBG-5, MBG-7, MBG-10 and MBG-15. The cost range from $995 to $9,995 depending on the MBG category. To receive Free Information about the MBG program, contact the American Immigration Information Center. Email: usvisa(a)aol.com greencard1(a)consular.com Tel: 202-429-5523 Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006. USA. YOUR EMPLOYER CAN SPONSOR YOU FOR A GREEN CARD. Do you have a U.S. employer but you don't know how to approach him to sponsor you for a Green Card? Are you afraid that your employer will fire you if he knows about your immigration situation? The American Immigration Information Center (AIIC) has a special way to approch your employer and influence him to sponsor you for a Green Card without putting your job at a risk. If you have a situation like this contact AIIC at usvisa(a)aol.com or greencard1(a)consular.com or 202-429-5523 or 301-587-9165. IS YOUR IMMIGRATION CASE TAKING TOO LONG & YOUR LAWYER IS DOING NOTHING ABOUT IT? Let the American Immigration Information Center help you find and solve the problem. They may be able to push your case through. Email to usvisa(a)aol.com or greencard1(a)consular.com and ask for help. IMMIGRATION AGENTS WANTED IMMEDIATELY Do you live in an area with a high population of international people (in the U.S. or any other country)? Do you own an office space? Do you have a phone and a fax? Are you a people's person? Would you like to promote U.S. immigration programs and help collect data from applicants in your area? Are you ready to start now? If you answered "yes" to all of the questions above then you may qualify to become an Agent of the American Immigration Information center. If you are interested and ready to serve and earn big money, email to usvisa(a)aol.com and requst for a phone interview for the Immigration Agent position. Fax: 301-587-9776 Phone: 301-587-9165 or 202-429-5523 FREE IMMIGRATION CONSULTATION Do you need help or have questions in any area of immigration? Call the American Immigration Information Center today for a Free Consultation session. Phone 202-429-5523. email usvisa(a)aol.com E

1 0

P.S unperfect MISTY algorithm
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

unperfect MISTY algorithm source code which I wrote isn't Public Domain. When you use it ,You need to permit from me. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Smartcard trial in NYC
by Harka 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] [ Reuters | Wired | ZDNet ] _________________________________________________________________ Previous Story: IBM Seeks To Fill Gap In Internet Commerce Next Story: Intel Sells Entire VLSI Stake _________________________________________________________________ Monday October 6 10:08 AM EDT Two N.Y. Banks Launch 'Smart Card' Test By Cal Mankowski NEW YORK - New York's two biggest banks and the Visa and MasterCard groups begin a test Monday to find out how readily consumers and merchants will switch from cash and coins for smaller purchases to a wallet-sized plastic card. The smart cards, billed as a quick, convenient alternative to cash for making everyday purchases, are being distributed to customers of Chase Manhattan Corp. and Citicorp. Chase Manhattan is the largest U.S. bank based on assets and Citicorp is ranked second. Citicorp's Citibank retail bank will issue Visa Cash cards to its customers. Chase Manhattan will issue its customers the Mondex electronic cash product which will appear under the MasterCard banner. Backers have said a key aim of the test is to demonstrate that the different technologies of the Visa Cash and Mondex cards are inter-operable" when it comes down to everyday usage. As one participant put it, the aim will be to show that two systems can be used over one terminal. Participants will also be hoping the smart cards will prove more popular than they did during a much-ballyhood test in Atlanta during the 1996 Summer Olympics. I would have to say it was not as positive as we thought it might be," said one of the people involved in the Atlanta test. The person, who requested anonymity, said there was a "Catch 22" problem in the test -- with merchants declining to be involved because not enough consumers had the cards, and consumers complaining that there were not enough places to use them. Although the cards can still be used in the area, about the only place they are seen nowadays is the Atlanta area transit system. Another person familiar with the Atlanta test said that merchants surveyed after the Olympics said they liked it, citing among other things the added security that comes from not having a lot of cash around. The New York test has signed up about 675 merchant locations, a spokeswoman said Friday. The number represents an increase of about 35 percent from mid-September. The area targeted for the cards is west of Central Park between West 60th and West 96th Streets, encompassing an area known as the Upper West Side. A news release in September said Citibank and Chase would each distribute 25,000 of the smart cards to customers. Residents of the area who were not customers of either bank could get a stand-alone smart card from either bank. The smart cards work like a regular Automated Teller Machine card but contain a computer chip that lets customers load" value into the card at an ATM or at a special kiosk. As the cards are used at participating merchants, the purchase is deducted from the card's stored value. For merchants, the sponsors of the test say, the benefit is faster, more efficient transactions because the need to make change or handle checks is eliminated when the cards are used. Smart cards have also been tested successfully in closed" environments, such as athletics stadiums or at the Army's Fort Leonard Wood in Missouri, and participants have said the results have been good. The development of the smart card even gets people talking about carrying on commerce without any cash at all, although some believe that is a long way in the future. I just turned 50 and I have trouble envisioning that in my lifetime cash will go away," David Slackman, executive vice president of consumer banking at Atlantic Bank of New York, said in a recent interview. But, he admitted, the volume of cash will probably go down as other payment methods win popularity. Some proponents say the card industry is moving toward a "multi-application" card that includes a stored value feature, a debit or check" card component, and the traditional credit card. One issue that proponents of smart cards generally shy away from is the preference of some merchants to deal in an all-cash environment because of the opportunity to under-report income to tax authorities. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ Search News Help _________________________________________________________________ Previous Story: IBM Seeks To Fill Gap In Internet Commerce Next Story: Intel Sells Entire VLSI Stake _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

