December 2003 - cypherpunks-legacy

Microsoft Exploratorium, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

********** http://cgi.pathfinder.com/netly/opinion/0,1042,1685,00.html The Netly News (http://netlynews.com/) January 13, 1998 Which Way the Windows by Declan McCullagh (declan(a)well.com) Looks like it's upgrade time not just for Microsoft Windows, but also for Microsoft's legal strategy. As engineers frantically debugged the Windows 98 beta last week, senior Microsoft executives roamed Washington, D.C., apologizing for their previous arrogance and saying they had been misunderstood. Call it Microsoft PR 2.0. "What we have not done is communicate" the way the software works, Robert Herbold, Microsoft chief operating officer, told The Netly News last Friday. But will Microsoft's new humility appease federal judge Thomas Penfield Jackson, who already issued a preliminary injunction against the Redmond firm? He's scheduled to hear from the company's lawyers and the Department of Justice this morning. Both have spent a good chunk of the last month complaining about each other: The government says Microsoft violated the judge's order, and Microsoft says the government is "poorly informed." As his attorneys argue the law, Bill Gates will be practicing politics -- a skill that will come in handy if Congress holds more antitrust hearings when it returns in late January. Pundits have made much of Gates's Democratic sympathies, another image he's trying to discard (or at least upgrade). Today Gates is scheduled to sit down for a private chat with technophilic House Speaker Newt Gingrich (R-Georgia), who will also tour the Microsoft campus. [...] *********** http://cgi.pathfinder.com/netly/afternoon/0,1012,1686,00.html The Netly News / Afternoon Line January 13, 1998 Microsoft Exploratorium The ugly guts of Microsoft Windows were on display today during a six-hour federal district court hearing in Washington, DC. Attorneys from Microsoft repeatedly pointed at a list of hundreds of .DLL and .EXE files and challenged the government to answer one deceptively simple query: Which files are part of Internet Explorer? The outcome of the case may well turn on the answer to that question, which lies at the heart of the Justice Department's beef with the software giant. Last month Judge Thomas Penfield Jackson ordered Microsoft to stop using its operating system's popularity to force-feed Internet Explorer to computer makers. But, again, which files belong to Internet Explorer? The government's witness ducked the question. "I can't go through your list and say which files are unique to Internet Explorer," replied author and computer consultant Glenn Weadock. "I don't think it's possible or even especially useful to define a list of files and say this is part of, or this is not a part of Internet Explorer." Which Microsoft has argued all along -- their browser is integrated into the operating system. Yanking it out, the company says, would be like amputating a leg: a person could only hobble along, at best. The government views this as a weak excuse, at best. "The court issued a very simple, broad order and Microsoft through its actions defied rather than complied with that order," said Justice Department trial attorney Phillip Malone. The government is asking Judge Jackson to hold Microsoft in contempt and levey a million-dollar-a-day fine. The hearing will continue tomorrow when Microsoft vice president David Cole testifies. - By Declan McCullagh/Washington -------------------------------------------------------------------------- POLITECH -- the moderated mailing list of politics and technology To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: subscribe politech More information is at http://www.well.com/~declan/politech/ --------------------------------------------------------------------------

1 0

Should police knock before entering - SC to decide [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > SUPREME COURT CASE: SHOULD POLICE KNOCK BEFORE ENTERING? > > SCOTUS graphic January 13, 1998 > Web posted at: 2:14 p.m. EST (1914 GMT) > > WASHINGTON (CNN) -- The Supreme Court was being asked Tuesday to > decide whether law enforcement officers should ring the doorbell or > knock before entering a building if they sense danger. > > The case focuses on a 1994 incident in Oregon. Hernan Ramirez fired > his gun after police broke in his garage window after they received > a tip that a fugitive was in the Ramirez house. It was a tip that > turned out to be wrong. > > Ramirez fired his gun without knowing that those intruding were law > officers, and once he realized who the intruders were he > surrendered. > > "The police fire back a fusillade of fire, screaming 'police! > police!' -- this is the first time Mr. Ramirez realizes that the > police are there," said public defender Michael R. Levine. > > Even though Ramirez was not the fugitive that police had been > looking for, they still arrested Ramirez on weapons charges since, > as a convicted felon, he was not permitted to possess a gun. > > A federal judge later ruled that the police search had been > unconstitutional. The federal government then brought the case to > the Supreme Court, arguing that the increased danger in that > particular case had warranted the window-shattering no-knock entry > into the Ramirez building. [text deleted] ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Privacy & Anonymous service providers?
by William Knowles 17 Dec '03

17 Dec '03

I'm working on a web page that would include a list of Internet providers that either offer anonymous accounts or a better degree of privacy not usually seen by regular ISP's. Below is a list of providers that offers these services that I have been able to put together, I'm wondering if there are some that I am missing. To avoid noise on the list and I'm no longer a member of the cypherpunks list, please e-mail me privately. Paranoia http://wwww.paranoia.com Data Haven Project http://www.datahaven.com L0pht Heavy Industries http://www.l0pht.com Offshore Information Services http://www.offshore.ai Cyberpass http://www.cyberpass.net SkuzNet http://skuz.wanweb.net LOD Communications http://www.lod.com The Nymserver http://www.nymserver.com Sekurity.org http://www.sekurity.org Hotmail http://www.hotmail.com Thanks in advance! William Knowles erehwon(a)dis.org == The information standard is more draconian than the gold standard, because the government has lost control of the marketplace. -- Walter Wriston == http://www.dis.org/erehwon/

1 0

mobile agents paper
by Adam Back 17 Dec '03

17 Dec '03

Nelson Minar <nelson(a)media.mit.edu> pointed out in email to me the relevance of his thesis proposal and paper "Computational Media for Mobile Agents" to the discussion on autonomous agents as a means to deploying eternity servers and remailers etc. http://www.media.mit.edu/~nelson/ (Not read it yet). Adam

