December 2003 - cypherpunks-legacy

Re: cypherpunks discussions
by Sarad AV 09 Dec '03

09 Dec '03

hi, I just a pick a book and learn and if i am in doubt, ofcourse i do have a lot of stupid ones. but thats how i learn. I have friends who will help me with my queries. I prefer not getting flamed like every one else and that too in quick succesion :-). so my guess is that as far as newbies are concerned all the discussions are taken private. Moreover,there is no loss in interest in cryptography, we pursue it with our heart and soul. Sarath. At 03:26 PM 12/7/03 -0800, Tim May wrote: >But even if crypto got trendy again, I just don't see the young >students of today flocking to our particular mailing list. Too many >other choices. Probably they'll read someone's daily blog.... A few observations. Nowadays, colleges offer courses in crypto. This was not the case when I started reading this list. And 'net social issues were not widely discussed; now there are many fora and public organizations that one can look at. Probably college courses on that, too. So *perhaps* neophytes interested in these things have many more places to learn. Just an optimistic possibility. I did much like your "the nose rings of the followers" comment though. __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

6 8

Re: Decline of the Cypherpunks list...Part 19
by Anonymous 09 Dec '03

09 Dec '03

Let's look at some real-world metric of cpunkish issues: 1. Surveillance and data harvesting. The main reason many "joined" cpunks (including me) was the issue of wide-spread surveillance and sophistication of data harvesting that computer networks enabled. I could protect my traffic no problemo. And I couldn't care less if some moronic consumer/sheeple type could not. That was not the issue. The issue was that government(s) (there used to be more than one in old times) had too good take on the pulse of the population, and would make less mistakes due to this feedback. Well, they succeeded and cpunks miserably failed. There was no way to jam the crypto down the throats of the unwashed. Today most of them keep their e-mails and http pages on disks that belong to LEA-friendly corps - there is no need to intercept - all TLA needs to do is search. There is more data harvesting today than ever before. It's not even mentioned any more. It's not a news item or a sexy maillist topic. 2. Crypto tools Widely available. This is a big success. One can readily download PGP or ssh. Seldom used. I don't count "protect-your CC # with SSL" kind of use. Only NSA knows, but I'd guess that the number of PGP users is pretty stable in the last decade. The biggest win of the government was removing surveillance from the focus. My guess is that all the early fuzz about crypto tools was fear that they will be widely used. When it became obvious that it will not happen the fuzz stooped. ECHELON? ITAR? No one even bothers to mention these any more. But you can safely assume that *all* mail traffic through MAE nodes is archived, along with google queries and that most net users have "files" with histories of search strings and similar. I would be disappointed with the waste of my tax dollars/euros/pounds if this is not the case. The only way out is new communication technology. Internet is too old and has been completely coopted. We need the Next Thing, now. I don't know what it is but these things seem to come up quite regularly. So forget about Internet doing anything for the cpunk agenda. Tune in the Next.

1 0

Re: Decline of the Cypherpunks list...Part 19
by proclus＠gnu-darwin.org 09 Dec '03

09 Dec '03

I'm still quite new to this list, so if you find this interesting, please take it as from a newbie ;-}. On Sun, 7 Dec 2003, Tim May wrote: > > Read the archives and note the drop-off in certain kinds of > > political discussion. Even some of the former nodes have vanished; my > > hunch is that many of those subscribed to the vanished nodes never > > bothered to find another node. (I have no idea how many subscribers the > > list has. The nodes I know of don't allow listing the subscribers. I'd volunteer GNU-Darwin.org as a new node, but we are having issues with SMTP, dynablocker, spews list, etc. (BTW, if anyone can recommend a reliable and inexpensive closed relay service, that would be a big help.) Anyway, is there a FAQ, HOWTO, volunteer person, where I can learn how to set up a new Cpunks node? I'd love to do this, if it would help, and I'm sure that most of our users would also love the idea of GNU-Darwin assisting the Cypherpunks list, which seems quiet apt. I frequently post to other forums crypto-related items, which could include a link to the Cypherpunks list. > > bothered to find another node. (I have no idea how many subscribers the > > list has. The nodes I know of don't allow listing the subscribers. > On 7 Dec, J.A. Terranson wrote: > None of mine will allow it either, with the reason being the protection of > the list contributors. A partial solution would be to list the number of subscribers in the list info, which reveals the info that is important to the community without revealing the identities of the subscribers. > CP has always been so much more than crypto. The history here is political, > with crypto not always playing a part. Even the non-crypto discussion is > almost completely lost. Here is an old post of mine. I was worried about being off-topic, so I did not continue with it. http://www.mail-archive.com/cypherpunks@lne.com/msg00722.html I'm a person who could post a ton of political stuff, which some might find interesting, but some of it may not be related to crypto at all. I support crypto against a government which would like to be called libertarian, which prats vacantly about democracy, free trade, and globalism while undermining freedom and constitutional liberties. This is the situation which necessitates private crypto. Conversely, many here likely would not be happy if I called myself libertarian, because I feel that corporations are titanic forces unfriendly to the vast majority of human beings and unworthy of human liberty. In short, I think that the libertarian position has been entirely undermined, coopted , and lost conceptual utility. The whole libertarian debate has become distasteful, trollish, and counter-productive, and it is driving people out of forums like this one, not attracting them. I would probably get labeled as a political spammer or a troll myself. I'm not sure this is what you want here. Regards, proclus http://www.gnu-darwin.org/ -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBOULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------ [demime 0.97c removed an attachment of type APPLICATION/pgp-signature]

