December 2003 - cypherpunks-legacy

CDL is here!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from mega(a)cash-site.com ----- >From mega(a)cash-site.com Tue Oct 14 13:49:23 1997 From: mega(a)cash-site.com Message-Id: <199710141849.NAA10744(a)enteract.com> Date: Tue, 14 Oct 1997 14:46:05 -0400 X-Sender: mega(a)cash-site.com To: mega(a)cash-site.com Subject: CDL is here!! CDL - the "first" true software that will "change your life" Commissions paid direct from the field DIRECT to YOU!!! No more worries about receiving checks - YOU get paid first! The FIRST company to tap into the $200 billion dollar software industry as a "home business" Packed with software...loaded with value...$200+ CD packed full of software included! There's only ONE WAY to find out more - go download the software for FREE.....install it and look at it - it will blow your mind!! (backed by major corporations) Download your FREE copy today at: http://www.makecash.net/cdl A great way to "make some extra cash" Explosive Opportunity to get in FIRST!! REMEMBER - this is the FIRST in a multi-billion dollar field..are you going to watch us or join us!! We have full support: conference calls daily toll free sizzle line fax-on-demand FREE webpages WOW!!! FREE Download! http://www.makecash.net/cdl /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// ----- End of forwarded message from mega(a)cash-site.com -----

1 0

Hi from the Girls...... (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from 36568300(a)18565.com ----- >From 36568300(a)18565.com Mon Oct 13 20:04:20 1997 From: 36568300(a)18565.com Date: Mon, 13 Oct 97 15:26:38 EST To: mailmaster(a)fish.net Subject: Hi from the Girls...... Message-Id: <6730057729034.43209(a)fish.net> Reply-To: mailmaster(a)fish.net X-Pmflags: 340788480 X-Uidl: 1834e532395abb83946c924b47abc32f Comments: Authenticated sender is <mailmaster(a)fish.net> BEWARE!!! WARNING!!! NOTICE!!! This is an adult site. You must be 18 to enter. If you are offended by subjects of sexual nature PLEASE DO NOT ENETER!!!! In the event you enjoy sex you must join us for the youngest, hotest live sex on the net. You hear us, see us, and direct our every move. To join us now just click on the higlighted text below: http://youngnlusty.com Love, The girls at Young N Lusty ----- End of forwarded message from 36568300(a)18565.com -----

1 0

Cyber Promotions Selling Off Its Own Mailing List (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from cyberout(a)pleaseread.com ----- >From undeliver(a)pleaseread.com Mon Oct 13 20:24:07 1997 Message-Id: <199710140123.UAA09407(a)enteract.com> Date: Mon, 13 Oct 1997 21:07:02 -0400 (EDT) X-1: NEW! Click on http://www.cyberpromo.com for FREE AUTORESPONDERS! X-2: This server blocks unauthorized email relaying. X-3: Link To Anti-Relay Code X-4: THIS MAIL WAS SENT THROUGH IEMMC'S NEW REMOVE FILTRATION SYSTEM! X-Advertisement: Visit http://www.iemmc.org for name removal information. From: cyberout(a)pleaseread.com To: fulldatabase(a)pleaseread.com Organization: Cyber Sender 7.0 Subject: Cyber Promotions Selling Off Its Own Mailing List ANNOUNCEMENT: Cyber Promotions is SELLING OFF ITS OWN MAILING LIST! For the first time, you can own Cyber Promotions proprietary list of 2.9 million email addresses. This is the same list to which Cyber has sent its e-Mags and exclusives. This list has never been sold before! You can take advantage of Cyber Promotions hard work since 1994. Cyber has painstakingly collected these email addresses from the following sources... * Online classified advertisements * Subscribe requests * Autoresponder requests * FreeResponder owners * FreeRelay recipients * Online business-related profiles * Web visitors * Internic records * Web mall advertisers * ... and much more! Since many of the people in this database have been on this exclusive list for over 6 months, they have had many opportunities to unsubscribe. This list only includes people who have not requested removal. Very few of these email addresses are available from other sources. You can use this list over and over again. You stand to make big money if you market your product, service or opportunity to this database. Regular price will be $2995 -- ONE WEEK SPECIAL only $995 -- (SAVE $2000) YOU CAN BE ONE OF THE VERY FIRST PEOPLE TO BENEFIT FROM THE BEST MONEY-MAKING EMAIL LIST EVER! So, don't wait. Order this list today before your competitors get to it first! This list is available on CD-ROM. You can receive it via 2nd day Airborne Express. Call Cyber Promotions at (215) 628-9780 between 10am and 7pm Eastern, and ask for Brian or Alan. Dont delay! This is the list you've been looking for. 48 hour special: Order within 48 hours and receive free limited versions of Stealth Bomber (send 50,000 emails an hour from your local dialup account and cloak your account id) and List-X (collect your own email addresses). Call NOW! (For list removal, hit reply and type "remove") ----- End of forwarded message from cyberout(a)pleaseread.com -----