1 0

Plan 9's auth() function - partialy secure distributed computing
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From ravage(a)ssz.com Tue Jan 13 17:51:44 1998 Date: Tue, 13 Jan 1998 17:51:42 -0600 From: Jim Choate <ravage(a)ssz.com> Message-Id: <199801132351.RAA29535(a)einstein.ssz.com> X-within-URL: http://plan9.bell-labs.com/magic/man2html/6/auth To: ravage(a)einstein.ssz.com Subject: auth [search] [index] delim $$ define lbr ' roman "{" ' define rbr ' roman "}" ' NAME ticket - authentication service DESCRIPTION This manual page describes the protocols used to authorize connections, confirm the identities of users and machines, and maintain the associated databases. The machine that provides these services is called the authentication server (AS). The AS may be a stand-alone machine or a general-use machine such as a CPU server. The network database ndb(6) holds for each public machine, such as a CPU server or file server, the name of the authentication server that machine uses. Each machine contains three values important to authentication; a 56-bit DES key, a 28-byte authentication ID, and a 48-byte authentication domain name. The ID is a user name and identifies who is currently responsible for the kernel running on that machine. The domain name identifies the machines across which the ID is valid. Together, the ID and domain name identify the owner of a key. When a terminal boots, the user is prompted for user name and password. The user name becomes the terminal's authentication ID. The password is converted using passtokey (see auth(2)) into a 56-bit DES key and saved as the machine's key. The authentication domain is set to the null string. If possible, the terminal validates the key with the AS before saving it. For Internet machines the correct AS to ask is found using bootp(8). For Datakit machines the AS is a system called p9auth on the same Datakit node as the file server the terminal booted from. When a CPU or file server boots, it reads the key, ID, and domain name from non-volatile RAM. This allows servers to reboot without operator intervention. The details of any authentication are mixed with the semantics of the particular service they are authenticating so we describe them one case at a time. The following definitions will be used in the descriptions: $CH sub c$ an 8-byte random challenge from a client $CH sub s$ an 8-byte random challenge from a server $K sub s$ server's key $K sub c$ client's key $K sub n$ a nonce key created for a ticket $K lbr m rbr$ message $m$ encrypted with key $K$ $ID sub s$ server's ID $DN sub s$ server's authentication domain name $ID sub c$ client's ID $UID sub c$ user's name on the client $UID sub s$ user's name on the server A number of constants defined in auth.h are also used: AuthTreq, AuthChal, AuthOK, AuthErr, AuthTs, AuthTc, AuthAs, and AuthAc. File Service File service sessions are long-lived connections between a client host and a file server. Processes belonging to different users share the session. Whenever a user process on the client mounts a file server (see bind(2)), it must authenticate itself. There are four players in an authentication: the server, the client kernel, the user process on the client, and the authentication server. The goal of the authentication protocol is to convince the server that the client may validly speak for the user process. To reduce the number of messages for each authentication, common information is exchanged once at the beginning of the session within a session message (see attach(5)): Client->Server Tsession($CH sub c$) Server->Client Rsession(${CH sub s},~{ID sub s},~{DN sub s}$) Each time a user mounts a file server connection, an attach message is sent identifying/authenticating the user: Client->Server Tattach($K sub s lbr AuthTs, ~ {CH sub s},~{UID sub c}, ~ {UID sub s}, ~ K sub n rbr , ~ {K sub n} lbr AuthAc, ~ {CH sub s}, count rbr )$ Server->Client Rattach($ K sub n lbr AuthAs,~{CH sub c},~count rbr$) The part of the attach request encrypted with $Ksubs$ is called a ticket. Since it is encrypted in the server's secret key, this message is guaranteed to have originated on the AS. The part encrypted with the $K sub n$ found in the ticket is called an authenticator. The authenticator is generated by the client kernel and guarantees that the ticket was not stolen. The count is incremented with each mount to make every authenticator unique, thus foiling replay attacks. The server is itself authenticated by the authenticator it sends as a reply to the attach. Tickets are created by the AS at the request of a user process. The AS contains a database of which $ID sub c$'s may speak for which $UID sub c$'s. If the $ID sub c$ may speak for the $UID sub c$, two tickets are returned. UserProc->AS $AuthTreq, ~ CH sub s , ~ ID sub s , ~ DN sub s , ~ ID sub c , ~ UID sub c$ AS->UserProc $AuthOK, ~ K sub c lbr AuthTc, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr , ~ K sub s lbr AuthTs, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr$ Otherwise an error message is returned. AS->UserProc $AuthErr$, 64-byte error string The user passes both tickets to the client's kernel using the fauth system call (see fsession(2)). The kernel decrypts the ticket encrypted with $K sub c$. If $UID sub c$ matches the user's login ID, the tickets are remembered for any subsequent attaches by that user of that file server session. Otherwise, the ticket is assumed stolen and an error is returned. Remote Execution A number of applications require a process on one machine to start a process with the same user ID on a server machine. Examples are cpu(1), rx (see con(1)), and exportfs(4). The called process replies to the connection with a ticket request. Server->UserProc $AuthTreq, ~ CH sub s , ~ ID sub s , ~ DN sub s , ~ xxx, ~ xxx$ Here xxx indicates a field whose contents do not matter. The calling process adds its machine's $ID sub c$ and its $UID sub c$ to the request and follows the protocol outlined above to get two tickets from the AS. The process passes the $K sub s$ encrypted ticket plus an authenticator generated by /dev/authenticator from the $K sub c$ ticket to the remote server, which writes them to the kernel to set the user ID (see cons(3)). The server replies with its own authenticator which can be written to the kernel along with the $K sub c$ encrypted ticket to confirm the server's identity (see cons(3)). UserProc->Server $ K sub s lbr AuthTs, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr , ~ K sub n lbr AuthAc, ~ CH sub s , ~ 0 rbr $ Server->UserProc $K sub n lbr AuthAs, ~ CH sub s , ~ 0 rbr$ Challenge Box A user may also start a process on a CPU server from a non Plan 9 machine using commands such as con, telnet, or ftp (see con(1) and ftpfs(4)). In these situations, the user can authenticate using a hand-held DES encryptor. The telnet or FTP daemon first sends a ticket request to the authentication server. If the AS has keys for both the $ID sub c$ and $UID sub c$ in the ticket request it returns a challenge as a hexadecimal number. Daemon->AS $AuthChal, ~ CH sub c , ~ ID sub c , ~ DN sub s , ~ ID sub c , ~ UID sub c $ AS->Daemon $AuthOK$, 16-byte ASCII challenge Otherwise, it returns a null-terminated 64-byte error string. AS->Daemon $AuthErr$, 64-byte error string The daemon relays the challenge to the calling program, which displays the challenge on the user's screen. The user encrypts it and types in the result, which is relayed back to the AS. The AS checks it against the expected response and returns either a ticket or an error. Daemon->AS 16-byte ASCII response AS->Daemon $AuthOK, ~ K sub c lbr AuthTs, ~ CH sub c , ~ UID sub c , ~ UID sub c , ~ K sub n rbr$ or AS->Daemon $AuthErr$, 64-byte error string Finally, the daemon passes the ticket to the kernel to set the user ID (see cons(3)). Password Change Any user can change the key stored for him or her on the AS. Once again we start by passing a ticket request to the AS. Only the user ID in the request is meaningful. The AS replies with a single ticket (or an error message) encrypted in the user's personal key. The user encrypts both the old and new keys with the $K sub n$ from the returned ticket and sends that back to the AS. The AS checks the reply for validity and replies with an AuthOK byte or an error message. UserProc->AS $AuthPass, ~ xxx, ~ xxx, ~ xxx, ~ xxx, ~ UID sub c$ AS->UserProc $AuthOK, ~ K sub c lbr AuthTc, ~ xxx, ~ xxx, ~ xxx, ~ K sub n rbr$ UserProc->AS $K sub u lbr AuthPass, ~ roman "old password", ~ roman "new password" rbr$ AS->UserProc $AuthOK$ or AS->UserProc $AuthErr$, 64-byte error string Data Base An ndb(2) database file exists for the authentication server. The attribute types used by the AS are hostid and uid. The value in the hostid is a client host's ID. The values in the uid pairs in the same entry list which users that host ID make speak for. A uid value of * means the host ID may speak for all users. A uid value of !user means the host ID may not speak for user. For example: hostid=bootes uid=!sys uid=!adm uid=* is interpreted as bootes may speak for any user except sys and adm. FILES /lib/ndb/auth database file /lib/ndb/auth.* hash files for /lib/ndb/auth SEE ALSO fsession(2), auth(2), cons(3), attach(5), auth(8) Copyright © 1995 Lucent Technologies. All rights reserved.