y2k
by Harka 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] [ Reuters | Wired | ZDNet ] _________________________________________________________________ Previous Story: Ameritech Closes Republic Asset Purchase Next Story: Microsoft Distributes 1.2 million Browsers _________________________________________________________________ Monday October 6 10:02 AM EDT Millennium Bug Threatens Financial Chaos By Nick Edwards SINGAPORE - The millennium bug computer crisis threatens a global liquidity lock-up that could send the world's financial markets crashing. With computers and automated systems now dominating global financial trade, experts fear the failure of a small proportion of systems on January 1, 2000, would bring chaos. Machinery installed to make markets more efficient could cause their collapse, shattered by computers that fail to recognize the start of another working day. At the end of 1999, many computers will either crash or start gushing out meaningless data because of programming shortcuts taken decades before to save computer memory. Abbreviating years to two digits did save memory, but set a time bomb ticking for the end of the century when clocks inside computers will read a meaningless '00' for the year 2000. And when the machinery controlling the money that makes the world go round seizes up, so too will the markets. It is our prediction that it will only take five to 10 percent of the world's banks payments systems to not work on that one day to create a global liquidity lock-up," said Robert Lau, managing consultant at PA Consulting in Hong Kong. I don't think the markets have quite grasped the implications of what will happen if the entire system goes down, " Lau told Reuters. Peeling back the layers of the millennium bug problem is a little like peeling back the layers of an onion and the end result is the same -- it brings tears to the eyes, analysts say. Banks will not be able to settle accounts, investors will not be able to access funds, traders will not be able to make deals, consumers will not be able to get cash, companies will not be able to buy materials. Computer experts and business analysts are concerned that the scale of the problem is severely underestimated. Lawyers say millennium litigation in the United States will be huge. We forecast $1 trillion of litigation in the U.S.," Jeff Jinnett of U.S. law firm LeBoeuf Lamb Greene & MacRae told a conference in London earlier this year. Taskforce 2000, a body working with Britain's Department of Trade and Industry, thinks the cost of ridding computers of their millennium bugs in Britain will be about 31 billion sterling. In the U.K. it would take the commitment of the entire IT (information technology) industry and that is not about to happen," said Taskforce 2000 executive director Robin Guenier. IT experts believe that if everybody in the world who has even a modest understanding of computer programming were to begin work correcting the millennium bug today, only 25 percent of the world's affected systems could be rectified. With international financial markets entirely intertwined, curing the millennium bug on Wall Street would be pointless if Asia were crippled. Some analysts think Asia's millennium problem is not as great as that of the West because computerization of routine business functions is not as widespread. But key financial markets like Tokyo, Singapore and Hong Kong are exposed. There might be less computing power in Asia, but that does not mean there is any less risk," Lau said. A global survey of millennium bug awareness and preparedness is under way at PA Consulting, which aims to publish it by the end of the year. Lau expects the findings to make depressing reading. One problem is that companies underestimate the problem significantly. Once they begin to work on it, their estimates of the cost of correcting it begin to escalate. Company directors do not see it initially as a business issue but an IT issue. Really it's the biggest business issue they face," Lau said. On the international foreign exchange markets for example, more than $1 trillion a day changes hands. Insurance is seen as one solution -- at least in terms of compensating firms hit by losses from the bug. But insurers face myriad millennium problems themselves and could end up being the biggest victims of the crisis. Not only do they have to tackle their own internal systems problems, their financial market transactions could be frozen by a global systems failure, their investments could plunge and the tangle of liability claims could be immense. Clients have not set aside enough money to deal with the millennium bug and the scale of the problem is too large for them to handle alone," said Singapore-based Aruno Salvi, general manager of Reliance National Asia Re. Sorting out who will pay for the damage by the thousands of cars likely to be in accidents caused by computer-controlled traffic lights that just blink out all over the world on January 1, 2000, is just one example. But there is a silver lining to the millennium cloud for some, as PA Consulting estimates it could see the end of three percent of the world's companies. On one level the millennium bug is a great opportunity. Some of your biggest competitors are going to go out of business," Lau said. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ Search News Help _________________________________________________________________ Previous Story: Ameritech Closes Republic Asset Purchase Next Story: Microsoft Distributes 1.2 million Browsers _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

2 1

Jim Bell 5
by John Young 17 Dec '03

17 Dec '03

We've received a report on Jim Bell, a request from him for books, and his scenario for punishment, contrition, revelation, redemption, begging mercy from Sam: http://jya.com/jimbell5.htm What a vicious ransom racket the Sam's devil church runs, burying the victim in hell, torturing for tithe.

2 1

[news] TimeStep introduces large-scale security solution for VPNs
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

TimeStep Corp. Monday introduced PERMIT Enterprise, the first secure virtual private network (VPN) solution capable of large-scale business communications over the Internet. By integrating best-of-breed technologies from market leaders, PERMIT Enterprise allows service carriers, such as ISPs and telcos, and other large distributed organizations to create multiple secure virtual private networks. Supporting the Internet Protocol Security (IPSEC) standard allows PERMIT Enterprise to operate within any network. (PR Newswire) For the story, http://www.infobeat.com/stories/cgi/story.cgi?id=5296539-c7a -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

1 0

Interactive Programming
by Brandon Crosby 17 Dec '03

17 Dec '03

I know that this isn't precisely on subject, but... Most of the people on this list probally do some amount of programming, right? Does anyone have information about self-modifing programs/routines? Thanks for the help. -Brandon Crosby

1 0

CyberTimes on Magaziner: "U.S. Encryption Policy Is Unformed"
by John Young 17 Dec '03

17 Dec '03

CyberTimes / The New York Times October 7, 1997 Clinton's Top Internet Adviser Says U.S. Encryption Policy Is Unformed By MARTIN NISENHOLTZ AMSTERDAM -- President Clinton's top Internet policy adviser acknowledged Monday that the administration lacked a firm position on the controversial issue of encryption. "We don't have a position" at present, Ira Magaziner, Clinton's senior adviser for policy development on the Internet, told representatives of 21 nations, mostly European, gathered here for the annual High Tech Forum. complete article: http://www.nytimes.com/library/cyber/week/100797encrypt.html