1 0

FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from netbiz(a)mail2.c-flash.net ----- >From netbiz(a)mail2.c-flash.net Mon Oct 13 23:00:35 1997 From: netbiz(a)mail2.c-flash.net Message-Id: <199710140400.XAA11339(a)enteract.com> Date: Mon, 13 Oct 1997 22:57:49 PDT Date: Mon, 13 Oct 1997 22:57:49 PDT Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! X-Mailer: Emailer Platinum (tm) by Internet Marketing Inc. //////////////////////////////////////////////////////// Realizing that many of you do not wish to receive UCE, if you would please type REMOVE in the Subject Header, your name will be REMOVED permanently from our mailing lists. All addresses being sent to now have be cleaned through our REMOVE System. By typing REMOVE in the header, you will no longer receive mail from this address!! Thank You! ///////////////////////////////////////////////////////// This is a 100% FREE OFFER to get your own FREE HOME BUSINESS KIT. This is NOT a Scam, Nor a Pyramid Scheme, but is however a Legal Legitimate Network Marketing Business!!! This Business is a FULLY licensed Telecommunications Company operating with licenses in all 50 states. There are absolutely NO PURCHASE REQUIREMENTS to join our company. SORRY...THIS OFFER IS FOR US RESIDENTS ONLY!!!! THE FREE HOME BUSINESS KIT INCLUDES: 1) FREEDOM Bulk Emailer worth $400.00 2) CHECKR SOFTWARE, worth $200.00 allows you to accept checks over fax,phone, or email. 3) Over 30 Million Email Addresses 4) FREE PERSONALIZED WEB SITE 5) Premade Marketing Letters and Templetes 6) Over 1600 FREE Sites To Advertise Your Business 7) Personalized Guidance and Direction 8) Over 50% Savings on Long Distance Bills at only 9.9 cpm 9) Over 90% Savings on Calling Cards, with NO SURCHARGE! 10) 800/888 Personal or Business Phone Lines at 9.9cpm for only $1.50/month!! 11) Huge Income Potential!! 12) Monthly Residual Income!! 13) Plus Much, Much More!! BEFORE YOU READ ANY FURTHER, YOU NEED TO KNOW THAT THE FOLLOWING BUSINESS OPPORTUNITY WILL COST YOU ABSOLUTELY NOTHING! IT'S 100% FREE!!!!! Do You Know 3 People That Use Long Distance? Dumb Question Huh? If you GAVE those 3 people a FREE Business Kit including all the Necessary Software, Do You Think They Might Know 3 People Who Use Long Distance? What if You Told Them They Could: Save on every Long Distance Call! (24 Hours a Day!) Long Distance Rates as low as 9.9 cents per minute> AT&T, MCI, and Sprint can't touch this! 800/888 for your home! Avoid calling home collect! Perfect for kids away at college or even use it to check your messages. Your cost for this is the same 9.9 cents per minute! AT&T charges a $10.00 monthly service fee for this feature. It's ONLY $1.50 per month with us! No-Surcharge Calling Card! Save almost 90% with rates as low as 19 cents a minute! (MCI, Sprint, and AT&T charge 80 cents minimum surcharge per call.) Pick your own card number and PIN for convenience. One More Thing . . . Don't confuse THIS with phone "clubs" who charge a monthly fee ($10-$50) for the "rights" to get a discount. Remember, you don't have to join anything to receive any of these great communication services, like long distance, paging and calling cards! Introducing The Easiest, Most Profitable, and Fun Way to Not Only Save Money, but to Work Part Time at Home and Get Paid!!! Lets' Take a Look at the Realistic Income You Can Generate By Just Telling 3 People!! You Tell 3 People about this offer = 3 people Those 3 Tell 3 People about this = 9 people Those 9 Tell 3 People about this = 27 people Those 25 Tell 3 People about this=81 people Those 81 Tell 3 People about this=243 people Those 243 Tell 3 People about this=729 people Those 729 Tell 3 People about this=2187 people Those 2187 Tell 3 People about this=6561 people Now add up all 8 levels of people to get = 9,840 people YOU KNOW HAVE 9,840 PEOPLE ON YOUR SUCCESS TEAM Now The Fun Part!! We know just by human nature that people could spend an average of $25.00 per month on Long Distance. Some people spend 10 times that, and others may not spend any. For all practical purposes, lets say all 9,840 people spent only $25.00 per month on Long Distance. 9,840 people x $25.00/month = $246,000/month on Long Distance!! HERE'S WHERE YOUR REWARD COMES IN!! Because You Told 3 People and got the ball rolling you are now paid 2% commission on the total monthly phone bill in your team. That's $246,000 Dollars X 2% Commissions = $4,920.00/per month in your pocket!!! WOULD THAT HELP INCREASE YOUR LIFESTYLE A BIT? YOU KNOW IT WOULD!! BUT TELLING 3 PEOPLE IS VERY CONSERVATIVE!! What would your income be if you told 5 people? I can't tell you, because you wouldn't beleive me!! So is this for real, or am I just blowing smoke? You Bet It's For Real!! People using Long Distance Is as natural as the air we breath, and the food we eat. This can, and will happen if you do your part!! What is your part? 1.You need to Tell 3, Tell 4, Tell 5, etc. and spread around your ID#, mine is #AH603800 2.You need to work with your downline to make sure that they Tell 3, Tell 4, Tell 5, etc. 3.You need to stay in touch and teach them how to do what you just did!! My favorite saying is "Give a Man a Fish, and Feed Him For a Day! Teach a Man to Fish, and Feed Him For Life!" So What Do You Need to Get Started? You Need to Contact Me For More Detailed Information including the Toll Free Sign Up Number and Web Site...You can contact me at netbiz(a)mail2.c-flash.net and type "MORE INFO" in the subject header, or leave a message for me at 414-669-3722, and make sure you leave your email address and phone number. After you sign up FREE, send me an email at netbiz(a)mail2.c-flash.net, be sure to include your name, address, telephone number, email address, and your new ID# they will assign you, and I will rush out your FREE BUSINESS AND MARKETNG KIT, including FREEDOM BULK MAIL SOFTWARE, and CHECKR, check by fax or phone software. Plus Your FREE MARKETING START UP KIT!!! ----- End of forwarded message from netbiz(a)mail2.c-flash.net -----