1 0

Plan 9 ordering info [rather expensive]
by Jim Choate 17 Dec '03

17 Dec '03

If you're interested in getting Plan 9 in CD format: Harcourt Brace & Co. 800-782-4479 Plan 9 (full distribution on CD w/ source) ISBN 0-03-017143-1 $367.50 + 8% s/h + state tax (8.25% in Tx) Usualy takes 24 hours to setup an account with them. Apparently they don't ship this through retailers. When I called this morning for up to date info the #3 selection for individuals and professional didn't work. Just select the operator option and be done with it. I advised them their VRU didn't work correctly. If you talk to EJ tell her thanks again. If you just want to play then go to plan9.att.com and get the disk set they offer for playing around. It lacks all source but it will install a minimal system on an Intel box. Should work on most systems though I do suggest that you use a SCSI based system. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Don't shoot the messenger (Re: 1 Question to Dr. Froomkin...) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 13 Jan 1998 18:38:43 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: Don't shoot the messenger (Re: 1 Question to Dr. Froomkin...) > It appears to me that your comments to Michael are based on your views > on the undesirability of the way the US judicial system operates in > practice today. Michael is merely offering his expert opinion on how > various questions would likely be interpreted by the current legal > system. Ok. It's not just the US judicial system, include the executive and legislative branches as well. > Screams of "and you think this is a good idea?" and "but what about > the constitution" are misdirected; I strongly suspect each of the > three posters I mention above share your distaste for the redefinition > of meanings and blatant disregard for the fairly clear meanings of the > constitution. You propose speaking softly will resolve the issue? If so why speak at all since that is the softest speech of all. Your position seems to be that if a question is hard then it should be avoided because it might offend the sensibilities? You propose that justice would be better served if it were all masked in innuendo and euphamism? Perhaps, that is no reason not to take them to task when they expound a position using fallacious arguments. Further, Dr. Froomkin is a law professor who *trains* future lawyers. If anyone should be held to task for their actions and views it is those who are deciding what tomorrows world will look like and the people charged with those decisions. There is a fundamental ethical responsibility for conservatism and literalism in those enterprises that simply isn't present in most other 'jobs'. We aren't playing horseshoes or handgrenades - close enough is not good enough. There is a fundamental difference between Lawyers, Doctors, & Soldiers and the vast majority of other human endeavours. In short, they are given the lattitude to decide events that directly and immediatley impact human life. Engineers, Pilots, hamburger flippers, etc. are seldom in a position as a matter of course of their practicing their vocation to decide whether a person will live or die. Because of this exclusion from commen behavioral limitations they should receive *less* latitude and trust in their actions instead of more (which is what is happening today). Ulitmately, when a lawyer fails in their duty to use *every* legal recourse a person sits in a room and gets to listen to the hiss of cyanide drop into the acid. When these people make a mistake there is no 'fixing' it. Sometimes "I'm sorry" just doesn't cut it. It is entirely too important to be complacent or trust without verification (thanks to Pres. Reagan for that one). The road to hell is paved with good intentions. We'll just have to agree to disagree here. If they take the job they take the responsibility to answer for their actions to any and every citizen that asks for it. However inconvenient, uncomfortable, or rude the question may be posed because the *next* citizen they ask to trust them may be the one asking the question. Never forget that but by the grace of God there go you. If you want to trust your future to somebody who 'shuts down' because somebody says "spin doctor bullshit" or strenously defends their views be my guest. Me, I want a MUCH more mature and determined individual handling me and my decendants future. I want to experience that strength of conviction from them not a yellow streak. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

British Ministers Adopt Unbreakable Crypto
by Eric Cordian 17 Dec '03

17 Dec '03

The UK is replacing the traditional "red boxes" used by ministers to carry their work home with them with high tech laptops. They will use a signet ring and fingerprints to control access to the computer. There will be a "Duress Finger." :) ----- LONDON (AP) -- It's a briefcase even James Bond could love. Britain's more adventurous Cabinet ministers soon will be spiriting laptop computers inside their signature ``Red Box'' briefcases, complete with fingerprint recognition systems and silent alarms. The stacks of papers, briefing documents and constituency correspondence that now go home with each minister in lead-lined red briefcases will be replaced in a few months by a specially designed super-secure laptop -- capable of carrying infinitely more homework. At $4,000 each, the prototypes unveiled Tuesday are seen as a symbol of the modern Britain so often touted by the Labor Party and are being billed as a way to make government work more efficiently. They will not, however, be foisted on ministers who prefer the old-fashioned paper route -- but those holdouts will miss an electronic voice that chirps ``Good morning, minister'' each time the computer is turned on. Each computer, built into the briefcase, will come with a security system that uses a signet ring and fingerprints to control access to the computer. Ministers who eschew jewelry can have the signet ring's smart-card incorporated into another device, such as a keychain or pen. The fingerprint function also requires an alternate finger to be programmed in case the minister cuts the one designated, thereby corrupting the fingerprint. ``It has certainly been billed as very James Bond-ish and I suppose we are 'Q,' '' said Alan Rushworth, managing director of Rhea International, the company that designed the security system, likening himself to the 007 character who outfits James Bond with all his gadgets. ``There is even a duress finger,'' Rushworth said. ``That is for if a terrorist or gunman has a gun to the minister's head forcing him to open the computer. It will appear to function normally but doesn't, and sends a silent alarm to the Cabinet Office.'' No ``top secret'' documents will be loaded on the computers because such material is seldom transmitted electronically for security reasons, a government spokeswoman said. Even American security experts could not breach the computer's security system, Rushworth boasted. ``The Cabinet office has used its best government hackers for extensive penetration testing and they couldn't break it,'' he said. ``It has also been tried by our cousins on the other side of the Atlantic -- and they couldn't get in either.'' -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

plan 9 features (Re: autonomous agents (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 14 Jan 1998 00:33:14 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: plan 9 features (Re: autonomous agents (fwd)) > Sounds interesting. I am not familiar with plan 9 besides the > enthusings of a colleague reminiscing about the work done at York > Univ, UK with plan 9. > > Java has a lot going for it as a candidate due to portability and code > distribution support. I think the only thing missing from java is the > bidding and scheduling mechanisms. Your other forwarded message on > plan 9 looks interesting also. I have been working on a potential distributed data haven model using the Plan 9 architecture. I have finaly amassed enough machines where I can actualy dedicate the i/o, process, and file servers on seperate machines. The problem that I see for the immediate future is getting nodes that don't happen to reside on my premises for additional testing in about a year. I don't have a clue to how to get people to spend $400 bucks for the software (which the ATT license prohibits from commercial use) *and* dedicate several machines to the enterprise. But I'm not going to give up, maybe some folks will volunteer just to do it...:) I took the liberty of forwarding the man page for the auth() function to the cpunks list. It describes the 56-bit DES based authentication mechanism. I personaly don't care for DES so at some point I will be looking to replace that mechanism with an alternative. I also need to take some time and look at porting the Plan 9 file server adapter for Unix to Win95/NT. Either that or I mount the file systems to a suitably enhanced Linux box and then export from there. This would imply that the Win95/NT boxes need to be on the physical network of the Linux box or else excessive opportunities for MITM attacks are present. Not that simply being on the same network provides complete protection either. I hope that OpenNT will provide enough Unix-like features to minimize the port effort. The Plan 9 mechanism also needs to be enhanced in such a way that besides the access token involving encryption the actual transfer of packets are also content encrypted. This has potential compatibility problems with un-enhanced Plan 9 servers that I haven't had a chance to look at. Once I have a system up and running it will allow non-Plan 9 systems to access the resources by using what is called 'hand-held DES encryptors'. Unfortunately, there is not a real description of how this is to be accomplished in a real-world manner. My hope is to have something available sometime this summer that will allow folks to play with it at least in a limited way. If you get the chance and have the resources you should look into at least getting the Plan 9 documents. They're like $150 but call and verify that price since I didn't this morning. Also note, there are now two releases of Plan 9 floating around out there. The only distinction I am aware of is one is the 'old' release and the current is the 'new' release. Don't have a clue as to how to tell them apart or what compatibility problems will exist. My best estimate is that in about a month I will have the resources to install and begin developing the model. I am currently between employers (I don't work at Tivoli-IBM anymore) so I'm job hunting in the Austin area over the next few weeks. I'll make reports to the list on the results as I manage to get results. I don't know about Java on Plan 9, I'll look into it. Take care. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: (eternity) Automating BlackNet Services
by Adam Back 17 Dec '03