1 0

Re: [LONG, off-topic]] Interactive Programming
by Peter Trei 17 Dec '03

17 Dec '03

> From: Brandon Crosby <bcrosby(a)mncs.k12.mn.us> > Subject: Interactive Programming > To: cypherpunks(a)toad.com > Date: Tue, 7 Oct 1997 08:04:05 -0500 (CDT) > Reply-to: Brandon Crosby <bcrosby(a)mncs.k12.mn.us> > I know that this isn't precisely on subject, but... > > Most of the people on this list probally do some > amount of programming, right? Does anyone have > information about self-modifing programs/routines? > Thanks for the help. > > -Brandon Crosby This probably *is* off-topic. Cypherpunks these days is mainly political discussion. Serious crypto programming has moved over to coderpunks, and this topic is not really crypto related, either. Your use of the term 'self-modifying' needs clarification. I used to write self-modifying code back when I was doing heavy assembler work, but only for performance reasons - on some processors it was faster to modify the address of an absolute memory reference by changing the instruction, than it was to use an indexed memory reference. Self-modifying code of this type is difficult to write, non-portable, non-reentrant, and usually to be avoided like the plague. I haven't done it in years, and use the story mainly to convince rookie programmers that I'm a scary dude. LISP programmers are much more into writing programs which build and execute routines on the fly. You might want to talk to someone into AI. But for a Real Programmer, and a true story of self-modifying code, heres: --------------------- The Story of Mel, a Real Programmer This was posted to USENET by its author, Ed Nather (utastro!nather), on May 21, 1983. A recent article devoted to the *macho* side of programming made the bald and unvarnished statement: Real Programmers write in FORTRAN. Maybe they do now, in this decadent era of Lite beer, hand calculators, and "user-friendly" software but back in the Good Old Days, when the term "software" sounded funny and Real Computers were made out of drums and vacuum tubes, Real Programmers wrote in machine code. Not FORTRAN. Not RATFOR. Not, even, assembly language. Machine Code. Raw, unadorned, inscrutable hexadecimal numbers. Directly. Lest a whole new generation of programmers grow up in ignorance of this glorious past, I feel duty-bound to describe, as best I can through the generation gap, how a Real Programmer wrote code. I'll call him Mel, because that was his name. I first met Mel when I went to work for Royal McBee Computer Corp., a now-defunct subsidiary of the typewriter company. The firm manufactured the LGP-30, a small, cheap (by the standards of the day) drum-memory computer, and had just started to manufacture the RPC-4000, a much-improved, bigger, better, faster -- drum-memory computer. Cores cost too much, and weren't here to stay, anyway. (That's why you haven't heard of the company, or the computer.) I had been hired to write a FORTRAN compiler for this new marvel and Mel was my guide to its wonders. Mel didn't approve of compilers. "If a program can't rewrite its own code", he asked, "what good is it?" Mel had written, in hexadecimal, the most popular computer program the company owned. It ran on the LGP-30 and played blackjack with potential customers at computer shows. Its effect was always dramatic. The LGP-30 booth was packed at every show, and the IBM salesmen stood around talking to each other. Whether or not this actually sold computers was a question we never discussed. Mel's job was to re-write the blackjack program for the RPC-4000. (Port? What does that mean?) The new computer had a one-plus-one addressing scheme, in which each machine instruction, in addition to the operation code and the address of the needed operand, had a second address that indicated where, on the revolving drum, the next instruction was located. In modern parlance, every single instruction was followed by a GO TO! Put *that* in Pascal's pipe and smoke it. Mel loved the RPC-4000 because he could optimize his code: that is, locate instructions on the drum so that just as one finished its job, the next would be just arriving at the "read head" and available for immediate execution. There was a program to do that job, an "optimizing assembler", but Mel refused to use it. "You never know where it's going to put things", he explained, "so you'd have to use separate constants". It was a long time before I understood that remark. Since Mel knew the numerical value of every operation code, and assigned his own drum addresses, every instruction he wrote could also be considered a numerical constant. He could pick up an earlier "add" instruction, say, and multiply by it, if it had the right numeric value. His code was not easy for someone else to modify. I compared Mel's hand-optimized programs with the same code massaged by the optimizing assembler program, and Mel's always ran faster. That was because the "top-down" method of program design hadn't been invented yet, and Mel wouldn't have used it anyway. He wrote the innermost parts of his program loops first, so they would get first choice of the optimum address locations on the drum. The optimizing assembler wasn't smart enough to do it that way. Mel never wrote time-delay loops, either, even when the balky Flexowriter required a delay between output characters to work right. He just located instructions on the drum so each successive one was just *past* the read head when it was needed; the drum had to execute another complete revolution to find the next instruction. He coined an unforgettable term for this procedure. Although "optimum" is an absolute term, like "unique", it became common verbal practice to make it relative: "not quite optimum" or "less optimum" or "not very optimum". Mel called the maximum time-delay locations the "most pessimum". After he finished the blackjack program and got it to run ("Even the initializer is optimized", he said proudly), he got a Change Request from the sales department. The program used an elegant (optimized) random number generator to shuffle the "cards" and deal from the "deck", and some of the salesmen felt it was too fair, since sometimes the customers lost. They wanted Mel to modify the program so, at the setting of a sense switch on the console, they could change the odds and let the customer win. Mel balked. He felt this was patently dishonest, which it was, and that it impinged on his personal integrity as a programmer, which it did, so he refused to do it. The Head Salesman talked to Mel, as did the Big Boss and, at the boss's urging, a few Fellow Programmers. Mel finally gave in and wrote the code, but he got the test backwards, and, when the sense switch was turned on, the program would cheat, winning every time. Mel was delighted with this, claiming his subconscious was uncontrollably ethical, and adamantly refused to fix it. After Mel had left the company for greener pa$ture$, the Big Boss asked me to look at the code and see if I could find the test and reverse it. Somewhat reluctantly, I agreed to look. Tracking Mel's code was a real adventure. I have often felt that programming is an art form, whose real value can only be appreciated by another versed in the same arcane art; there are lovely gems and brilliant coups hidden from human view and admiration, sometimes forever, by the very nature of the process. You can learn a lot about an individual just by reading through his code, even in hexadecimal. Mel was, I think, an unsung genius. Perhaps my greatest shock came when I found an innocent loop that had no test in it. No test. *None*. Common sense said it had to be a closed loop, where the program would circle, forever, endlessly. Program control passed right through it, however, and safely out the other side. It took me two weeks to figure it out. The RPC-4000 computer had a really modern facility called an index register. It allowed the programmer to write a program loop that used an indexed instruction inside; each time through, the number in the index register was added to the address of that instruction, so it would refer to the next datum in a series. He had only to increment the index register each time through. Mel never used it. Instead, he would pull the instruction into a machine register, add one to its address, and store it back. He would then execute the modified instruction right from the register. The loop was written so this additional execution time was taken into account --- just as this instruction finished, the next one was right under the drum's read head, ready to go. But the loop had no test in it. The vital clue came when I noticed the index register bit, the bit that lay between the address and the operation code in the instruction word, was turned on --- yet Mel never used the index register, leaving it zero all the time. When the light went on it nearly blinded me. He had located the data he was working on near the top of memory -- the largest locations the instructions could address --- so, after the last datum was handled, incrementing the instruction address would make it overflow. The carry would add one to the operation code, changing it to the next one in the instruction set: a jump instruction. Sure enough, the next program instruction was in address location zero, and the program went happily on its way. I haven't kept in touch with Mel, so I don't know if he ever gave in to the flood of change that has washed over programming techniques since those long-gone days. I like to think he didn't. In any event, I was impressed enough that I quit looking for the offending test, telling the Big Boss I couldn't find it. He didn't seem surprised. When I left the company, the blackjack program would still cheat if you turned on the right sense switch, and I think that's how it should be. I didn't feel comfortable hacking up the code of a Real Programmer. ----------------- Peter Trei trei(a)process.com

5 4

Press Release: Federal Government Teams With Tivoli (fwd)
by James Choate 17 Dec '03

17 Dec '03

Forwarded message: >From Sandra_Lara(a)brahms2.tivoli.com Tue Oct 7 09:17 CDT 1997 X-Lotus-FromDomain: TIVOLI SYSTEMS From: Sandra_Lara(a)brahms2.tivoli.com To: Yall(a)tivoli.com Message-ID: <86256529.004E6A0D.00(a)notes-brahms2.tivoli.com> Date: Tue, 7 Oct 1997 09:09:58 -0400 Subject: Press Release: Federal Government Teams With Tivoli Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Length: 3758 Federal Government Teams With Tivoli To Develop Security Specifications Austin, TX, and Baltimore, MD, October 7, 1997 -- Tivoli Systems, architect of TME 10, the world's leading systems, network and applications management platform, today announced it will work with the U.S. Government to establish new security specifications for Information Technology solutions. Threats to information security have never been more prevalent than they are today. Valuable data is commonly stored within and transmitted over corporate and public networks. The rapid adoption of the Intra/Internet for business purposes has magnified the challenge of securing this data and has caused an increased demand for better methods of establishing IT security certification. Responding to this demand, the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have partnered to form the National Information Assurance Partnership (NIAP), a joint effort between government and private industry. To help further its goal of developing new certification processes and criteria, NIST turned to Tivoli. "The NIAP is an important step forward in improving overall commercial security," said Gail Daniels, vice president of marketing at Tivoli. "As the introduction of Tivoli's TME 10 Security Management product made clear some time ago, we have solidly demonstrated our commitment to meeting the vast marketplace demands for security. We applaud the NIAP and its efforts as it works to identify faster and better methods for certifying security products." "We are meeting with a broad variety of industry leaders, such as Tivoli, to refine the goals of the National Information Assurance Partnership and its programs to meet the demands of the public and private sectors for timely, efficient and effective testing, evaluation, and certification," said Tim Grance, NIAP program manager. "We are determined to make this a collaborative effort between industry and government. With the support of industry leaders and their customers, we can do just that." Tivoli's TME 10 Security Management is the only product to centralize enterprise security management and extend mainframe-class access control across distributed computing platforms. Modeled largely upon IBM's RACF, the leading access control product for datacenter environments, TME 10 Security Management was designed for distributed environments, including UNIX and Windows NT platforms. About Tivoli Systems Tivoli Systems provides TME 10, the industry's leading solution for end-to-end management of distributed computing environments, from mobile computers to mainframes. Thousands of companies around the globe use TME 10 and compatible third-party products to reduce the cost and complexity of managing networks, systems, databases and applications. Headquartered in Austin, Texas, Tivoli is an IBM Company. Tivoli distributes its products worldwide, through a network of domestic and international sales offices, system integrators, resellers and IBM sales channels. For more information, visit Tivoli's World Wide Web site at http://www.tivoli.com. ###