1 0

Re: PGP CAKware & IETF controlled Open-PGP standard
by Omegaman 17 Dec '03

17 Dec '03

Adam Back writes: > Jonathan Seybold <jseybold(a)pgp.com> writes: > > Adam, one aspect of your suggestion puzzles me: > > One thing which concerns me most is KNOWING when a message I send > > (or receive) could be read by someone else. The PGP CMR scheme makes this > > very clear: if there is an extra CMR key, the message may be read by > > whomever controls that key, if not, only the recipient may decrypt the > > message. > > If, however, the message is secretly re-encrypted to a corporate > > storage key AFTER it is received, I will never know that. > > You will if you mark the key with this information. This is a straw man anyway. You don't know this now. Someone you are communicating with could already be forwarding plaintext to a third party unbeknownst to the sender. This is a "do you trust the recipient" issue. > What I _am_ arguing is that in designing systems to provide companies > with data recovery mechanisms that you should a) not weaken security > more than necessary, and b) that it would be nice if you used a method > which doesn't introduce GAK compliancy for communications keys. > > I presented I think in plenty of detail an alternate mechanism which > is both non-GAK compliant, and more secure. So what is the problem? > Is there a technical flaw in my solution? No. But there is in their's(PGP Inc.) as I think you and others have amply demonstrated. The technical issues alone are enough to reject usage of PGP5.5's CMR features. It intrigues me that there has been virtual silence from PGP employees on the technical issues. Only Hal Finney via the IETF-Open-PGP has come anywhere near commenting upon this. I haven't seen anyone from PGP Inc. comment on your data-recovery implementation ideas. In my optimistic moments, I take this as a sign that internally, PGP inc. is giving consideration to producting more sensible and effective solutions. (Maybe even as outlined here) > > This means, I believe, that they should NEVER INVOLVE HIDDEN BACK > > DOORS THAT USERS ARE NOT AWARE OF. > > Agreed. You can flag backdoors with either solution. See above. The prescence of flags does not prevent this. By definition I might add ;). Trust issues, etc. are involved. > It works well enough, but it could be made much more secure, by > separating storage key functionality from transient message key > functionality. This would also give you the chance to resolve the > articificially created need for GAK compliancy, which arises because > you are being forced by this lack of distinction between key > functionalities to use one key for both long term storage and what > should be transient communications key usage. Hal Finney's description of key sttributes indicate that implementing separate storage keys would not be hard for PGP Inc to implement in the next release. > Decentralised control is good, of course, but the pgp5.5 and SMTP > policy enforcer is a ready to roll GAK system. Of course, other companies could have (and will) implement similar systems. That PGP, with it's reputation and stated policies, would is surprising. Hopefully, PGP will live up to their reputation by realizing this misstep and correcting it with a more secure, less GAK-compliant implementation. > The PGP bashing PGP observes is an attempt by the pro-privacy crypto > community to influence PGP to re-think the GAK compliancy, and to > point out the more secure way to implement corporate recovery of > stored email messages without GAK compliancy. > > I reserve the right to bash any company which attempts to field GAK > compliant software. The "bashing" in this notoriously harsh forum has been rather tender in my view. Perhaps the perception of "bashing" is based on recognition (and guilt) that the CMR mechanism is flawed and goes against "the spirit of PGP." Methinks, y'all doth protest too much. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