17 Dec '03

Scratch Monkey writes: > Here's a way to do an automated "high risk" server, using many of the > same methods as the eternity implementation but with longer delays and > more security for the server. This design ties in pretty well with what I understood Tim May's suggestion to be of using BlackNet to provide eternity services. I notice that you are assuming that all document delivery would be via digital dead-drop (alt.anonymous.messages). Depending on the usage pattern of this service it has the potential to be higher bandwidth than by Eternity USENET design. The BlackNet with dead-drop only scheme you propose will become more expensive in bandwidth than Eternity USENET at the point at which the volume of satisfied document requests being posted to USENET for different recipients exceeds the volume required to repost the traffic at the desired update rate. This is because you may have multiple requests for the same document, all of which must be posted to alt.anonymous.messages. One thing you could do to reduce this overhead would be to combine requests for the same document. To do this you could add an extra delay to satisfying requests to increase the chances of accumulating more requests for the same document. Alternatively, documents which were sent out within the last 24 hours or so could have just the bulk symmetric key encrypted for the subsequent recipients sent together with a message-id. (A separated multiple crypto recipient block). A more subtle problem you would probably want to address with this design is that you don't really want anonymous requested documents to be linkable, so you would need to do stealth encoding of the messages. This tends to be more complex for multiple recipients, but it is doable, and is made easier by standardising on public key size. In general I think I consider my Eternity USENET design more secure than your design and of similar overhead depending on whether the usage pattern results in lower bandwidth. I make this claim because users are offered better security with E-USENET because they are completely anonymous, and don't need to submit requests. They can passively read E-USENET, perhaps on a university campus, or with a satellite USENET feed. The readers are much harder to detect. This is significant because remailers are complex to use, and the users should be assumed to be less technically able (ie more likely to screw up remailer usage). Publisher anonymity is of basically the same security. A lower bandwidth alternative, to either E-USENET or what you have termed Automated BlackNet alternative is therefore to send messages via use-once mixmaster remailer reply blocks of the sort used by some nymservers. Clearly this is also lower security because the user must creating reply blocks which ultimately point back to himself. However the performance win is big. With this architecture BlackNet can win significantly over E-USENET because the volume is reduced to just indexes of available documents. Also I consider indexes are probably low enough risk for people to mirror on the web or cache on the web or whatever. My E-USENET prototype design has a separate index mechanism. (I understand there is some magic inside mixmaster which prevents packet replay, which helps avoid message flood attacks, though didn't locate the code fragment responsible for this functionality when I examined the sources.) Also I found your use of hashes and passwords so that the server does not necessarily know what it is serving interesting. I have similar functionality in my prototype E-USENET implementation. I mainly included the functionality because the prototype is also being used as an publically accessible eternity USENET proxy, to allow the operator to marginally reduce risks. I think this approach is of marginal value, in that the attacker will be easily able to compile an index from the same information as users. This is really a form of secret splitting: the key is one part, and the data the other part. The key can be considered to be part of the URL. > Both the client and server software should be trivial to write, and in > fact I am working on that now. The server is partially written, but I am > at a handicap because I do not have access to usenet at this time. If > anyone knows of some canned code (preferably sh or c, but perl would work) > that will perform functions such as "Retrieve list of articles in > newsgroup x" and "Retrieve article number y", a pointer would be nice. http://www.dcs.ex.ac.uk/~aba/eternity/ I have done most of the work already I think. What you are trying to do is so similar that you should be able to acheive what you want with some light hacking of my perl code. For testing purposes I am in the same position as you; dialup ppp connection and linux machine. What I did was to implement both newspool access code, and NNTP access code. For local testing I just create a dummy news-spool. The eternity distribution comes with a few documents in this dummy news spool. A real local news spool would work also. Then you can simulate everything you want offline. You can change the config file to switch to an open access NNTP news-server at any time for a live test. All the code to read USENET is there, and to scan chosen NNTP headers, etc. I would highly recommend perl as a rapid prototyping language. What you see took 3 days (long days, mind, motivation was at an all time high around then). Adam