1 0

Re: The Right to Work for Nobody
by Anonymous 17 Dec '03

17 Dec '03

At 11:08 AM 10/6/97 -0500, William H. Geiger III wrote: >founders. While the socialist is pissing his life away on the road to >medocracy the founders of such companies, and 1000's like them, are >working 80+ hours a week building their company sometimes at the expence >of health, home and family. > >After years of hard work, when the founders are finaly able to reap the >fruits of their toil, the socialist will step up and say: "I want what you >have, you can't have that because I don't" even though the socialist has >done nothing to earn it. I understand your argument here, but I have to disagree with some of your base assumptions. There are people who are in situations beyond their control, working their asses off. Born to the wrong parents, with the wrong skin color in the wrong neighborhood, or got a girl pregnant at age 15 and instead of leaving her on welfare and running off to finish law school (unlike a few senators) he did the "right" thing and married her; and then this poor schlep takes two 40-hour/week jobs at McDonalds to try to make the rent payment on some rat-infested converted warehouse. What's the difference between his 80+ hours per week and the C.E.O. of K-Mart's 80+ hours per week? I'm not saying that society owes him anything more than the chance he already had (and blew); rather, I'm just pointing out that there are more people lined up at the dole than just socialists crying, "there ought to be a law." Some of them are truly hard workers that either had shit-for-luck when they needed it, or no scruples when they should have used them. Which would you choose in the above situation? Abandon the girl & child to welfare and go on to run for president, or marry her and lead a hard life of squalor, working 80+ hours per week trying your damndest to stay out of the welfare office? Get a better job, in this factory town that just closed down and has 25% unemployment? You're glad for the two jobs you've got. Or how about a worse case: your car is hit by a poor, lazy drunk driver with no insurance, leaving you paraplegic and blind? Your occupation used to be carpenter, and you worked 80+ hour weeks including night jobs for friends, but you never could afford long-term medical insurance. Your insurance company claims you recorded your car's VIN number incorrectly, so they're not liable for covering you. What do you do? Your company makes some chemoglarb for use in rat poison. You've worked 80+ hour weeks trying to get a job as the safety coordinator because the company needs one desparately. They have a toxic leak before you get the job, and are bankrupt before the affected workers see their last paycheck. You're laid off, and now you can't even sit up in bed because of the damage to your lungs. What do you do? Or you're black, working 80+ hour weeks at a job trying to get ahead. Your white coworkers start talking about lynching you for being uppity. What do you do? Before condemning all of humanity asking for handouts as lazy scum who don't deserve them, consider all these people in situations that didn't deserve to be there any more than you deserve to be rich. You have many advantages: brains, education, situation, location. They have more than equal (or even overwhelming) disadvantages: injuries, responsibilities, situations, locations. There are some people in truly shitty situations. So, what do we OWE them? That's easy -- *nothing*. They were not offered a signed contract when they were born saying that life would be fair to them. Should we help them? That's a different question. A friend of mine has a T-shirt that says "Detroit -- where the weak are killed and eaten." That's a common enough response in the animal kingdom, but are we higher than that? Sure, people like you will ignore them on the streets because they're "Somebody Else's Problem." Does that make it more or less fair for the people who actually give a shit about others and do something to help them? Or, maybe we're just stupid for trying to drag the injured gazelles along with the rest of the herd. Maybe we should just let them fall to the lions. Here's a toast to your long good health and continued prosperity, so I don't have to sweat hauling your sorry ass up from the lions some day in the future.

1 0

None
by Anonymous 17 Dec '03

17 Dec '03

FBI trainees goof, nab innocent teen-agers October 3, 1997 Web posted at: 9:35 p.m. EDT (0135 GMT) ELIZABETHTOWN, Pennsylvania (AP) -- Armed FBI trainees in bulletproof vests and camouflage surrounded a group of teen-agers, handcuffed them and forced them to the ground before realizing they had the wrong people. The trainees were taking part in a training exercise at a town square Wednesday night in which they were apparently supposed to nab others taking part in the drill. Instead, up to 30 FBI trainees jumped out of a caravan of vehicles and descended on the innocent teen-agers, bound their wrists with plastic ties and ordered them to lie face-down on the sidewalk. After about 30 minutes, the agents set the teens free. The FBI would not comment on the specifics of the drill, but an FBI official apologized Friday and two agents visited the home of one of the youths Thursday night to express their regrets. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.