New Mailing List: Terrorism
by John Gilmore 17 Dec '03

17 Dec '03

Sounds like some "civil rights oriented" EMS, fire, law enforcement, intelligence community, etc people should join, and let the rest of us know what they are doing... John From: churton.budd(a)mediccom.org (Churton Budd) Date: Sat, 11 Oct 1997 10:55:40 GMT TERRORISM --------- TERRORISM is intended for discussion about terrorism response and prevention, including intelligence gathering and emergency responses. Topics include weapons of mass destruction, suspicious activities, educational and funding opportunities, politics, and response ideas. TERRORISM is an open forum to EMS, fire, law enforcement, intelligence community, disaster preparedness & response, and military personnel with an interest in preventing and responding to terrorist incidents. Announcements about new educational opportunities and grants are welcome, as are new products, services, or technologies directly related to terrorism response. Listname: terrorism Post to: terrorism(a)mediccom.org subscription command: subscribe terrorism sent to: listserv(a)mediccom.org

1 0

why Phil Zimmermann should be speaking out against pgp5.5 and CMR
by Adam Back 17 Dec '03

17 Dec '03

(Readers may notice PRZ's email address on the Cc line, this is an open letter addressed to him). In the debate on the controversial pgp5.5 commerical message recover (CMR) system, I noticed someone made the comment that they couldn't see what the big deal is with enforced multiple crypto recipients who aren't also message recipients, as pgp2.x has had non-enforced multiple crypto recipients for ages. I will put the case for why this practice should be avoided for security reasons. I would like to also put the case of why the enforced multiple crypto recipient construct should be avoided in building messaging systems where the designers would like to avoid building GAK compliant systems. The security reasoning is simple: there are is an extra door into the encrypted data: via the CMR key. Introducing an extra door reduces security, because there are now two keys which could be compromised to gain access to the data. That was simple. Possibly not that major a problem, perhaps both keys are so well secured that the additional leakage is academic. In that case, fair enough. Now the GAK compliant case: Firstly it is important to understand the subtle but very significant difference between enforced crypto recipients who aren't message recipients and normal pgp2.x style multiple crypto recipients. This difference is as much to do with the way that mail clients and plugins have used the pgp2.x multiple crypto recipients in fielded systems as with the actual messaging packet differences. A message recipient is someone who's email address is listed in a To: Cc: or Bcc: field in your mail client. A crypto recipient is someone who will be able to decrypt the message. Pgp is a hybrid crypto system, a message consists of the email encrypted with a randomly generated symmetric key, the session key. The session key is in turn encrypted to the public key of the recipient, these are called Public Key Encrypted (PKE) packets. To implement multiple crypto recipients pgp simply tacks on as many PKE packets as there are crypto recipients; each PKE packet being the session key encrypted to the public key of one of the crypto recipients. Now in most fielded PGP email plugins, and clients which take notice of Cc: and Bcc: fields, the number of crypto recipients ties directly with the number of message recipients. This makes it difficult therefore for the existing systems to automate encryption to a third party without software modifications. If a company which is hoping to become a market leader (a hint PGP) were to retain this functionality, GAKkers would find it difficult to use this software to effectively impose GAK. Sure you can Cc: your message to the NSA key. This would be voluntary GAK. Carl Ellison and a number of others suggested this whimsically years back. As in "What's all the fuss about voluntary key escrow, I'll implement voluntary key escrow for you right now, get DIRNSA to generate a key, and I'll sign it, and put it on the keyservers -- end of problem". Carl Ellison had a very good point. The government doesn't want voluntary key escrow, they want