5 4

Re: Decline of the Cypherpunks list...Part 19
by Freematt357＠aol.com 09 Dec '03

09 Dec '03

In a message dated 12/8/2003 8:27:05 PM Eastern Standard Time, declan(a)well.com writes: > >As for writing for "Reason," they haven't asked, and their editorial > >focus is increasingly statist. Cf. Cathy Young's quote at the bottom of > >this post. > > I disagree. I went to a Reason gathering in Washington last Thursday > and found the staffers there definitely not statist. > Reason has improved mightily after Nick Gillespie took over from Postrel as editor. After the Cathy Young statement I raised holy hell with Reason and to their credit both David Nott (President, Reason Foundation) and Mike Alissi (Publisher) both wrote me and promised, which they delivered, pro encryption articles. Around ten years ago I had a heated argument with one of the deep pocketed Trustees of the Reason Foundation about what I considered the magazine's divergence from libertarian thought. He basically said that if the magazine went into a more overtly libertarian direction, they'd lose subscribers- I thought then that was bs, and even let my subscription lapse. I resubscribed a couple of years ago and have found the magazine much improved. Regards, Matt Gaylor-

1 0

Marijuana once again legal in Ontario, Canada
by Tim Meehan 09 Dec '03

09 Dec '03

An unforeseen consequence of government incompetence. http://ontario.indymedia.org/front.php3?article_id=25324 TORONTO - Ontario Consumers for Safe Access to Recreational Cannabis is happy to inform consumers that, because of Health Canada's failure to implement constitutional Medical Marijuana Access Regulations, wide-open marijuana legalization is back in Ontario! "The police will likely still have their 'business as usual' public relations line, but since Health Canada has defied the order of the Ontario Court of Appeal by not allowing a grower to supply multiple patients, as ordered, the MMAR is unconstitutional," said Tim Meehan, communications director of OCSARC. "Because it's unconstitutional, that means that according to the Parker decision by the same court in 2000, the possession of marijuana law is dead once again." OCSARC reminds people that while they might still be arrested and prosecuted by police and prosecutors who refuse to acknowledge the status of the law, they may seek substantial financial compensation later. "This is a notice to police that while they do have the power to arrest harmless marijuana smokers, they will be doing so at their own peril. Cannabis consumers will not allow themselves to be treated as second class citizens, and many will be armed with legal information and representation in case the harassment continues," said Meehan. OCSARC (Ontario Consumers for Safe Access to Recreational Cannabis) is a Toronto-based organization working to end prohibition and promote reasonable and responsible regulation and quality assurance in the cannabis market.

2 1

None
by Keith Ray 08 Dec '03

08 Dec '03

who end

2 1

Re: Decline of the Cypherpunks list...Part 19
by Freematt357＠aol.com 08 Dec '03

08 Dec '03

In a message dated 12/8/2003 2:46:37 PM Eastern Standard Time, timcmay(a)got.net writes: > So, you are free to be "Matt Gaylor, Activist!" and to try to get > articles published in "Liberty" or "Gold Currency Times" or wherever > you get published, but I have other things I'd rather be doing. > > Preaching to me that I ought to be sacrificing my time for the > betterment of some skatepunks by publishing in "Piercing Magazine" is > the silliest kind of altruistic thinking. > No Tim, not altruistic. My reason for wanting you to write is a selfish one. Self preservation. You are able to tie technology into the bigger picture, and you do have something valuable to say. You already sacrifice your time in pointless diatribes about the good ole' days on CP- I'm just making a plea that you do something more useful- Regards, Matt Gaylor-