1 0

First time advertised in US...!
by belle＠sparksintl.com 17 Dec '03

17 Dec '03

First time advertised in US...! 100% SAFE & NATURAL HERBAL GEL REMOVES TWO INCHES OF FAT IN 24 HOURS http://www.sparksintl.com Dear E-Mail Reader, Hundreds of thousands of men and women outside of the United States have had the good fortune to use BELLE FIGURE LIPOSOME REDUCING SYSTEM over the past three years with great success. Now its finally here. Now its your turn to lose excess fat safely and permanently. SOUNDS UNBELIEVABLE! HOW DOES IT WORK? The "Belle Figure Liposome Reducing System" uses liposome technology to travel directly to the fat cells and liquefy the excess fat naturally. This intelligent formula knows the difference between excess fat and the good fat your body needs to function properly. The body then treats the liquefied fat as a waste product and eliminates it naturally and efficiently through urination. A SAFE ALTERNATIVE TO DANGEROUS LIPOSUCTION. Even the latest form of liposuction is still expensive and dangerous invasive surgery. It's called Ultrasonic Liposuction and it costs $5,000 to $15,000 depending on the body area. The surgeon uses ultrasonic waves to vibrate the fragile membranes of fat cells. When the membranes collapse, the fat liquefies. Then the surgeon makes incisions, inserts a liposuction tube into your fat layers and sucks out the liquefied fat. Sounds horrible, doesn't it? BELLE FIGURE LIPOSOME REDUCING SYSTEM replaces surgery with a natural herbal gel that you rub into your skin like a moisturizer. Now with BELLE FIGURE LIPOSOME REDUCING SYSTEM, you can lose fat quickly, safely, and permanently without surgery, without pain, without spending thousands of dollars. SEVEN REASONS WHY OUR PRODUCT IS UNIQUE... 1. It removes fat immediately, within 24 hours. You don't have to wait weeks or months for it to work as you do with some "body contouring" products on the market. 2. It liquefies fat naturally with herbs and is eliminated by the body naturally thru urination 3. It's 100% safe, 100% herbal, 100% hypo-allergenic. 4. Quick and easy to use, it takes less than an hour to apply. 5. No side effects, no after-effects, no strange sensations -- just great results! 6. It can be used repeatedly to lose multiple inches and maintain the fat loss over months, even years. 7. Affordable even for people on a budget. OUR CUSTOMERS ARE THRILLED! I work out regularly with weights and I look pretty good. But I still had more fat around my waist than I wanted. Thanks to Belle Figure, I lost a full inch in 24 hours. Now my waist is 32 inches. I was also very impressed with the tone and texture of my skin. -- Carl Humphrey, Age 41, Odessa, Texas Even though I dont consider myself overweight, my skin on my stomach was very flabby. I was amazed when I measured and saw I had lost 1-1/2 from my waist, 1 from my hips, and 3/4 from each thigh. My skin tone improved dramatically, too -- Norma Haynes, Age 70, Columbia, SC "Ive never seen anything work like this in my life. The first time I used it, I lost 2-1/2" from my waist, 2-1/2" from my hips and 3-1/2" from each thigh! 12 inches total! I put on a pair of jeans that were too tight the day before, and they zipped up easily. Ive used this product three times since then and have lost more inches each time! -- Victoria Duncan, Age 49, Seattle, WA BELLE FIGURE LIPOSOME REDUCING SYSTEM $149.95 plus $8.95 S&H System Includes: 1. Liposome Reducing & Anti-Cellulite Gel (2 oz. for one complete application) 2. Cosmetic Reaffirming Gel. (2 oz.) 3. Fat-Loss Success Journal VISIT OUR POPULAR WEB SITE: http://www.sparksintl.com We are very pleased to offer you this exciting product at our special Internet price. If you decide to buy, please send us a quick e-mail message telling us about your results; we'd like to brag about you in future advertising. Sincerely, Sparks International P.S. DISTRIBUTORS WANTED! What's even better than losing two inches of fat in 24 hours? Losing the fat WHILE you're making money! BELLE FIGURE is new in the United States and that means that this market is wide open for motivated distributors. The average BELLE FIGURE customer uses the product 3-4 times and immediately recommends it to five people. Out of those five, three buy the product, too. In other words, GREAT NEWS TRAVELS FAST and you can build a brisk business with it. Let us know if you want more information. ***** ORDER NOW! ***** Mastercard * VISA * American Express CREDIT CARD ORDERS Toll-free (888) 293-0323 PHONE 1 (206)-213-0323 FAX order to: 1-(206)-213-0321 Or mail orders to: Sparks International P.O. Box 19497 Queen Anne Station Seattle, WA 98109 Removals to mailto:remove@sparksintl.com #

1 0

Re: Internet Via Electric Lines? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "William H. Geiger III" <whgiii(a)invweb.net> > Date: Wed, 08 Oct 97 01:28:42 -0500 > Subject: Re: Internet Via Electric Lines? > This is nothing new. At least late 70's. > I think it was GE that several years ago created phone extensions that you > plugged into your power outlets, no need to run wire to put in an extra > outlet. I believe that X-10 uses this same principle for computer control > of household appliances. > > Not to mention data leakage through power lines is an issue long reconized > by the TEMPEST crowd. > > The trick here seems to be in routing the data. How do you get data on the > power grid routed to the location that you want it to go?? The trick with X-10 is to stay away from transformers as the signal won't go through them effectively. This ends any dreams of sending data to your neighbor, the signal won't go through your power meter. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Hair loss? Check this out!
by biz＠t-1net.com 17 Dec '03

17 Dec '03

We are now offering a unique, well-kept secret, simple to make at home formula to stop your hair loss. Origin of the formula: Middle-East Ingredients: 3 (very unexpensive) Application: At night, on scalp, rinse hair in the morning. Repeat for 5 days, every 3 months. Results: Stop hair loss, healthier hair. Re-growth possible in some cases. Try it! Now! Price: US$5.00 Mail US$5.00 (cash or international postal mandate) to: Distribution R.B. Inc. 2605 Cote-Vertu #505 St-Laurent / PQ / Canada H4R 2A9 Mention one of the following for us to send formula: 1. E-mail address or 2. Fax number or 3. Mailing address Try it now, you'll be amazed at the results. Simple but efficient. JMD Bery - President /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. ////////////////////////////////////////////////////////////////////////////////

1 0

Crowds as an anonymous remailer
by Mark Hedges 17 Dec '03

17 Dec '03

Regarding your post to cypherpunks asking about a distributed remailer network - this is very much what the Mixmaster remailers do now. Each message is cut into uniformly sized encrypted chunks which are traded in a stormy cloud of random traffic between the remailers, until they reach an outlet point. See http://www.obscura.com/~loki for more info. Mark Hedges Infonex Internet Inc. >On the subject of Crowds >(<http://www.wired.com/news/news/technology/story/7331.html>), a distributed >system for anonymous Web browsing, I was wondering if anyone knew of any >attempts or efforts to create a decentralized remailer network in the same >manner -- can such a thing be done, and be useful? > >Such a system might work quite like Crowds (or could even be a subset of >Crowds itself, or based on it, as the source is available), with a small >"jondo" program running on each host in the remailer network. To send an >anonymous message you must be running a jondo, hence you are part of the >network. The jondo takes your message, encrypts and randomly forwards it to >any jondo in the network, which then either re-forwards it to another jondo >or its final destination. > >There is no way for the recipient to know who the original sender was other >than that sender was part of the crowd running the jondos, and there is no >central remailer machine to target since the "remailer" consists of a >network of machines running these jondos. As members increase, the network >performance as well as the degree of anonymity increases (imagine, for >instance, if such a program came with Linux as a standard part of the OS). > > >m > >email stutz(a)dsl.org Copyright (c) 1997 Michael Stutz; this information is ><http://dsl.org/m/> free and may be reproduced under GNU GPL, and as long > as this sentence remains; it comes with absolutely NO > WARRANTY; for details see <http://dsl.org/copyleft/>. > >

1 0

Re: Four horsemen skew Internet
by Lyle Seaman 17 Dec '03

17 Dec '03

This is an off-topic rant. Anyone who wants to make me happy will convince the NYT to investigate the following question: How did Magaziner get to be "Clinton's Top Internet Adviser"? Last I knew, he was the Clintons' "Top Health Care Adviser". That is, after he was Rick Miller's $1k/hr "Top Wang Labs Turnaround Adviser", 1 year before they declared bankruptcy. For a guy with such a string of successes, he seems to keep popping up someplace new. At 01:33 PM 10/7/97 -0500, jbugden(a)alis.com wrote: > >Excerpted from the following NY Times article: > >http://www.nytimes.com/library/cyber/week/100797encrypt.html > >Clinton's Top Internet Adviser Says >U.S. Encryption Policy Is Unformed > >Magaziner took The New York Times and The Wall Street Journal to task for what >he characterized as sensationalizing negative aspects of the Internet. An >analysis of the newspapers' front-page coverage of the global computer network >in the last year, he said, revealed that the four most popular words or phrases >in such articles were "drug deal," "stalker," "bomb maker" and "pornography." >Such coverage, he asserted, had led to a popular image of the Internet that was >fundamentally skewed and that made arguing for market-driven solutions >difficult. > > >