1 0

(fwd) Automating BlackNet Services
by Adam Back 17 Dec '03

17 Dec '03

Scratch Monkey, a nym, described this BlackNet variant on the eternity list(*), which raises some interesting issues I think. I am currently forwarding eternity discussion backwards and forwards between the lists and adding Cc's on my replies. Adam (*) To subscribe see http://www.dcs.ex.ac.uk/~aba/eternity/ there is a CGI form to subscribe, or send message with body "subscribe eternity" to majordomo(a)internexus.net. ------- Start of forwarded message ------- To: eternity(a)internexus.net From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay Associates, L.L.P. Subject: (eternity) Automating BlackNet Services Sender: owner-eternity(a)internexus.net Precedence: bulk On Tue, 13 Jan 1998, Adam Back wrote: > This suggests that another approach would be to have two classes of > services. Users of high risk documents can put up with 24 hour turn > around, and lower risk documents can be served by an alternate > service, intermediate risk documents can exist by using low risk > resources until detection. Here's a way to do an automated "high risk" server, using many of the same methods as the eternity implementation but with longer delays and more security for the server. For now I am calling this scheme (which is not much more than an automated participant in the BlackNet scheme) ABNS, for Automated BlackNet Server. 1) Server program resides on host with large disk and full news feed. 2) Server program watches alt.anonymous.messages. 3) Alice anonymously posts data to alt.anonymous.messages, in a format similar to eternity documents. However, the data would typicaly be encrypted to the public key(s) of the 4) Server notices the message, processes it and stores the data. 5) Bob anonymously posts a request for a document to alt.anonymous.messages. 6) Server notices the request, and anonymously posts a public key to alt.anonymous.messages along with a statement that the requested document is available. 7) Bob notices the post from the server, and anonymously posts a second request to alt.anonymous.messages, this time encrypted with the server's public key. This second request could include Bob's public key. 8) The server notices and decrypts the second request, and anonymously posts the requested document to alt.anonymous.messages, encrypted with Bob's public key if one was provided. The reason for steps 6 and 7 are to prevent multiple servers from responding to the same request with (potentialy) very large files. Of course, if Bob knew the data was available from a particular ABNS, he could skip steps 5 and 6. Both the client and server software should be trivial to write, and in fact I am working on that now. The server is partially written, but I am at a handicap because I do not have access to usenet at this time. If anyone knows of some canned code (preferably sh or c, but perl would work) that will perform functions such as "Retrieve list of articles in newsgroup x" and "Retrieve article number y", a pointer would be nice. So far, this is not too exciting, but the addition of a couple of extra technologies could make it very usefull... If the "Steganographic File System" being proposed by Ross Anderson comes to fruition, the ABNS could recieve a filename and password as part of each submission, and then promptly 'forget' them. In this way, not only does the server not have access to the contents of the file, it doesn't even know what files it has! Retrieval requests would include the appropriate information to enable the server to fetch the data. The addition of digital cash to the picture would make it really viable, because the server could charge for storage, or retrieval, or both. So picture this: Alice has some data she wants to sell. She encrypts this data to the public key of an ABNS, along with the filename and password to be used for file access and an amount of cash sufficient to pay for storage costs for maybe 6 months. She would also specify a 'value' for the data, which the ABNS will charge for access to this data and of which Alice will recieve a cut. She could also send a small advertisement (for which here storage fees should be minimal) as a separate document, and give it a value of zero. The server decrypts the message and verifies the cash. It then stores the file in the designated filename/password location in the SFS (stego file system). It makes a hash of the filename/password, and stores this hash in a 'table of contents' file that would also contain: - - the 'paid-until' date for the data. - - the public key of the submitter. - - the 'price' for the data It would then forget the filename and password. Bob learns of the existance of the data (how? I haven't thought about that yet but it doesn't seem to me that it would present much of a problem) and wishes to purchase it. He sends a message to the server by encrypting to the server's public key and posting to alt.anonymous.messages. In his message he includes the filename/password of the data he wants, along with an appropriate amount of cash and Bob's public key. The server decrypts Bob's request: - - First, it pockets the cash. (Everything else is just to keep customers) - - It then creates a hash based on the filename/password of the data that Bob is requesting. - - It looks up that hash in the table of contents file. - - If it is not found, it anonymously posts a message encrypted to Bob's public key indicating that the data is not available, but that Bob now has a line of credit at this particular ABNS. :) - - If it _does_ find the hash in the contents file, it checks the paid-until date. - - If the file is not paid up, the server treats it as if the file were not present (and in fact, it deletes the file at this time, something it could not do without the filename/password that Bob supplied). - - If the file is present, and storage fees are paid up, and Bob has enclosed enough cash (or has enough credit), the ABNS accesses the file in the stego filesystem and anon-posts it to Bob's public key. - - The server then forgets the filename/password, but remembers the hash. - - Of the 'fee' collected from Bob, the server allocates it as follows: - 70% is kept. - 10% is credited to the hash retrieved by Bob, to extend it's "Paid up" time. This means that documents that bring in a lot of money can pay for thier own storage costs, without the contributer needing to keep paying. - 20% is encrypted to the public key listed in the table of contents and posted to alt.anonymous.messages, as a royalty to the contributor. Of course, this is just one possible policy for the server to have. Market forces will shape the eventual pricing scheme. I'm actualy not sure if such a system would be used, because Alice may have no motivation to send her data to an ABNS when she can run the server herself and take 100% of the money. Comments on this aspect of operation would be appreciated. Either way, the same software could be used. I hope to post initial versions within a couple of weeks, assuming I can hack myself some account with nntp access for testing. -Scratch Monkey- 85d8e7d860504ba9e90527e7e89210d7 This is a new persistant nym. PGP key(s) will be posted soon, and I will verify that the keys belong to the same person who posted this message by providing the string that produces the md5 hash above.

1 0

mirroring services, web accounts for ecash
by Adam Back 17 Dec '03

17 Dec '03

Some meta-level thoughts on the eternity service document availability problem: Many of the problems with designing an eternity service are introduced by trying to build real time accessibility of data (with similar response times for documents to those offered by web servers). The BlackNet model can quite ably provide eternity like services with perhaps 24 hour turn around on documents. Everything is operated by digital dead drop (via say news:alt.anonymous.messages), or mixmaster remailers. This suggests that another approach would be to have two classes of services. Users of high risk documents can put up with 24 hour turn around, and lower risk documents can be served by an alternate service, intermediate risk documents can exist by using low risk resources until detection. The low risk document service could be just an automated mirroring service, and could for example explicitly state that illegal materials in server localities will be removed on the server operator becoming aware of this fact, or perhaps on receipt of court notification. This presents the kind of "we aim to discourage illegal materials" persona that commercial ISPs like to present to the police and spooks. It might also be useful to partially automate the differences in types of material which can be hosted in various jurisdictions. Scandinavian countries might be used for pornography in the 14 - 21 year old range; other jurisdictions useful for copyright music materials, where music royalties are collected by a blank media tax; the US might be useful for publication of materials critical of Islamic beliefs, and so on, in each case the materials being strictly legal in the server locality. The mirroring service could be offered by mirror site operators as a public service for locally controversial materials, or services could be charged for to improve long term availability. If the mirroring service is automated, it is likely that materials will slip through the gaps in the system (especially if it is designed with this property in mind), much like warez used to be traded in funny named directories on badly configured ftp servers, or world read and writeable ftp incoming directories. The operator says "darn warez pirates" and removes the offending warez when he is notified. But it might stay up for a few weeks, and URLs spread quickly, and there are lots of open access sites. Another less controversial "host" service which warez pirates might be likely to get away with abusing would be simple web space available for ecash. Lance Cottrell already offers this such anonymous web accounts. If many ISPs start offering this kind of service, the pirates will be more easily able to keep going by hopping from account to account, as accounts are closed for breach of policy, in a similar way that spammers treat accounts as disposable. A TAZ server could even offer a persistent virtual URL to a migrating warez file collection located either on mirroring sites, or on anonymous ecash paid web accounts. (TAZ servers just offer a layer of indirection, see Ian Goldberg and Dave Wagner's paper: http://www.cs.berkeley.edu/~daw/cs268/ ) Adam

3 5

Freedom Forum report (freedom of association) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 13 Jan 1998 18:55:24 -0700 > From: Jim Burnes <jim.burnes(a)ssds.com> > Subject: Freedom Forum report (freedom of association) > (It is left as an excercise to the reader to figure out why > prohibition > needed an amendment to the constitution while prohibition of > other > mind altering substances did not ;-) What amazes me is that such groups as NORML and other pro-drug organizations have not had their lawyers raise this issue. As far as I can tell nobody has *ever* raised this issue in regards to the drug prohibitions. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Rincin AP
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Forward from Terrorism list: From: JCHV72A(a)prodigy.com (MR JAMES P DENNEY) Date: Tue, 13 Jan 1998 19:45:44, -0500 To: TERRORISM(a)mediccom.org Subject: RICIN ALERT Bureau of Narcotic Enforcement Merced/Mariposa Narcotic Task Force RE: RICIN Alert The Sacramento Regional Office of the Bureau of Narcotic Enforcement has offered this alert to all it's personnel: "The following alert has been confirmed and is being shared throughout the law enforcement and intelligence community. This alert advises that nationwide trend among drug traffickers is to "bait" law enforcement officers with a white powder called RICIN. RICIN is a derivative of Castor beans and looks like powder methamphetamine. It is highly toxic and if it contacts human skin, it is fatal. The death process takes several days, depending upon the dosage, and is almost impossible to detect during an autopsy. Forensic experts advise that if you field test RICIN in the Scott Reagent Kit, it will foam and bubble extensively. The test will also produce a gas that is very similar to mustard gas and can also be lethal if inhaled. RICIN is 6,000 times more lethal than cyanide and there is no antidote. Symptoms of contact exposure to RICIN are: Fever, cough, weakness, and hypothermia, progressing to dangerously low blood pressure, heart failure and death. Due to this situation, in the event of suspect drug seziures, do not come into direct skin contact with any powdered substances, and exhibit caution of field testing any powdered substances." We are forwarding this advisory to all California EMS Agencies and recommend that each agency contact the local hospitals in their area. We are unaware if RICIN can be detected on a toxicological exam. There is a potential for someone, other than law enforcement, to become contaminated with this substance. -----