3 2

RE: Got.net and its narcing out of its customers
by Tyler Durden 08 Dec '03

08 Dec '03

Tim May wrote... "I consider Don Frederickson despicable, and stupid. To not bother before understanding the context of the thread and say, basically, "Yes, we have narced out this customer to law enforcement, but they are just watching" is reprehensible." Well, I saw the got.net quote before and that brief sample seemed to indicate something entirely different to me. First of all, it says they've 'talked to the authorities about him' seems allows for the possibility of having been contacted BY said authorities. Second, it points out "he hasn't broken any laws"...third it says "please notify me when he actually breaks the law..."...that's kind of a nice, business-smart "fuck off" as I see it. In other words, the guy seems to acknowledge that he doesn't like a lot of Tim May's philosophies, but he won't even think about doing anything unless Mr May personally murders someone or whatever. In other words, he's saying he's going to support Tim May's free speech, but he's saying it in a way that won't cause him to end up in Guantanamo. But then again, that's the only quote I've seen... -TD >From: Tim May <timcmay(a)got.net> >To: Declan McCullagh <declan(a)well.com> >CC: cypherpunks(a)lne.com >Subject: Got.net and its narcing out of its customers >Date: Mon, 8 Dec 2003 13:17:22 -0800 > >On Dec 8, 2003, at 1:15 PM, Declan McCullagh wrote: > >>On Sat, Dec 06, 2003 at 01:59:26PM -0800, Tim May wrote: >>>This actually fits in with something Lessig is widely known for, his >>>"technology-custom-law" trichotomy (*). >>> >>>(* He may call it something different...I haven't checked in a while. >> >>I was reading some of David Friedman's articles over the weekend and >>noticed that he also used the same trichotomy, predating Lessig. >> >>>"I'm sorry that Tim is being a bother again. He has a long history of >>>being obnoxious and threatening. So far, he has not broken any laws. We >>>have talked to the authorities about him on numerous occasions. They >>>have chosen to watch but not act. Please feel free to notify me if he >>>does anything that is beyond rude and actually violates any laws and I >>>will immediately inform the authorities." >>> >>>Thank You >>>Don Frederickson (co-owner and CEO of got.net, Santa Cruz) >> >>When did Don Fredderickson write this? >> >>-Declan >> > > >You can Google Groups for any of the unique text to find it, and the >context. > >Or, here's the thread (search on my name for the exact spot, or go to >August 22nd): > ><http://groups.google.com/groups?hl=en&lr=lang_en&ie=UTF-8&oe=UTF >-8&safe=off&threadm=220820032357238678%25timcmay%40removethis.got.net&rn >um=1&prev=/ >groups%3Fq%3Dfrederickson%2Bgot%2Btim%26hl%3Den%26lr%3Dlang_en%26ie%3DUT >F-8%26oe%3DUTF >-8%26safe%3Doff%26selm%3D220820032357238678%2525timcmay%2540removethis.g >ot.net%26rnum%3D1> > >Searching GG on "don frederickson got tim" is maybe more reliable than >pasting this URL. > >(If you are asking did Don write this on or about the 22nd?, I assume so, >of course, as this is when this "Kal" nym was foaming and threatening to >get my account yanked and have the cops raid my house.) > >It happened in one of the "movies" groups (rec.arts.current-movies), when >the thread was on DVD copy protection and the (claimed) illegality of >making DVDs of movies. > >I explained how I was cheerfully making an average of a DVD a day of my >favorite current movies. > >A couple of "nyms" went ballistic and foamed that they had forwarded my >"admissions" to the RIAA and how I would face civil penalties and jail >time, oh my! > >Then one of them claimed he had arranged to have my account yanked, for >"violation of the DMCA." He claimed he had sent copies of my "criminal" >admissions to Got.net, to the RIAA, to "law enforcement" (shudder!), and >so on. > >The owner of Got.net replied to him and the above got posted (not by me). > >I consider Don Frederickson despicable, and stupid. To not bother before >understanding the context of the thread and say, basically, "Yes, we have >narced out this customer to law enforcement, but they are just watching" >is reprehensible. > >The earlier owners/operators of Got.net took the stance that what people >said on Usenet or on mailing lists was of no interest to them, save for a >few carefully-spelled-out TOS issues (like spam). > >The new owner apparently thinks it's his job to narc out his customers to >law enforcement and then to tell others who are not even his customers >that he has done so. Were I the litigious sort, I might contemplate suing. > >(I haven't quit Got.net yet mainly because I am evaluating options for >broadband in my rural location. Currently, DSL is about half a mile away, >so may arrive soon--when it does I expect I will get it. Cablemodem is >available to the top of my hill, but not down my long driveway, and the >cable company will not allow me to either string my own lines or mount a >WiFi or IR or similar atop the telephone pole. (My utilities are >underground, but were laid when the house was built, circa 1976. No cable >lines. Which is one reason I got a satellite dish, DirecTV, shortly after >moving in. And, yes, I have looked at satellite broadband options like >DirectLink...not impressive at all.) And the "Pringles can" approach is >not something I want to spend my time engineering or debugging.) > >My hunch is that Frederickson and Got.net have been forwarding copies of >some of my e-mail to "law enforcement," which would have put them in >violation of the ECPA, except that after 9/11 and the Patriot Act and all >these actions are now considered just good corporate citizenship. > >--Tim May _________________________________________________________________ Cell phone switch rules are taking effect find out more here. http://special.msn.com/msnbc/consumeradvocate.armx

1 0

Re: Decline of the Cypherpunks list...Part 19
by Freematt357＠aol.com 08 Dec '03

08 Dec '03

In a message dated 12/7/2003 10:58:00 PM Eastern Standard Time, timcmay(a)got.net writes: > My generation was very active, on all sides. The droids born after > about 1980 are mainly followers. Probably what the nose rings are for. > Hey Tim, why don't you continue your activism and make an attempt to get your writing into more places where generation X might find it. If they are truly droids surely you with your grand intellect could be become their pied piper, leading their revolution. You might feel better venting to the cloistered culture here on CP, but what good does that do? Regards, Matt-

2 2

Re: Decline of the Cypherpunks list...Part 19
by Freematt357＠aol.com 08 Dec '03

08 Dec '03

[demime 0.97c removed an attachment of type message/rfc822]

1 0

Has this photo been de-stegoed?
by Tyler Durden 08 Dec '03

08 Dec '03

OK...let's say I receive a photo that I expected to contain stegoed information on it, but then find that there's nothing I can retrieve using the likely methods or software. Is it possible to determine that the photo 'originally' (ie, when it was sent to me) contained stegoed information, but that it was intercepted in transit and the real message overwritten with noise or whatever? Now I know pretty much nothing about this subject, but I would suppose that de-stegoing a photo must like some kind of spatial spectral fingerprint that should be visible after the photo is FFT'd (is there freeware software out there?). Now I IMAGINE that a sophisticated interceptor could substitute 'believable' de-stego-ing noise so that it would look like the photo never had any stego in the first place. OR...is this actually 'impossible' to do perfectly? And then, what if the interceptor tried to put an alternate message in there instead? Is there a way to tell that there was originallya different message there? My assumption first of all is that nothing was done to prepare the photo against these possibilities. A simple stego message was placed without real thought about whether it might be intercepted and altered. -TD _________________________________________________________________ Take advantage of our best MSN Dial-up offer of the year six months @$9.95/month. Sign up now! http://join.msn.com/?page=dept/dialup