as some suspected all along mandatory key escrow, they want GAK (the GAK term is coincidentally another Carl Ellison meme). The reason this is voluntary GAK is that the user in most mail systems would have to go to some concious effort to do this, and may forget some of the time. (It's difficult to make "forgetting" a 5 year jailable offense). Now I'm well aware that some email clients, and MTAs will no doubt allow you to forward copies of all your email transparently to another party. (Please don't flood us with replies describing such functionality). But this is not really the point; it doesn't matter if you can forward copies of your encrypted email "thoughtpolice(a)nsa.gov" -- they can't decrypt it with out the recipients key. Now we come to the danger of PGP Inc's CMR mechanism. CMR breaks this traditional premise that the crypto recipients correspond one-to-one with the message recipients. What it allows is instructions to be given in a public key that tell the software to encrypt messages intended for the owner of this key to two message recipients. This means that for example: If Phil Zimmermann is using his own companies pgp5.0 mail client (and I presume he is), that if the US Government were to pass a law requiring everyone to generate new CMR keys that he would be able to comply without changing his software. This is why I would argue that even pgp5.0 is GAK compliant, it knows how to understand CMR public keys. (I am not actually sure if the pgp5.0 mail client can generate CMR public keys, but the pgp5.5 one can for sure, I'd welcome clarification on this point). The new mandatory GAK law would mean that if he didn't generate a CMR key he would go to jail. So he complies. The terms of the law dictate that the CMR recipeint in individual's mail clients must be "thoughtpolice(a)nsa.gov". Now the next time one of PRZ's favourite resistance groups that he likes to tell us stories about send him an email thanking him for the useful piece of software he provided them with, the USG can listen in because the pgp5.0 software which the resistance fighters have presumably also upgraded to will understand PRZ's CMR key. The USG will if it suits their purposes sell this information to the government in the originating country, and they will have the death squads go kill the resistance fighters if they can determine their identities from the leaked message. This kind of makes a mockery of what PRZ and the PGP brand stands for. Now the pgp 5.5 defenders at PGP Inc will jump up at this point and tell us that this is not so because pgp 5.0 has ability to strip out the second enforced recipient. Well it does. However, PGP Inc has come up with another related clever innovation: their SMTP policy enforcer. This ensures that when resistance fighters attempt to send PRZ email inside the PGP Inc offices (where they will be presumably field testing their GAKware software suite), that if they do take off the CMR recipient, that their mail will bounce. So not being technical crypto gurus, they will try not taking it off next time and the NSA will read the mail again, resulting in the resitance fighters death. Or perhaps alternatively if they really did want to send him email for an important reason, like perhaps to warn him that the corrupt government they were fighting against was going to introduce a law of mandating the use of pgp5.5 by all ISPs and individuals, they would have no way to reach him. This would suit PRZ quite well, because he probably wouldn't want to hear that. Actually it is possibly not fair to pick on PRZ, as I consider it somewhat likely than PRZ is dragging his feet internally to PGP, but is powerless to stop the corporate mindset now at the helm. And if so I apologise for making points at his expense. But also it is important that if PRZ is against this move, that he speak up. That act would have major significance in altering PGP Incs mind. It might also result in a parting of the ways, but I understand from attenders at a physical cypherpunks meeting in the US that PRZ when quizzed about PGP Inc corporate mentality meaning the company would eventually sell out to GAK, relayed that he would quit rather than have be associated with this. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Encryption Program
by Randall Farmer 17 Dec '03