2 1

RE: Four horsemen skew Internet
by jbugden＠alis.com 17 Dec '03

17 Dec '03

While I'm not too concerned about your present state of happiness, if you read the cited article, you may find that it is less off-topic than you thought. The quote was chosen as a "text-bite" that - while echoing sentiments familiar to many people on this list - is seldom heard from within the US administration. Magaziner's often been good for politically inopportune statements. To quote from an article in a Canadian business newspaper in late July: "Ira Magaziner, Clinton's international emissary on the issue of how governments should respond to the explosive growth of business on the Net, said any attempt to regulate its content would not only be a mistake, it would be futile." Let's wish him success in his current endeavours, ;-) -----Original Message----- From: Lyle Seaman <lws(a)transarc.com> Sent: Tuesday, October 07, 1997 3:35 PM To: James Bugden Cc: cypherpunks(a)toad.com Subject: Re: Four horsemen skew Internet This is an off-topic rant. Anyone who wants to make me happy will convince the NYT to investigate the following question: How did Magaziner get to be "Clinton's Top Internet Adviser"? Last I knew, he was the Clintons' "Top Health Care Adviser". That is, after he was Rick Miller's $1k/hr "Top Wang Labs Turnaround Adviser", 1 year before they declared bankruptcy. For a guy with such a string of successes, he seems to keep popping up someplace new. At 01:33 PM 10/7/97 -0500, jbugden(a)alis.com wrote: > >Excerpted from the following NY Times article: > >http://www.nytimes.com/library/cyber/week/100797encrypt.html > >Clinton's Top Internet Adviser Says >U.S. Encryption Policy Is Unformed > >Magaziner took The New York Times and The Wall Street Journal to task for what >he characterized as sensationalizing negative aspects of the Internet. An >analysis of the newspapers' front-page coverage of the global computer network >in the last year, he said, revealed that the four most popular words or phrases >in such articles were "drug deal," "stalker," "bomb maker" and "pornography." >Such coverage, he asserted, had led to a popular image of the Internet that was >fundamentally skewed and that made arguing for market-driven solutions >difficult. > > >

1 0

What's really in PGP 5.5?
by Jon Callas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have a number of comments about the New York Times article on PGP 5.5 for Business of which Martin Minow sent a synopsis. If we had built what they said we had, then we'd deserve of all the derision people have directed at us. But we didn't. The New York Times got it flat wrong. I'll describe what we built, how it works, and its limitations. But first, some background on the problem we're trying to solve in PGP 5.5. A couple of years ago, the government sugarcoated their surveillance plans by switching from "key escrow" to "key recovery," and trying to sell surveillance to people by pointing out some of the downsides of strong cryptography, and selling key recovery as the way around them. One of the downsides of cryptography is that if you lose your passphrase (or token, PIN, smart card, or whatever), you've lost your data. My favorite way of expressing this problem is, "if you lose the keys to your car, then you have to get a new car." This downside is particularly insidious for a number of reasons. First, without fixing that problem, strong cryptography will be in some sort of limbo. You want to use it to protect your valuable information, but you won't want to use it for any information that's *too* valuable, because it's easily lost. Crypto-protected information is fragile, and this fragility could hurt its widespread deployment. Worse, this gives the government a rationale for regulating cryptography. Like it or not, government has a mandate to protect the people from dangerous technologies, be they in foods, drugs, autos, or information technologies. Many people believe that the government uses this mandate as a rationale for acquiring power, many people would prefer that they let us take our chances, but that's not germane to this discussion. It *is* germane to note that when you hear some ham-fisted remark about how surveillance is like air bags, they are saying: they have to protect people from dangerous things, crypto is dangerous, therefore they have to protect people from crypto. When they started mumbling along these lines, the privacy community got their own act together and started describing what we believe to be the real solution. This is called "data recovery." The first time I heard the term, I hated it. I still hate it. The reason I hate it is that it's got the word "recovery" in it, which makes it sound to someone who isn't paying a lot of attention that all recovery systems are basically the same thing. Most of the people in the world don't pay a lot of attention most of the time. When I was at HIP97 this August, I was amused to hear cypherpunks chanting, "Data recovery good, key recovery bad." The sublimely Orwellian tone of this mantra makes me laugh and cringe at the same time. (To explain the reference, in Orwell's "Animal Farm," there's a revolution in the farm and the animals take over, run by the pigs. One of the slogans they have is "four legs good, two legs bad." By the end of the book, the pigs are nigh indistinguishable from the people. But I digress.) The essence of data recovery is that focusing on the keys is a canard. If you've misplaced your data, you want the data back, not the keys. The only people who want your keys are people who want to spy on you. If you've locked yourself out of your car, you want the use of your car, not the just the key. Thus, the solution to encrypted data being fragile is to let people get to the data. Simple, obvious, but subtle, because the key to getting the data is the key. If you don't like data recovery, you aren't going to like what we did in PGP 5.5 -- we built a data recovery system. Some people aren't going to like it, and some of those will think this missive is a load of self-serving twaddle. Myself, it gives me the same mildly uncomfortable feeling that fake rocks for spare keys do, or skeleton keys do, financial audits, or any other similar technology. Uncomfortable feelings aside, if the fragility problem is not solved, then many people who should be using crypto won't, and government will continue to view this problem as a question of public safety, and thus in their mandate to regulate. Data recovery is useful for a number of things. Perhaps you lost your passphrase. Or data might have been encrypted by an employee or co worker who was in an accident. (As an aside, fifteen years ago, the architect of a product I worked on was in a severe car wreck. He was not killed, but suffered brain damage and has never returned to work.) Your spouse might need access to financial records. Everyone, be they an individual, business, or coporation has a right to having their data protected, and protection not only means being able to put it into a safe, but getting it out of that safe later. What makes data recovery different from key recovery? In my opinion, data recovery allows you to get encrypted data without compromising the key of the person who encrypted it. Data is property, and keys are property. An ethically built system allows emergency access to data without destroying the property of the key owner. Ethically built data recovery software has a number of properties: (1) It is surveillance-surly. It should be impossible or unwieldy for an adversary, be they government (yours or foreign), dirtballs (such as