1 0

Re: cypherpunks discussions
by Major Variola (ret) 08 Dec '03

08 Dec '03

At 07:22 AM 12/8/03 -0800, Eric Murray wrote: >Other people have made the point that mailing lists are "old tech" >and I agree. I don't like the new replacements (blogs, web boards) >as much as lists, but perhaps that's because of what I used first. Its not just "the First is the Only Way" phenom. What's going on is that folks are online all the time now, so things interactive (web boards, IM) have become more popular than they could have been in the dial-up past. The big advantage of email, which was the original "killer app", was store and forward. Ie, asych; offline. IM strikes me as perverse. If I wanted to be interrupted I'd answer my telephone. Email clients of olde allowed aliasing to lists, which predated (and motivated) mailing list exploders/auto-managers. They are still widely used for group-of-friends 'private' lists. Even my parents understand Bcc: nowadays. Yahoo boards have options to use email, and modern clients manage multiple email addresses. But for online folks a board is perhaps more convenient, since the board is accessable everywhere. For home/office/school mobility this is a feature, even if its regressing to the "PC as dumb terminal" mechanism. The advantage of eg Yahoo groups (and presumably blogs) is their moderation; the lack thereof enabled spammers to bulldoze the commons of usenet. Inevitable. Also the reason why lne.com is the best node. >Kids these days don't know how to use shell shortcuts either. Not sure what you mean by that. "Shortcut" is a M$ term for lame-ass sym link. ---- "Remember, it takes 42 muscles to frown and only 4 to pull the trigger of a decent sniper rifle." Michael Hohensee

4 3

Re: Decline of the Cypherpunks list...Part 19
by Major Variola (ret) 08 Dec '03

08 Dec '03

At 03:26 PM 12/7/03 -0800, Tim May wrote: >But even if crypto got trendy again, I just don't see the young >students of today flocking to our particular mailing list. Too many >other choices. Probably they'll read someone's daily blog.... A few observations. Nowadays, colleges offer courses in crypto. This was not the case when I started reading this list. And 'net social issues were not widely discussed; now there are many fora and public organizations that one can look at. Probably college courses on that, too. So *perhaps* neophytes interested in these things have many more places to learn. Just an optimistic possibility. I did much like your "the nose rings of the followers" comment though. ------ "When I was your age we didn't have Tim May! We had to be paranoid on our own! And we were grateful!" --Alan Olsen

1 0

Cypherpunks List Info
by cpunk＠lne.com 07 Dec '03

07 Dec '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Larry Lessig on ending anonymity through "identity escrow"
by Declan McCullagh 05 Dec '03

05 Dec '03

See also: http://politechbot.com/pipermail/politech/2003-December/000268.html --- >Date: Fri, 05 Dec 2003 09:12:16 -0500 >To: politech(a)politechbot.com >From: Declan McCullagh <declan(a)well.com> >Subject: Larry Lessig replies to Politech over limiting anonymity [fs][priv] > > >--- > >[Why do I get the feeling that Larry Lessig doesn't like "absolute" >anonymity much at all? Systems for building and defending "absolute" >anonymity already exist in the form of anonymous remailers and Freenet, >among others. It would be foolish to follow Larry's advice and concede too >quickly that such technologies have so few legitimate uses that they >cannot be reasonably defended. Even the oft-benighted Eurocrats have >recognized this: a 1997 EC directive encourages anonymity, as does a >German federal law (http://www.iid.de/rahmen/iukdgebt.html) In the U.S., >since the Federalist Papers were published with effectively "absolute" >pseudonymity, surely the framers of the U.S. Constitution had them in mind >when crafting the Bill of Rights. Justice Thomas lists more >contemporaneous examples in his McIntyre concurrence >(http://supct.law.cornell.edu/supct/html/93-986.ZC1.html) Saying >anonymous technologies are indefensible concedes a crucial point: that the >government's power is so sweeping that police have the right to learn our >identity in all cases. So much for whistleblowing and anonymous reports of >public brutality. > >Perhaps more to the point, the twin privacy-encroaching technologies of >automated electronic surveillance and efficient large-scale databases did >not exist decades or centuries ago. "Absolute" anonymity lets us reclaim >some of that lost zone of privacy. Lastly, trying to remove "absolute" >anonymity from the Internet (banning strong encryption and computers that >can be programmed not to keep logs) would be far more disruptive, >destructive, and harmful than proposals like Hollings' CBDTPA that Larry >has rightly opposed. --Declan] > >--- > >From: Lawrence Lessig <lessig(a)pobox.com> >Cc: Declan McCullagh <declan(a)well.com> >Subject: Re: [Politech] Economist, Lessig want to preserve freedom by >ending anonymity [fs][priv] >Date: Fri, 5 Dec 2003 10:16:31 +0900 >To: Aaron Swartz <me(a)aaronsw.com> > >It's not an inaccurate quote, but it is taken out of context. > >What I said was that the trend in our laws was to destroy any privacy at >all -- that the idiocy of Patriot Acts, etc., was effectively eliminating >any form of privacy. There are two kinds of responses to this -- one to >try to defend and build a system protecting absolute anonymity; the second >is to build effective protections for pseudonymous life, which is >shorthand for traceable transactions, but where the permission to trace is >protected by something like a warrant requirement. I'm not saying the >government should build these systems, but that they should be permitted >and indeed encouraged. > >In my view, we will make no progress following path one, but that we would >strongly advance privacy if we could advance path two. A strong ethic and >architecture of pseudonymous identity, properly protected, would give us >more privacy than we have today. > >Of course, it is possible (and probably likely) that such an architecture >would not properly protect the link between a transaction and the privacy >of a person. Government officials, for example, upon mere suspicion would >be able to break the link, etc. That of course is not what I am promoting. >I would promote a regime where the gov't required a very strong >warrant-like reason before it could break the code that makes the link. >But I will not that the baseline from which we're starting is a world >where no real showing is necessary for this sort of surveillance. > > >On Dec 4, 2003, at 9:26 AM, Aaron Swartz wrote: > >>>To preserve freedom further, suggests Mr Lessig, anonymity could be >>>replaced by [warrant-traceable] pseudonymity. >> >>Can you explain this? The Economist article seemed to be total nonsense, >>but I'm surprised they paraphrase you as saying something like this. In >>general, for eliminating anonymity to make sense you need to answer three >>questions: >> >>1. Is anonymity the problem? Between DMCA subpoenas and national security >>letters, it seems that very few people on the Internet have even limited >>anonymity. >> >>2. Will the people who are anonymous evade things? The people who _are_ >>anonymous, of course, are people like crackers. If you outlaw anonymity, >>crackers will likely find security holes that let them hide their >>identity and pass their actions off as those of others (e.g. using the >>WiFi network of some squeaky-clean grandma to launch the attacks). >> >>3. Is it worth the cost? Even if you can answer the above questions, >>it'll be difficult to do without knocking large groups of people off the >>Internet. (If the digital divide is bad now, imagine what it'll be like >>when you need a credit card to get on the Net.) >> >>Were you misquoted? If not, can you answer these questions? Or is this >>more blind optimism? >>-- >>Aaron Swartz: http://www.aaronsw.com/ >----- >Lessig >Stanford Law School >559 Nathan Abbott Way >Stanford, CA 94305-8610 >650.736.0999 (vx) >650.723.8440 (fx) > > Ass't: <laura.lynch(a)stanford.edu> > <http://lessig.org/blog> > <http://creativecommons.org> > <http://eldred.cc> > > Help reclaim the Public Domain: Please sign this petition: > http://eldred.cc/sign > > How else can you help? Check out: > http://svcs.affero.net/rm.php?r=Lessig