17 Dec '03

Although I don't know the PRNG in Visual Basic (the one 3dmx uses) well enough to do much real analysis, the description of an attempt to correct a problem in it shows a weakness in the "enhanced" version...here's a slightly abridged/clarified copy of the message I sent the author about it. ------------------------------------------------------------------------------- <headers snipped> ... > While it is true that PRNG's are not very good, Well, there isn't any big problem with PRNGs as a class -- RC4 is based on a PRNG, and it's okay to use as long as you know its limitations (i.e., just so you don't try using the same key twice or anything similarly silly). ... > I believe I found a way around that problem...I used a syst[e]m of cubic > arrays. The program first creates sixteen cubic arrays, and fills them one > space at a time with random characters. When the stream of characters to be > XORed with the plaintext is generated, it picks a random cube and a random > location with[in] that cube. I can't do much real analysis since I don't know how Visual Basic's PRNG works, but with a truly secure PRNG like one you would see in a good stream cipher, you can't predict x bits of the PRNG's output with more than 1/2^x probability of bring right without doing exhaustive search of the keyspace. However, your arrays almost surely won't be filled with the *exact* same quantity of each character, so, even if the bytes in your PRNG's output are selected randomly from the arrays, some bytes are more likely to be a byte in your "enhanced" PRNG's output than others. Therefore, given a bunch of the stream, one can guess the next 8 bits of the PRNG's output with more than 1/256 probability of being right, meaning your PRNG doesn't fit the bill. To sum it up, no matter what Visual Basic's PRNG does, that method *can't* be 100% secure. ... --------------------------------------------------------------------------- Randall Farmer rfarmer(a)hiwaay.net http://hiwaay.net/~rfarmer

1 0

Re: proposal: commercial data recovery
by goddesshera＠juno.com 17 Dec '03

17 Dec '03

On Tue, Oct 14, 1997 at 10:37:21AM +0100, Adam Back wrote: > > If we take the design goal of designing a commercial data recovery > system which is not GAK compliant, we can most succinctly state this > design goal as the task of ensuring that: I take a certain sad pleasure in reminding people that among my first posts on this list I warned that cypherpunks had better design a commercial key recovery system, or one they didn't like would be forced down their throats. Attila now spouts my line exactly, Adam is busy designing (though he still can't bring himself to use the term 'key recovery', being meme-dominated as he is), and Tim nods approvingly. Good luck, gentlemen -- you should have been doing this a year ago. -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html This message was automatically remailed. The sender is unknown, unlogged, and nonreplyable. Send complaints and blocking requests to <goddesshera(a)juno.com>.

1 0

Re: the case for separate comms keys
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Death rays from Mars made Adam Back <aba(a)dcs.ex.ac.uk> write: >You can also acheive the same flexibility with an extra indirection with >symmetric storage keys (optionally held in escrow). In fact I think this is >what later versions of Peter Gutmann's SFS do. The reason he uses for this is >that it allows you to change your passphrase without re-encrypting the whole >disk, because the _actual_ disk encryption key is encrypted itself with the >hash of your passphrase, rather than using the hash of the passphrase directly >as the key. There are also a few other reasons for doing this, and I've extended the idea used in SFS for use with my cryptlib encryption toolkit. Instead of encrypting just the key, you also encrypt the algorithm details, ie: E ( algorithm, algorithmInfo, key ) passphrase E ( data ) algorithm, algorithmInfo, key This makes the job of an attacker somewhat harder because even if they have some means of performing a reasonable attack on the second encryption step, they won't know exactly what it is, so even if it only has a 40-bit key they might need to search half a dozen algorithms before finding the right one. This makes it a lot harder to just brute-force everything going past in the hope of finding something useful. This is especially entertaining for algorithms like RC5 and Safer, where you can produce dozens of variations by playing with algorithm parameters, in effect adding extra bits to the key length. As Adam mentions, you can also escrow[0] the second key (which SFS does using a threshold scheme with the parameters controlled by the user). In this way the user can change their password without destroying the ability of the escrow to access the data. Finally, using the session-key mechanism means you never encrypt two lots of data using the same key, and means you can encrypt a single message for multiple recipients just like the public-key equivalent. Peter. [0] This is "escrow" used in the true sense, not the GAK euphemism. It's completely under the control of the user, it's optional, and it's intended for recovery of stored data when you forget the passphrase.