1 0

Re: Ricin AP
by Eric Cordian 17 Dec '03

17 Dec '03

Anonymous writes: > This alert advises that nationwide trend among drug traffickers is to > "bait" law enforcement officers with a white powder called RICIN. > RICIN is a derivative of Castor beans and looks like powder > methamphetamine. It is highly toxic and if it contacts human skin, it > is fatal. The death process takes several days, depending upon the > dosage, and is almost impossible to detect during an autopsy. Ricin is a ribosome-inactivator, which inhibits protein synthesis at the cellular level by binding to and damaging the 50S ribosomal subunit. This is eventually and irreversibly fatal, although not immediately so, and the symptoms which occur in poisoned individuals are generally misdiagnosed by internists as a wide variety of other ailments. The most famous case of the use of ricin was when Bulgarian dissident Georgi Markow was assasinated by the KGB with an umbrella jab which left a microscopic porous metal sphere tainted with ricin in his leg. He died in agony a number of days later. The lethal dose of ricin in humans is microscopic, and it is a poison of choice in cancer therapy, since it destroys cells and patients are unlikely to have previous immunological exposure to it. It can be bound to monoclonal antibodies, or other carriers, to target only specific cells. > Due to this situation, in the event of suspect drug seziures, do not > come into direct skin contact with any powdered substances, and > exhibit caution of field testing any powdered substances." LOL! Like one should come in contact with ANY unknown chemical substance, powdered or not. Remember that researcher who just died after accidently getting a drop of Dimethyl Mercury on a gloved hand, not to mention the one who got a speck in her eye and succumbed to monkey herpes a couple of weeks later, despite intensive antiviral therapy. And that's not even mentioning other fun things like Thallium, and Organophosphate nerve agents, or the use of cellular penetrators like DMSO as carriers for contact poisons. Ricin isn't the only nasty substance one could use to keep jackbooted thugs out of the marijuana plants. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

TLS implementations
by Anonymous 17 Dec '03

17 Dec '03

Don't you know the place where there is anyone TLS implementations (source code)? Teach to me if it is here because it is known. Thank you very much.

2 1

Deregulation of US Electricity
by iNqwx6tuC＠vers1esv.com 17 Dec '03

17 Dec '03

DEREGULATION OF THE U.S ELECTRIC UTILITY INDUSTRY IS CREATING A $215 BILLION FINANCIAL OPPORTUNITY FOR YOU! Imagine Utility Savings of 20% - 40%! now imagine being a marketer of those savings and earning a recurring monthly commission on the Utility usage of consumers throughout the country... <<<<< Call 1-800-358-2754 for 24 hr, 1 min message >>>>> __________________________________________________ Effective Jan '98, Electric Utility Monopolies will be dissolved on a State-by-State basis opening a $215 "Billion Dollar" industry to free-market competition. We need independent "Electric Power Marketers" in all 50 States especially California and the Northeast. Build a leveraged, recurring income in as little as 10-15 hours/week. full training and support; minimal start-up; lucrative. New Ground- Floor Opportunity with established international networking giant. Capitalize now on projected $10 Billion in annual revenue. People made millions with deregulation of the Telecommunications Industry. The Electric Utility Industry will be three times the opportunity. <<< Call 1-800-358-2754 for 24 hr, 1 min message >>> (Please do not reply via e-mail. Call our Voicemail and leave your name, telephone number and the best time to call and we will contact you as soon as possible) To be removed, call the above number and SPELL your email address stating you would like to be removed from future mailings.

1 0

Neat quote from Ron Rivest
by Peter trei 17 Dec '03

17 Dec '03

At the RSA Data Security Conference: "There are probably more people in this room working on crime *prevention* than in the entire Federal Government." -- Ron Rivest quoted (hopefully correctly) by Peter Trei ptrei(a)hotmail.com ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Jailhouse Rock
by Sacramento Nutly News 17 Dec '03