2 2

Privacy and Property on the Net: Research Questions
by Eugen Leitl 05 Dec '03

05 Dec '03

http://www.sciencemag.org/cgi/content/full/302/5651/1686 PERCEPTIONS OF SCIENCE ESSAY: Privacy and Property on the Net: Research Questions William Sims Bainbridge* The Net, which consists of the Internet plus the parallel networks of commercial and military data communication, raises serious issues of personal information vulnerability and ownership of intellectual property. Peer-to-peer sharing of music files over Internet, for example, challenges the existing system of copyright. Counterterrorism "data mining" systems hunt for signs of suspicious activity across vast databases of information about people who do not wish to be spied upon. Research by social and information scientists is needed to clarify many such issues. To a sociologist, perhaps the most interesting quality of Internet and other data transmission networks is their potential to alter power relationships with respect to personal privacy and intellectual property. Both are restrictions on the free flow of information. Government is implicated in both, on the one hand by providing legal support for them and, on the other hand, by potentially violating them in the pursuit of its own goals, such as national security. Social scientists have only just begun framing research projects to learn how the Internet is liberating information from traditional restraints or to understand the likely human consequences. Although both privacy and property are rooted deep in humanity's evolutionary past, they are variables, and societal norms change. For example, until a century and a half ago, U.S. census takers would post their completed enumeration forms in the town square for anyone to read, but from 1850 until 1954 when Title 13 of the U.S. Code forbade publication of an individual's records, a complex series of steps gradually increased confidentiality protections (1). Today, the Census Bureau keeps the data confidential for 72 years. This change has largely been driven by the increasing government collection of data about its citizens, to facilitate social services, taxation, and management of the economy (2). By offering confidentiality, government hopes the public will relinquish some of its traditional privacy. Whether citizens benefit from government collection of data about them is another matter. In Maryland, every prospective juror is asked what his or her religion is, even though this information is not used in the jury selection process. The religion data are kept confidential, but all information about prospective jurors that is used in the selection is made public. Thus, we have the bizarre situation of costly information being kept confidential precisely because it is useless. The idea that government should regulate intellectual property through copyrights and patents is relatively recent in human history, and the precise details of what intellectual property is protected for how long vary across nations and occasionally change. There are two standard sociological justifications for patents or copyrights: They reward creators for their labor, and they encourage greater creativity. Both of these are empirical claims that can be tested scientifically and could be false in some realms (3, 4). Consider music (5). Star performers existed before the 20th century, such as Franz Liszt and Niccolo Paganini, but mass media produced a celebrity system promoting a few stars whose music was not necessarily the best or most diverse. Copyright provides protection for distribution companies and for a few celebrities, thereby helping to support the industry as currently defined, but it may actually harm the majority of performers. This is comparable to Anatole France's famous irony, "The law, in its majestic equality, forbids the rich as well as the poor to sleep under bridges." In theory, copyright covers the creations of celebrities and obscurities equally, but only major distribution companies have the resources to defend their property rights in court. In a sense, this is quite fair, because nobody wants to steal unpopular music, but by supporting the property rights of celebrities, copyright strengthens them as a class in contrast to anonymous musicians. Internet music file sharing has become a significant factor in the social lives of children, who download bootleg music tracks for their own use and to give as gifts to friends. If we are to believe one recent poll done by a marketing firm rather than social scientists, 48% of American Internet users aged 12 to 17 had downloaded music files in the past month (6). In so doing, they violate copyright laws, and criminologists would hypothesize they thereby learn contempt for laws in general. A poll by the Pew Internet and American Life Project found that two-thirds of an estimated 35 million Americans who download music files do not care whether they are copyrighted (7). Thus, on the level of families, ending copyright could be morally as well as economically advantageous. On a much higher level, however, the culture- exporting nations (notably the United States) could stand to lose, although we cannot really predict the net balance of costs and benefits in the absence of proper research. We do not presently have good cross-national data on file sharing or a well-developed theoretical framework to guide research on whether copyright protection supports cultural imperialism versus enhancing the positions of diverse cultures in the global marketplace. It will not be easy to test such hypotheses, and extensive economic research has not conclusively answered the question of whether the patent system really promotes innovation. We will need many careful, sharp-focus studies of well-formed hypotheses in specific industries and sectors of life. For example, observational and interview research can uncover the factors that really promote cultural innovation among artists of various kinds and determine the actual consequences for children of Internet peer-to-peer file sharing. The classic sociological theory of privacy asserts two main principles that are relevant to current information debates (8, 9). First, private relations between individuals are not merely a personal luxury but the very basis of all societies. Thus, surveillance of