crackers), business competitors (who sometimes count as dirtballs), or others to use this against you. The system should also be aware of how passive surveillance (like traffic analysis) interacts with it. (2) It is an "opt-in" system. Users must consent to it, and must take some action to start using it. It should be as easy as possible to stop using the system. The system must also allow someone who does not opt in to use all the system's features. Please note that abuses of consent (for example, an employer who says, "consent or we fire you") are something we can't prevent in any system. (3) It must obey the principle of fair warning. If you send me a message that is subject to data recovery, you should know that before sending the message. This way, if you don't agree with my policy, you can decide not to send me that message. This interacts closely with the opt-in principle above. (4) The data recovery system should be preferable to an escrow system. A number of corporations who use PGP keep copies of their employees' secret keys. This is both odious and dangerous. Escrowed keys are a target for attackers, subpoena-bait, and potentially ruin the value of digital signatures. It's just bad policy. (5) The system has to allow someone under a legal threat to respond effectively to that threat. Legal threats include warrants, subpoenas, and discovery processes. You have to be able to respond to the request for information without losing your keys and thus all of your data. (6) It must also provide a response to those who would regulate crypto in the name of public safety. Fortunately for us, potential regulators have focused on the horsemen of the infocalyse. There are other pseudo-public-welfare threats including the rights of a person to their spouse's records, or the rights of heirs to information property. We, the people who design privacy systems, have to think about what happens when the regulators stop dragging out the pornographers and start dragging out the poor widows and orphans. Note that these requirements are not completely consistent with each other. For example, an opt-in system is riskier than an opt-out system, yet friendlier to one's own privacy. Balancing these requirements is part of the difficulty of good software design. If you have been skimming the above, wondering when I'm going to get around to actually telling you what we did in PGP 5.5, this is it. With PGP 5, there are a number of attributes of your key that are stored in a self-signature. For example, your preferred symmetric algorithms are stored in your self-signature. The data recovery feature -- which we call "Corporate Message Recovery" -- is an attribute in your self-signature that tells anyone who receives your key that you want messages encrypted to you to also be encrypted to that other key. There is also a flag that tells the encryptor, "please" or "I insist." Architecturally, there can even be more than one recovery key. That's it. That's all it is. Well, that's mostly all it is. There are other bits of the system. For example, if I look up Alice's key on a key server and Alice has a recovery key, I get Alice's recovery key, too. If Alice's recovery key is a "please use" key, then I can encrypt to Alice alone. In any case, the PGP software tells me that Alice has a recovery key, so I can decide to use some other mechanism to talk to her. Note that design satisfies the opt-in and fair-warning requirements. Also, since Alice's recovery key is an attribute of her self-signature, she can change it. She can even have a second user name (let's call it Bob), that has no recovery key. Also, we have three encryption products: PGP freeware, PGP for Personal Privacy, and PGP for Business Security. Corporate Message Recovery is included *only* in PGP for Business Security. It is not, and never will be, in either the freeware or the Personal Privacy product. It is an extra cost item that we created for businesses as per their requirements. As I stated above, a number of these businesses keep copies of their employees' secret keys. One of the reasons we created this feature is to satisfy their requirements with some mechanism that is less blunt than key escrow. When a PGP message is formed, there are a number of "packets" that make up the message. The usual construction is that there is a "session key" packet for each public key that the message is to be read by. Following that is the actual message packet, that is encrypted with a symmetric cypher to session key. The session key packets specify the *key*, by its 64-bit key ID. This is an important and subtle point. Let's go back to Alice, a.k.a. Bob. The information that specifies a recovery key is in a self-signature of a user name, but the session key specifies a public key by keyID. It is impossible, solely from looking at a message, to know if it is addressed to Alice or Bob because that information is not stored in the message. A message that does not honor recovery is syntactically correct. I don't know why Bruce Schneier said that this is everything the FBI wants. If it is, then they have changed spots! One of the major ways PGP's system differs from anything else I've seen is that it has no enforcement built into the protocol. This helps make PGP surveillance-surly, with or without Corporate Message Recovery. If this is all the FBI needs, then they've decided the way to get your files is to knock on your door with a warrant, and that's a big, big, big step forward. Getting back to the system, I'm sure you've noticed a gotcha there. If I mail Alice a message that I encrypted to Bob, she can decrypt it, but the recovery key can't. If you've been paying very close attention, you have wondered something akin to, "hmm, if Alice's key accidentally lost its self-signature, there would be no way to encrypt to her recovery key." You're right. If Alice really wants recovery on messages sent to her, then she has to use our SMTP Policy Management Agent. The policy management agent is an SMTP proxy. You can configure it to do a number of things. Most relevant to this discussion is that Alice can use the policy agent to require that her recovery key gets used. However, the policy agent does *not* decrypt the message. One of the very good features of Business PGP is that it does not decrypt the message. It does not prevent or even try to prevent multiple-encryption. It's really, really easy to encrypt a message to Alice alone, and then encrypt that message to both Alice and her recovery key. We're not going to change that. Nor does the policy management agent archive messages, make copies, notify your mother, or any of the other things we've been accused of doing with it. It's simply the gatekeeper that enforces Alice's corporate policy. To sum up, we created the Corporate Mesage Recovery feature to satisfy the requirements of our customers who need emergency access to data. We made careful decisions to make it useful and effective for honest people, while minimizing its potential for abuse. No one has to use it; we do not include it with PGP freeware, nor with PGP for Personal Privacy. We alert all users of all products when they encrypt to someone who has a message recovery key. It is an opt-in system that you can opt out of. It is not a surveillance system. A few weeks ago, we showed it to the FBI and asked their opinion. They told us it doesn't meet any of their needs. - - ------ Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNDqoyn35wubxKSepEQJ9FQCfQcaS8aWdXcTZild0nKe5+LatDRsAnA5n GTIb2dYUx4+Uh/Frim2hKFuF =4u2g -----END PGP SIGNATURE----- ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)