17 Dec '03

[SACRAMENTO NUTLY NEWS--byline Chainsaw McCullagh]IN AN EXCLUSIVE interview at the Sacramento County Jail, former UC-Bezerkeley math professor, Theodore "Don't Call Me Teddy" Kaczynski, spoke (on the condition that his anonymity would be preserved) to a Nutly News reportwhore, a drug-smuggling prison guard, and a few inmates sharing a crack pipe in an adjoining cell. "Selective prosecution...", Kaczynski said, pausing to let the Nutly News reportwhore pass the pipe back to the far side of the cell bars, and turn on his tape recorder. "Selective prosecution," TK continued, "will be the basis of the defense I plan to raise." "A defense," he added, "which I expect will help to swing public support over to my side during my trial and subsequent execution." Seeing the skeptical glances exchanged between the reportwhore, the guard, and the crackheads in the adjoining cell, Kaczynski proceeded to explain that the American public was growing increasingly tired of sacrificial lambs being thrown to the prosecutorial wolves on the basis of patently illegal discrimanitory prejudices. "Allowing Bad BillyC in WashDC, To walk free around town, Despite Foster and Brown..." Kaczynski rapped, until noticing the icy glares from the pigmentation criminals in the next cell, then continuing in a normal cadence, "...is one thing, but prosecuting the mother of the fat broad for child abuse, while allowing Karen Carpenter's mother to walk..." The reportwhore and the jail guard, passing the crack pipe back and forth, also passed a glance that confirmed they were beginning to see the true danger involved in allowing TeddyK a legitimate trial. The whole American justice system was based on the outcome of the case being pretty well set in stone by the time it reached a jury, if a trial became unavoidable. The jury rigging process and the pretrial motions were comparable to the bidding in a bridge game, with the actual playing of the cards during the trial being mostly for show. Of course, in high-profile cases that are a must-win for government prosecutors and their behind-the-scenes handlers, the bidding process is mostly to decide how much the defendant's lawyers will be compensated for selling their client quietly down the river. McVeigh's lawyers got $15 million and a guarantee of future government largess, in return for making certain that their client got a defense that most people wouldn't find acceptable if it were their dog that was facing being 'put down' by the Feds. Legal rulings by the judge were geared toward allowing the defense team the freedom to use any tactic or evidence which would not help their client's case, or hurt the government's case. Nichol's trial was geared toward actually allowing the defense team to present a moderately legitimate defense, to preserve the pretense of justice, while risking little chance of justice ultimately triumphing. Kaczynski's trial was slated to be another quick and easy slam-dunk, with the legal eagles moving their playing pieces around in a grand game designed to ensure everyone's future reputation and earning power while maintaining the charade that Truth and Justice still play some minor part in the whole process. The key to the House of Cards known as the American Judicial System, however, is convincing the defendant and/or the public, that the game is not totally rigged from beginning to end. When either the defendant or the jury cannot be controlled, the House of Cards begins tumbling rather rapidly. The key to controlling the defendant is to convince him/her that their legal representatives are sincerely acting in their client's best interest, and are not selling him/her out, in the slightest way, in order to further their career and guarantee not missing their tee-time for their afternoon golf game with the prosecutor. The key to controlling the jury is to make certain that they are not allowed to view any evidence, or hear any point of view, which runs contradictory to the outcome which has been preordained by following 'established legal procedure.' The danger is not in Theodore Kaczynski claiming innocence...the danger is in him questioning why he, McVeigh and Bell are being prosecuted, while Clinton, Nixon and Bush were/are not. The danger is in him asking why the mother of the girl who died of Chatelaine-Incorrect obesiety is a criminal worthy of prosecution, while the mother of the girl who died of BarbieDoll-Approved anorexia is guilty of NoCrime. The danger is in asking why a teenage foreigner was prosecuted for not recognizing the signs of a broken wrist and a cracked skull in a child, while the parents, trained adult physicians, were not. The danger is in TK asking why tobacco executives, known to have participated in the deaths of millions are allowed to buy their way out of prosecution, while TimmyM and TeddyK are not. The danger is in Terrible TeddyK exercising his freedom of speech and raising socially inacceptable questions during defense of his actions. There is not a day that goes by that someone in America does not kill more people than TK ever dreamed of--individuals, government bureaucrats or corporate executives. The danger is not in Kaczynski proclaiming his innocence, the danger is in him saying, "So the fuck what? It's a predatorial universe. I'm a small fry with a large mouth. The average citizen has killed more people than me just by keeping their mouth shut and enjoying their share of the booty from the murders committed by the government and corporations that the sheeple count on to do their stealing for them." The danger is in arch-demon, Terrible TeddyK, being allowed a free voice to demand being tried alongside the US government soldier who fired a burst of taxpayer-supported bullets into the body of a Somalian mother with her baby in her arms, defending her home against assault by armed forces of foreign governments. The danger that Theodore Kaczynski presents is the same danger which James Dalton Bell represented--unfettered free-speech--uncontolled sound-bytes--a non-approved view of reality. The plain fact is that the world-view sold to us by those who control the mainstream media is so far out of whack with reality that it cannot even withstand verbal assault by StinkBombers, let alone UnaBombers. Who is Theodore Kaczynski? He is a man who has murdered fewer people than Winnie Mandela and countless other 'world leaders'. He is a man who has murdered fewer people than your average street gang leader. He is a man who has murdered fewer people than me--and, quite possibly, you. He is a dangerous man--a man who can't be bought. He is a man whom the government portrayed as someone who must--and who would--be justifiably put to death, after a 'fair' trial. A man who is now being offered a 'plea bargain' for the simple reason that he has demanded his right to speak in his own defense. That cannot be allowed in a judicial system that is built on a House of Cards that depends on its survival for all of the players to tread lightly around the thin walls of reality on which Justice in America is built. The final irony, of course, is that Terrible TeddyK, who only killed a couple of people, was parlayed into a major threat to world peace and individual security by the very people who now wish that they could dismiss him as mentally unstable, for the purpose of allowing him free speech, but mentally responsible, for the purpose of holding responsible for his actions. The final irony is that, in declaring Terrible TeddyK sane enough to execute, their is a danger in portraying him as sane enough to listen to. And the true danger of free speech is that someone may be listening. The final irony is that we, as a society, have deemed that we cannot execute those who are mad, but only those who are sane. We can only hold them responsible if their speech and actions are sane. Snell, Kaczynski, Jesus, TruthMonger...all present the same problem. We can confine them in the rubber-room, or hang them on the cross, but in doing so, we risk validating the truths they claim to speak. The danger is not in the warning contained in their speech--"Don't look back, something might be gaining on you." The danger is that someone--McVeigh, Gus-Peter, Saint Peter, A Cypher- Punk To Be Named Later--might be listening. The danger is that it does not matter if it is McVeigh, with a ton of fertilizer, saying "Something 'big' is going to happen.", or Bell, with a bottle of mercetan, saying, "Something 'small' is going to happen." What matters is that those who have heard and acted on the admonition, "Lock and Load!", are in a position to hear and act on the proclamation that "The Revolution is NOW!" The problem of Theodore Kaczynski will have to be resolved through execution, suicide, or dismissal as a madman. The problem of Clinton, Reno, Mandella, you and I...that will have to be resolved through the denial represented by selective prosecution.

1 0

Re: rant on the morality of confidentiality
by Blanc 17 Dec '03

17 Dec '03

Bill Stewart wrote, in reference to "immoral science" vs immoral *scientists*: >Depends. [#invoke Godwin's Law] >Consider the Nazi studies done on human susceptibility to freezing, >poisons, torture, etc., and the followon work done by various >evil empires. Some of it was just done for fun, >but some of it _was_ real science, with hypotheses and experiments, [..etc...] ............................................................. I was being picky/particular. Because consider that science does not conduct itself: it is a method developed by scientists, and it is *conducted by* them. They determine what is the right manner in which to conduct their experiments, they figure out how to determine what is valid in terms of proofs. Their findings, to be valid, must relate to the actual nature of things, to reality. But then, being humans, scientists must consider what all of this "means" to us, or about us, upon reflection. If after a time, scientists have come to depend on the "scientific method" (as established by other scientists in the past) to determine what they shall do, how they should proceed, and have given up on doing some of their own current reasoning on methodologies; if they are not sensitive to the meaning or validity of what they do, then this would be to say that it is "science" which is at fault when they inflict torture, for example, rather than those individuals who engage in those experiments. But this is like the tail wagging the dog, or like the typical Nazi excuse that "the State made me do it": "Science determined that the experiment had to be conducted this way, in order to achieve true knowledge; I had no choice." I say it is the scientist who makes the science immoral, if it be judged to be so, not vice-versa. As for the concept of morality, which I'm sure will be the next controversy brought up by someone: It is a difficult thing to pin down what morality/immorality is, because because it is an abstract concept which requires a comprehensive view on humanity, conscience, and concepts of "goodness", and because it is so mixed up with notions from religion and associations with any number of unrelated ideas and concepts. Generally it can be agreed that someone who liberally and insensitively creates pain and destruction upon humans is not "one of us", psychologically. An educator (Montessori) explained it thus: "Good is life; evil is death; the real distinction is as clear as the words." Anything which goes of the direction of life is good (and moral) while anything which goes in the other direction is of the opposite character. "The 'moral sense' ... is to a great extent the sense of sympathy with our fellows, the comprehension of their sorrows, the sentiment of justice; the lack of these sentiments convulses normal life. We cannot become moral by committing codes and their application to memory, for memory might fail us a thousand times, and the slightest passion might overcome us; criminals, in fact, even when they are most astute and wary students of codes, often violate them; while normal persons, although entirely ignorant of the laws, never transgress them, owing to 'an internal sense which guides them'. " Those who have become insensitive to this internal guidance system are generally dangerous, and risky to be around, even if you don't want to identify their inclinations as "immoral". .. Blanc

1 0

Covert Superhighway - the missing component?
by Ross Anderson 17 Dec '03

17 Dec '03

Scratch Monkey proposes building an Eternity service using the Stego File System, provided an anonymous broadcast channel exists - it's assumed that alt.anonymous.messages will do the job. I suspect that wide deployment of Eternity would lead to this group being closed down. We need a more robust anonymous broadcast channel. Let's call it the `Covert Superhighway'. How do we build it? Ross

5 4

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Timmy May's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. \ o/\_ Timmy May <\__,\ '\, |

1 0

how to release code if the programmer is a target for coercion
by Ryan Lackey 17 Dec '03