citizens in the name of national security undermines the very society it was intended to protect. Second, privacy and its violation are inescapably issues of power, with power defined as the ability to defend one's own privacy while being able to invade the privacy of others. Thus, citizens' privacy is violated by government surveillance, even if the information is kept confidential afterward by the agencies. Computer scientists have begun to develop systems that would defend people's information privacy (10). For example, the World Wide Web consortium, which is the chief forum for development of Web standards, has launched the Platform for Privacy Preferences, which automatically manages personal information when interacting with Web sites, following the explicit wishes of the user (11). Ethically informed research can be valuable for design and implementation of information systems. Data mining, for example, can be used in noncontroversial situations like intrusion detection, when you need to defend your own data against attack from outside. But it can also be used aggressively to sift through vast troves of data, pulled together via the Net in a process called data fusion, in a way that violates the privacy of law-abiding citizens while hunting for a few criminals or terrorists. In its recent report, Information Technology for Counterterrorism, the National Research Council blithely suggests that all airport security baggage x-ray machines could send their pictures to a unified computer network that would monitor the collective movements of terrorists boarding different airplanes in different cities, incidentally spying on everybody else who flies (12). Proper sociotechnical design could limit the harm. For example, an automatic data-mining system could seek patterns of suspicious behavior, without allowing any human being to see the data. Then, specially sworn court officials could carefully examine the suspicious cases, before reporting to law enforcement only those few that met statutory definitions of probable cause. What is the optimal design for such a multitiered confidentiality system? Would there be unintended consequences? Would it be acceptable to the public? Without good answers to such questions, information technology could fall under the same cloud of public suspicion that hangs over nuclear power and genetic engineering. Already, aggressive telemarketing has made people very reluctant to answer scientific surveys administered by telephone (13). Internet-based surveys have promise, but they typically lack the reliability of traditional random-sample polling. Another challenge is that impartial research on the real consequences of government security-motivated data fusion and mining may not be possible within the government security regime itself, because impartiality in science requires the research to be made public. Like other buzzwords, "data mining" is difficult to define precisely, and it is practically indistinguishable from a wide range of statistical and pattern recognition techniques used throughout the sciences. Thus, if it is brought into disrepute by privacy violations, science could be harmed. Similarly, many scientists use data that belong to other people, such as the social survey data archived at the Inter-University Consortium for Political and Social Research (14), so they would be affected by any change in the intellectual property regime. Internet arose as a medium of scientific communication and is an indispensable tool for scientists today. Thus, research on Internet privacy and property issues could benefit science itself, as well as society. Only an anarchist would argue for complete government deregulation of information, but any social scientist would find it interesting to contemplate the implications of major changes in government enforcement of intellectual property rights and government collection of data about its citizens. This essay has briefly sketched theoretical issues that would underlie research on information privacy and property in the age of Internet, and policy-makers should be aware that current practices may reflect cultural lag, the conflict-ridden situation when technological development has rendered traditional norms obsolete (15). References and Notes 1. R. McCaa, S. Ruggles, Scand. Pop. Stud. 13, (2002). 2. D. Bell, The Coming of Post-Industrial Society (Basic Books, New York, 1973). 3. C. A. Ganz-Brown, J. World Intellect. Property 1, (1998). 4. National Research Council, Computer Science and Telecommunications Board, The Digital Dilemma: Intellectual Property in the Information Age (National Academy Press, Washington, DC, 2000). 5. W. S. Bainbridge, in Social Sciences for a Digital World, M. Renaud, Ed. (Organization for Economic Co-Operation and Development, Paris, 2000). 6. Ipsos-Insight, "Legal issues don't hinder American downloaders" (14 March 2003); [cited from www.ipsos-reid.com 5 May 2003]; available at www/ipsos-insight.com. 7. M. Madden, S. Lenhart, "Music downloading, file-sharing and copyright" (July 2003) at www.pewtrusts.com. 8. B. Schwartz, Am. J. Sociol. 73 (1968). 9. W. S. Bainbridge, "Privacy," forthcoming in Encyclopedia of Community, K. Christensen and D. Levinson, Eds. (Sage, Thousand Oaks, CA, 2003). 10. National Research Council, Computer Science and Telecommunications Board, Who Goes There?: Authentication Through the Lens of Privacy (National Academy Press, Washington, DC, 2003). 11. World Wide Web Consortium at www.w3c.org. 12. National Research Council, Computer Science and Telecommunications Board, Information Technology for Counterterrorism (National Academies Press, Washington, DC, 2003). 13. D. El Boghdady, Washington Post, 8 September 2002, p. H1. 14. Inter-University Consortium for Political and Social Research at www.icpsr.umich.edu. 15. W. F. Ogburn, Social Change (Huebsch, New York, 1922). 16. The views expressed in this essay do not necessarily represent the views of the National Science Foundation or the United States. The author is in the Division of Information and Intelligent Systems, the Directorate for Computer and Information Science and Engineering, National Science Foundation, 4201 Wilson Boulevard, Arlington, VA 22230, USA. E-mail: william.bainbridge(a)verizon.net -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