12 17

Nader Letter to Bill Gates
by Robert Hettinga 17 Dec '03

17 Dec '03

Yet another spit take arrives in the e-mail. This seems to be another great week for hilarity... Cheers, Bob Hettinga --- begin forwarded text Date: Tue, 7 Oct 1997 13:21:43 -0400 (EDT) Reply-To: love(a)cptech.org Originator: info-policy-notes(a)essential.org Sender: info-policy-notes(a)essential.org Precedence: bulk From: James Love <love(a)cptech.org> To: Multiple recipients of list <info-policy-notes(a)essential.org> Subject: Nader Letter to Bill Gates MIME-Version: 1.0 The following in Ralph Nader's letter to Bill Gates, inviting him to Ralph's November 13, 14 conference on Apprasising Microsoft's Global Stategy. Jamie ----------------------------------------------------------------------- Ralph Nader P.O. Box 19312 Washington, D.C. 20036 October 2, 1997 Mr. William H. Gates Chairman and Chief Executive Officer Microsoft Corporation 1 Microsoft Way Redmond, WA 98052 Dear Mr. Gates: The customary executive mind receiving a letter such as this would be inclined toward prejudgment and denial, instead of anticipation and affirmation. But as a dominant corporate architect and philosopher of the information highway--note your expressed desire in your book, The Road Ahead, to open the dialogue about how society should shape its future in an age of tremendous technological change--you should be willing to include in that dialogue--Appraising Microsoft and Its Global Strategy. That, as it happens, is the title of a conference in Washington, D.C. on November 13 and 14, which Essential Information and I are sponsoring and to which you are invited to make a presentation. Let me describe briefly what has led to this unique event. As you may know, our various groups work in the consumer safety and environmental protection areas with a dual focus on both corporate and government accountability. We also have been pioneers in advancing freedom of information standards in government and widening the access to justice by all citizens. Concentration of economic power, along with its abuses, has long been a concern of ours and we have worked with many people of conscience inside companies, some of whom became effective whistle-blowers. Recently, people in many different kinds of businesses have been expressing fear and criticism about your company's business practices and strategies. At first, we were prone to dismissing such complaints as reflecting envy toward the dominant company. But as the private criticism became more diverse--flowing from downstream commerce well beyond software and hardware companies and from more disinterested scholars, commentators, writers, public officials and customers, it became an incentive toward further public exploration. Even this accumulated criticism did not suffice to warrant a gathering to explicitly explore the many forays and practices of your company's business strategies, which you must agree, have a range of ambitions and ongoing initiatives in more industrial and commercial directions locally to globally than possibly any business entity in modern history. What tipped the scale was the fear of speaking out by thoughtful people in the business world who otherwise have the position, energy and the resources to do so. Self-censorship brought on by the detailed fear of Microsoft retaliation--itself seen as a many pronged cluster--is not healthy in any economy. Especially when this fear is not imagined but rooted in past and current actions which are described and attributed to your company's high velocity momentum. On the other hand, you and your associates are described as so fearful of becoming another Digital Equipment or IBM missing a "big bend in the road", as you put it, that you are moving to position yourself as the "new middleman" on every lane of the information highway possible. To some observers, Microsoft playing the insecure and challenged role, as depicted in an article you may have relished on the cover of Barron's (September 15, 1997), assumes an irony of King Kong proportions. Seasoned executives are quaking before the relentless Microsoft wave in such lines of commerce as banking, real estate, insurance, car dealers, travel services, cable television, newspaper media and entertainment. The June 5, 1997 issue of the Wall Street Journal reported a detailed Microsoft strategy memorandum, deepened by interviews with your executives, that foreshadowed the "first a partner then a competitor" approach. Your critics assert that using a bundling strategy, together with tactical free offerings, made possible by monopolistically garnered profits, and a punitive "stick" response to your challengers makes Microsoft a leading candidate for antitrust action if only the enforcement agencies had the up-to-date knowledge, willpower and resources to apply these necessary laws for a free, fair and competitive economy. The conference participants are among the few who are still willing to speak openly of their concerns, findings and recommendations. Many plead for an open, not closed, architecture, for a digital future that is a patrimony, a commonwealth within which the best and the most consumer-sensitive will have an opportunity to prevail. They seek an information highway that is ungated where they see such a highway increasingly become gated. You, Steve Ballmer and Nathan Myhrvold have what you believe to be formidable responses to these declarations. Responses that are both specific and that rise to the level of national public policy regarding the information infrastructure in the economy. Focusing on the "Big Kid on the Block"--Microsoft--addresses the core concern directly and avoids the nuanced generalities and abstractions that have no operational realities attached to them. The agenda for the conference is being completed and includes the enclosed topics with the speakers who have confirmed their presence. Other presenters will be added in the coming days. In the interest of joining the issues, your presentation should come near the completion of the conference on November 14. We intend to have a serious, coherent and consequential conference that will lead to greater public understanding of the trends and the issues that will affect business and the general public as you wrote about in The Road Ahead. Your industry is thrusting toward increasing arcane language, acronyms and specializations that are narrowing the public or lay audience which, ever enlarging, is critical in making this technology serve the broadest of human interest and well-being. We are inviting Vice President Albert Gore, your friend and information highway colleague, to participate in the conference. Being an open gathering and near his office, his presence would neither entail the cost, time and closed-door nature of his earlier visit to your 100 executives meeting near Seattle. This should increase the likelihood of his acceptance, one might hope. Should you wish to discuss this invitation further, please call me or John Richard of Essential Information at (202)387-8034. Of course, you may wish to have other Microsoft executives attend the conference and they are welcome to come and absorb the many currents of information and activity, both in the formal sessions and in the informal corridor and coffee break discussions that are often so valuable. While there is a conference fee, there is no outside funding or sponsorship to inhibit or compromise the integrity of the proceedings. Sincerely, Ralph Nader Enclosure -------------------------------------------------------------------- This some other documents about the conference are on the Web at: http://www.essential.org/appraising/microsoft/ -- James Love | Center for Study of Responsive Law P.O. Box 19367 | Washington, DC 20036 | http://www.cptech.org voice 202.387.8030 | fax 202.234.5176 | love(a)cptech.org --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Nobuki Nakatuji <bd1011(a)hotmail.com> say: > unperfect MISTY algorithm source code which I wrote isn't Public Domain. > When you use it ,You need to permit from me. > > > > ______________________________________________________ > Get Your Private, Free Email at http://www.hotmail.com No no, too late. I take MISTY and use in my secret crypto program to come out soon on Foriegn web-site. I take MISTY and make perfect. You go, chop chop.

1 0

Re: stored value cards in NYC - Motorola PR fluff.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

John R Levine <johnl(a)iecc.com> writes: > > Anybody on the list know more about this project? ("...one of the largest > > and most exciting..." :-) The puff piece has some contact info, but I don' > > expect to get anything useful from them. > > This could be interesting. NYC already has stored value cards called > Metrocards which you can use for subway and bus fares. The MTA has tried > with little success to get newsstands and other vendors of low-price high > volume stuff to take them. Physically they're just thin plastic cards with > the usual magnetic stripe, nothing fancy. They permit variable sized > decrements and are rechargable, so their design must be reasonably > sophisticated. They suck. I'm sticking to tokens. > > I read somewhere in an account of an NYC hackerfest that the Metrocards > have been subjected to intense hacking but they apparently remain secure. They can't be all that secure... Bruce Schneier helped design the crypto. Schneier is to cryptography that Schildt is to C programmin. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

News from the Front (October Issue)
by news＠sldc.ffg.com 17 Dec '03

17 Dec '03

An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 10/6/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Special Offer III. Hot Tip ----------------------------------------------------------------------- I. News from the 'Front WEBWHACKER 3.2 UPDATE! There is a FREE update available via the Internet for users of WebWhacker 3. To receive your FREE update, follow these steps: 1. Launch WebWhacker 2. Click Help 3. Click Update WebWhacker Software... 4. Follow the on screen prompts To check out the new and exciting features in WebWhacker 3.2, visit: http://webwhacker.ffg.com/whatsnewdir/3/ww2whatsnew.html HP ACQUIRES FOREFRONT'S NEXT-GENERATION INTERNET-PRINTING TECHNOLOGY ForeFront's Internet Technology and Printing Development Team will be able to accelerate Hewlett Packard's solutions for easy, fast and reliable Internet printing. http://www.ffg.com/press/9_97hewlett.html FOREFRONT ACQUIRES COMPUTER BASED TRAINING SOFTWARE DEVELOPER LANTEC ForeFront is moving aggressively to expand its presence in the training and education markets. http://www.ffg.com/press/lantecacq.html ----------------------------------------------------------------------- II. Special Offer Ever receive files you can't read? Want to print their contents in a useful format, such as a booklet or brochure? ForeFront would like to introduce the ultimate utility bundle: Quick View Plus + ClickBook Now you have access to any file format AND you can print the file's content in any format, including booklets, brochures, and more! How much would you expect to pay for this perfect partnership? Would you believe ONLY $69.95! That's a savings of almost $40 off the regular price of $109.90! Follow this link now to take advantage of this limited time offer: http://store.ffg.com/qvp/ ----------------------------------------------------------------------- III. Hot Tip If you have Microsoft Internet Explorer 4 and WebPrinter or ClickBook, you have the ultimate web printing tool! You are capable of printing multiple linked web pages in a book with one click (almost)! Try this: 1. Launch Microsoft Internet Explorer 4 2. Browse to the site you want to print, e.g. http://www.ffg.com/corpinfo/ 2. Click File/Print... 3. Select your ClickBook printer driver from the Name drop down list 4. Check "Print all linked documents" and "Print table of links" 5. Click OK NOTE: make sure WebPrinter/ClickBook is done procesing pages before clicking the Print button. (In this example there should be 11 pages received) This is truly "The best way yet to print the 'Net!" If you don't have WebPrinter yet, then get it! http://www.ffg.com/wp/ For more printing options, try ClickBook! http://www.ffg.com/wp/clickbook.html ----------------------------------------------------------------------- This newsletter is only sent to those who requested the newsletter and those who downloaded, registered, or evaluated our software. If you wish to unsubscribe from the ForeFront newsletter mailing list, please visit http://www.ffg.com/press to Unsubscribe.

1 0