17 Dec '03

Tim May brought this issue up recently -- if someone develops a greatest- thing-since-sliced-bread Eternity package, then releases it. it's pretty likely that they will eventually be approached by (mi6/mossad/CIA/KCIA/etc.). What's likely to happen? Certainly they could kill you. They could make it look like random street crime, or an accident, or kill you with #16 000 in your pocket just to make it clear what their reasons were (Gerald Bull, Mossad, London, .32acp). At best, you could force them to make it very obvious it was murder, by having paranoid levels of security, but they could still kill you. If they kill the programmer (s/programmer/programmers, or just enough that the project becomes disorganized, etc.), that at worst will keep new releases of the software from coming out. At least until another group starts working on things, assuming protocols and/or source are public. Perhaps that new group would be a front for the NSA, though. A risk. More likely, they'd try to coerce you. This could include threats of death, which are best responded to by ignoring them, since they don't gain anything if they kill you. Or torture, which is equally ineffective if they kill you. Or slander/etc. to try to discredit you. (unlikely to work at least among cypherpunks, in the absence of technical attacks as well). Most likely, they would try to buy you. This could be by outright offering money for back doors, which would be great if it worked, but is unlikely to happen in the first place. If offered a bribe, you could go public with that fact (preferably after taking the money :), and worst case publically distance yourself from the project. More likely, they could try to infiltrate the technical team covertly, or ask for features which happen to be non-public security compromises, perhaps under the guise of security improvements (this presumes they are beyond the state of the art). WOrst case, one can say that if the intelligence community is far beyond the state of the art, you have no chance at protecting against covertly modified source code, modified to break in a subtle way which is not known to the general community. However, the world is already in this position -- if they solved the DLP, or even knew of subtle bugs in a processor, or whatever, tools would already be weak. Assuming the intelligence community is not so advanced that thorough inspection by the world at large won't reveal back doors or weaknesses, the solution is code review by the public. It was brought up that verifying PGP was just about at the limit of the world's capability. I agree that it is certainly beyond the level of one person, or even a small group, to verify -- plus, you want code verified by enough non-interacting entities that it is unlikely they can all be bought. I was looking around for a solution to this -- Lenny Foner at the MIT Media lab has something for his agents project which might be a solution. A system by which sections of source code are verified by individuals, signed, other sections are verified by others, etc. Then, during compilation, you could say something like "all of the security critical code must be verified by at least one of these 12 people, everything else by at least 5 people per section in this list of distinct people". It would then show where the "threadbare" sections are, and you could optionally verify them yourself, have someone else verify them for money, or post to cypherpunks asking for help. Security critical code should be encapsulated fairly well anyway -- I'd feel a lot worse about having a bug in such a part of my code than a screen refresh bug. One could potentially limit unintended side effects by running security code on its own processor, in its own sandbox, or just use a different instance of the JVM to run it. I think technical means can solve the problem of source code review and intelligence community rubber hose tactics. (preferably they'll still be handing out free money anyway, though) -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

1 0

Re: Talk of Banning Research into Human Cloning (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 14 Jan 1998 12:31:04 +0000 (GMT) > From: "David E. Smith" <dave(a)bureau42.ml.org> > Subject: Re: Talk of Banning Research into Human Cloning (fwd) > > I wonder if it is the intention of those who support a ban on human cloning > > to prevent my friend who lost his forearm in the Vietnam War from having a > > new one grown and attached? > > Yup. Unless there's some remarkable breakthrough, you can't just grow an > eyeball, or a kidney, or whatever. You've gotta grow the whole body. In > time, we might be able to genegineer the process for optimal production of > the targeted body part, likely with all sorts of side effects that would > be, er, detrimental in a "real" person. Actualy, at least according to one episode of that show on TDC that Skully form the X-Files hosts, there are several groups who are working on just this thing. One female researcher has extended the life of worms (admittedly a step or two from humans) by 7 times with no apparent effect. There was a piece on CNN late last nite about some researchers discussing this as well. Their estimate is that it would be at least 5 years before there would be anything available on the open market. There is also at least two groups working on growing specific organs. One group (the one interviewed on the TDC show) is using plastic forms to grow the organs in. They can apparently grow small samples of specific cells and are looking at how to organize the growth of more complex structures such as a kidney which would include blood-vessels and such. I am sorry I don't know the name of the show. If somebody out there does please speak up. My prediction is that within 15 years there will be methods to extend human life by at least a factor of 3 and techniques to replace every organ or structure with the persons own cells (thus alleviating all tissue rejection problems) through accellerated growth mechanism based on cloning in such a way that cancer, accidents, etc. will become at best temporary tragedies. In short, unless you get your head or entire torso squished there will be methods to keep people alive for periods approaching 200 years. Further, these techniques will be available through standard insurance via your employer because they will be low cost (that's the nice thing about bio-science). ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Press Release
by 1qfiZZ5dK＠k1notsee.com 17 Dec '03

17 Dec '03

ATTENTION ALL INTERNET USERS PRESS RELEASE BILLION DOLLAR COMPANY ANNOUNCES ENTRY INTO TRILLION DOLLAR TECHNOLOGY MARKETS You're obviously technology minded or you wouldn't be reading this right now! THE MARKETS You're probably aware that deregulation of the $215 Billion Dollar electricity market begins in 1998. Remember what happened when long-distance deregulated? Companies like MCI and Sprint made billions and became household names in a market 1/3 the size of electricity! And electricity is only the tip of the iceberg. An international powerhouse doing in excess of $1.5 Billion annually is aggressively seeking entrepreneurs to participate in its launch into the following markets: Electricity Internet Access Internet Commerce Long-Distance Telephone Service International Phone Service Cellular Service Paging Cable and Satellite Television Natural Gas Home Security Systems We are offering you the opportunity to turn these expenxe centers into profit centers and participate in the largest transfer of wealth in history. IMAGINE GETTING PAID EVERY TIME SOMEONE GETS ON THE NET, BUYS SOMETHING OFF THE NET, TURNS ON THE LIGHT, COOKS, MAKES A TELEPHONE CALL, USES A CELLULAR OR PAGER, WATCHES CABLE OR SATELLITE TV OR USES A HOME SECURITY SYSTEM! Recurring, ongoing income paid on services we all use everyday already, except you can now earn a royalty on other people's usage. You can also receive royalties on the usage of businesses, large corporations, apartment buildings...anywhere these services are used. THE COMPANY Billion Dollar Company, completely debt-free Top-rated by Dun & Bradstreet, listed on NYSE "One of the 8 fastest growing companies in US history"-Success Magazine Highest paying company in its industry THE STRATEGY To reach our goal of dominating all connections into the home/building we will: Partner with Blue-Chip megacompanies in these industries Use our corporate buying power to negotiate favorable rates Offer these services in 1-year contracts to ensure your income Ultimately "Bundle" these services into ONE MONTHLY BILL for the ultimate in convenience while keeping attrition to a minimum COMPENSATION We currently have over 500 people earning an average income of $561,000 per year in markets that total $75 Billion annually--less than 1/15 of the size of the markets we are positioning to enter. INFORMATION We have set up a voice forum that you can call 24 hours per day and get more information about this once-in-a-lifetime opportunity. Please take 10-15 minutes and call: 801-345-9614 Then call me at 310-281-5500 so I can answer your questions and provide further information. BEING FIRST IS GREAT--YOU NOW HAVE THE OPPORTUNITY TO BE BEFORE FIRST

1 0