[IP] Markle Report -- Creating A Trusted Information Network for Homeland Security (fwd from dave@farber.net)
by Eugen Leitl 05 Dec '03

05 Dec '03

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Uniform Police apparently unconstitutional
by kawaii ryuko 04 Dec '03

04 Dec '03

http://www.constitution.org/lrev/roots/cops.htm "Police work is often lionized by jurists and scholars who claim to employ "textualist" and "originalist" methods of constitutional interpretation. Yet professional police were unknown to the United States in 1789, and first appeared in America almost a half-century after the Constitution's ratification. The Framers contemplated law enforcement as the duty of mostly private citizens, along with a few constables and sheriffs who could be called upon when necessary. This article marshals extensive historical and legal evidence to show that modern policing is in many ways inconsistent with the original intent of America's founding documents. The author argues that the growth of modern policing has substantially empowered the state in a way the Framers would regard as abhorrent to their foremost principles." (Stolen from Declan's Politech list and reposted here.) Ever lovable and always scrappy, kawaii

1 0

[IP] The Third Annual Workshop on Economics and Information Security (fwd from dave@farber.net)
by Eugen Leitl 04 Dec '03

04 Dec '03

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Recommended Pro freedom discussion list
by Freematt357＠aol.com 03 Dec '03

03 Dec '03

[Note from Matt Gaylor: I've been on this list for a couple of years and on occasion I find the discussion lively and interesting. It's coming from Kent State University, the place where actual real assault rifles were used May 4, 1970 to wound 9 and kill 4 student war protesters. Ohio Guardsmen opened fire during a noontime demonstration. For a chronology of the shooting please go to: http://members.aol.com/nrbooks/chronol.htm. I can think of no better way to remember the fallen, than by discussing liberty via the school they attended.] -=> the libertarian discussion list <=- ldl(a)listserv.kent.edu The ldl list is intended for discussion of libertarian issues, as well as announcements of local and state events. We encourage lively and active discussion, and discourage mean, derogatory, or wildly off-topic posts. - To subscribe, send 'subscribe ldl' in the body of an email message to listserv(a)listserv.kent.edu - To get a reference of listserv commands and options, send 'info ref' in the body of an email message to listserv(a)listserv.kent.edu - For other problems or questions, send email to list owner Bob Hart at bobhart(a)neo.rr.com

1 0

Re: [p2p-hackers] Peer-to-Peer Journal (P2PJ) CFP (fwd from sam@neurogrid.com)
by Eugen Leitl 03 Dec '03

03 Dec '03

Right now we're getting increasing FUD from the sides of Elsevier & Co against emerging open content journals. I don't think there's a turning of the tide, though, as early adopters have already embraced alternative channels of publication (physicists and math people foremost in arXiv), and it's only a matter of time before more conservative branches of science (medical, chemistry and biology people: that's you) are to follow. We might be getting the publishing monopolists to try grasping for DRM for paper copyright. I'm wondering why they haven't started watermarking their .pdfs yet, shough a crawler looking for phrases or computing document hashes would do just as nicely. Either way, the librarians are attempting to revolt using whatever little leverage they have. Fact is, the budgets are shrinking, and the shelves are emptying, while the content owners have established a de facto pay per view. ----- Forwarded message from Sam Joseph <sam(a)neurogrid.com> -----

2 1

Inferno: PBS | I, Cringely . Archived Column (fwd)
by Jim Choate 03 Dec '03

03 Dec '03

What I find most interesting in this article is not MS marketing noise but the comment about the White House, robot.txt, and Google... http://www.pbs.org/cringely/pulpit/pulpit20031120.html Truly a despicable act for a -public servant-. -- -- Open Forge, LLC 24/365 Onsite Support for PCs, Networks, & Game Consoles 512-695-4126 (Austin, Tx.) help(a)open-forge.com irc.open-forge.com Hangar 18 Open Source Distributed Computing Using Plan 9 & Linux 512-451-7087 http://open-forge.org/hangar18 irc.open-forge.org James Choate 512-451-7087 ravage(a)ssz.com jchoate(a)open-forge.com

1 0

Japan police arrest two Winny/Freenet users
by R. A. Hettinga 02 Dec '03

02 Dec '03

<http://asia.cnet.com/newstech/security/printfriendly.htm?AT=39159923-390011…> Japan police arrest two P2P users By Staff, CNETAsia 3/12/2003 URL: http://asia.cnet.com/newstech/security/0,39001150,39159923,00.htm A Japanese peer-to-peer (P2P) file-sharing network which claimed to keep user identities untraceable has failed to work--two users in Japan have been arrested. The developer of the P2P software has also had his home searched by police, according to a report in the Mainichi Daily. There are around a quarter of a million users of the supposedly anonymous file-trading network, called Winny, which rides on the more well-known Freenet network. Such networks differ from other file trading software such as Kazaa in that they claim to be able to hide the Internet Protocol (IP) addresses of users. It is not known how the police managed to track down the two users, or why criminal action is being taken against them. In other countries, P2P users have been hit with civil lawsuits instead. The creator of Freenet, Ian Clarke, has cast doubt on whether Winny uses Freenet's full identity-cloaking features or its cryptography, according to a report in New Scientist. Freenet is an open-source project and is most prominent of a growing number of projects aimed at giving people the ability to communicate online without being tapped, traced or monitored. The software marks an attempt to create a network that exists as a parallel Internet, where content of any kind can be uploaded and downloaded without any way to track who created a given "site". Unlike other peer systems, Freenet has a built-in method of pushing content between different computers, so that a given file can migrate around the network between different people's hard drives until it is stored near regions where it is most often used. The arrested are two men, aged 41 and 19, said the Mainichi Daily report. Among other charges, the older man is accused of sharing the Hollywood movie A Beautiful Mind while the teenager is being held for making the game Super Mario Advance available online. Several companies, including game maker Nintendo, are pressing charges against the pair. This is the first known case of legal action being taken on users on anonymous file-sharing networks. In Korea and Taiwan, lawsuits have been filed against users of P2P networks. A copyright body in Taiwan is suing three users of file sharing networks while in Korea, recording companies are threatening to do the same. In both countries, creators of file sharing software have been brought to court, but defendants are arguing they are not responsible for what people choose to share. Both cases involve homegrown P2P networks sharing local-language music. In Taiwan, the International Federation of the Phonographic Industry (IFPI) has sued three P2P users who are said to have shared files on the locally-popular Kuro and Ezpeer networks. Unlike internationally popular networks such as Kazaa, both Taiwanese services are fee-based. The Recording Industry Association of Korea (RIAK) is said to be mulling suing end users of free-use P2P software Soribada. Soribada's 4.5 million users have lost the recording industry millions in revenue, claimed the RIAK. The makers of the software have been slapped with a US$16,300 fine, despite claiming that they are not responsible for the actions of its users. In the U.S., the Recording Industry Association of America (RIAA) has targeted hundreds of P2P users for legal action. There is some evidence that the controversial RIAA lawsuits against ordinary computer users are making a dent in the file-swapping world. According to Web analysis firm Nielsen/NetRatings, weekly usage of the Kazaa software in the United States plummeted from a high of 7 million people in early June to just 3.2 million people in late October. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Silly Linux Kernel Bug
by Eric Cordian 02 Dec '03

02 Dec '03

As reported today on Slashdot, in linux kernels prior to 2.4.23, it is possible to map the kernel into user space with brk(), since apparently no one ever bothered to check that the argument passed was in the lower 3 gig of the address space. This is almost as funny as early linux kernels in which the LDT was user writable. In any case, the patch is to stick the following check in do_brk() in /mm/mmap.c if ((addr + len) > TASK_SIZE || (addr + len) < addr) return -EINVAL; This is of course a serious bug, since anyone on a vulnerable machine has access to kernel memory by writing a terse no-brainer C program, of which I will not give an example, because enough people on the Internet hate me already. :) An interesting occurrence, because it demonstrates that massive numbers of open source participants auditing the code aren't sufficient to ferret out every giant coding blunder. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

4 4

[discuss] national Community Technology Network conference, Austin Dec 7-9 (fwd)
by Jim Choate 02 Dec '03

02 Dec '03

---------- Forwarded message ---------- Date: Tue, 2 Dec 2003 16:01:35 -0600 (CST) From: gene crick <gcrick(a)main.org> To: discuss(a)effaustin.org Subject: [discuss] national Community Technology Network conference, Austin Dec 7-9 Comrades, the Time Has Come To Arise! [I still miss ole Leon Trotsky and his gang] EFF supporters have a unique opportunity to hear and be heard at the Sixth Annual Community Technology Networking Conference at the Holiday Inn (I-35 at Woodward this Monday and Tuesday. Public interest technology is facing near-crisis: we're out of fashion with government and corporate leaders, telecom providers are avoiding underserved people, challenges like spam and threats to free speech are back on the rise. 2004 will be a critical year. But there are good prospects as well. Community Information Communications Technology (ICT) is one of the few telecom professions solidly growing, and the major players are coming to Austin to meet with us in a few days. (FCC, Department of Commerce, Gates Foundation and many more) You need to be here. EFF should be solidly represented, sharing views and plans for the future of the Internet as something more than a mass marketing sales outlet. Cost for the conference is no barrier either: register as student is only $50, includes three meals, and we don't check student IDs :) (regular is $100) So come join us; we finally have a chance to make our concerns known! thanks gene Gene Crick TeleCommunity Resource Center EFF, EFF-Austin [demime 0.97c removed an attachment of type APPLICATION/MSWORD which had a NAME of CN2003 invitation.fin.doc] --------------------------------------------------------------------- To unsubscribe, e-mail: discuss-unsubscribe(a)effaustin.org For additional commands, e-mail: discuss-help(a)effaustin.org

1 0