1 0

Re: CVS: cvs.openbsd.org: ports
by uk1o＠rz.uni-karlsruhe.de 17 Dec '03

17 Dec '03

Hello! [older mail] According to Warner Losh: > In message <199709160731.JAA11130(a)waldorf.appli.se> Niklas Hallqvist writes: > : To people with commit access: committing to ports won't work, it's a > : sup mirror where files will get overwritten. Instead discuss changes > : on ports@ and when good, mail to imp@ with explanations for > : consideration of including into FreeBSD. > This particular patch was committed to the FreeBSD tree last night. > I do think that there will come a time when OpenBSD needs to have its > own ports tree. 95% of this tree could be a mirror of the FreeBSD, > but there are some interesting issues that need to be resolved that > haven't been (like the libcrypt issues). How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people? We could set it in <bsd.own.mk> or something like this (to a value meaning "we don't have it and we don't need it either), and FreeBSD could do similar. Another way were patching the third party program's Makefile accordingly. We should introduce a patches-${OPSYS} directory having precedence before the patches directory of a port. Thus we could maintain our special patches for ports which need them while continuing to use the FreeBSD ports where they work out of the box. I see now that this is already implemented in <bsd.port.mk>, so we could just USE that. > Warner Regards, Felix.

3 2

Re: CVS: cvs.openbsd.org: ports
by Warner Losh 17 Dec '03

17 Dec '03

In message <E0xLTBc-0001Bo-00(a)rover.village.org> uk1o(a)rz.uni-karlsruhe.de writes: : How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people? : We could set it in <bsd.own.mk> or something like this (to a value : meaning "we don't have it and we don't need it either), and FreeBSD could : do similar. The problem isn't in the BSD make files, but rather in the makefiles of the ports. True, many FreeBSD ports' patches add -lcrypt blindly to the makefile, but that could change. : Another way were patching the third party program's Makefile accordingly. : We should introduce a patches-${OPSYS} directory having precedence before : the patches directory of a port. Thus we could maintain our special patches : for ports which need them while continuing to use the FreeBSD ports where : they work out of the box. I see now that this is already implemented in : <bsd.port.mk>, so we could just USE that. There already is the patches-${OPSYS} that can be used for this purpose. Warner

1 0

I have seen the future.....
by tech21＠tectel.com 17 Dec '03

17 Dec '03

I HAVE SEEN THE FUTURE And it will change your world soon... I receive a lot of telephone calls. All of them interesting-some of them fascinating. Seldom though, do I receive a call that I would truly refer to as "compelling." That is, of course, until my phone rang about 3 weeks ago. I still can't believe it. Odd call. Gentleman wanted some information-specific information. Of course I had a few questions that I needed answered first. "What's the product?" "Can't tell you," came a rather hollow reply. "Can't tell me? Why not?" I pressed, becoming increasingly more curious-and irritated-by the moment. Seeming to change the subject he said, "We want you to come take a look, and give us your opinion." "Come where? And give you my opinion on what?" "We'll send you a plane ticket." Three days later, I found myself staring out the window of that early morning Delta flight as we made our final approach, wondering what in the world I have got myself into. Met with the founders and the young man who had invented the technology. I guess it was about 55 minutes into the presentation that I understood what these guys were up to, and the profound effect this was going to have upon the world-our world. While I sat there riveted on the CEO's every word, transfixed by the passion emanating from his steel blue eyes, I felt like some character in a spy novel, conspiring on a plot to overthrow the government. One day, I'll tell you the whole story. What you ask could have such a profound effect upon our world? THE TOTAL DESTRUCTION OF THE TELE-COMMUNICATION INDUSTRY AS IT CURRENTLY EXISTS!! I've recently been invited to the high technology company discussed above. It is a new publicly traded company. It will be the Microsoft of the telephone industry. It is extremely well funded and has patented high technology. The proprietary technology is the most significant advance in over 100 years of tele-communications. Protected by 2 patents covering 48 applications, we have a private network infrastructure at a pre-opening investment of approximately 23 million dollars. We are not re-sellers of Long Distance time; rather a direct competitor to AT&T and others. To illustrate the potential of this proprietary technology: the internal cost of AT&T to complete a call is calculated at approximately 3 cents per minute; MCI and Sprint the second and third largest competitor based on cost of approximately 4 cents per minute. Our private network "compression technology" can accomplish the same call for as little as 2/ 100th of a cent per minute. For example, AT&T and MCI just announced they were going to cut their basic rates by 5% during the daytime and 15% during the nighttime. On a 15 minute coast to coast call AT&T's new price will be $4.65 during the day for their average customer, our regular price to every customer every day (24 hours per day, 7 days per week) is $1.18. We can afford to beat AT&T pricing because of our technology. But you ask, do I have to use any special equipment. Absolutely not. Just pick up the phone and call the party you want to reach. Pricing is only the tip of the iceberg with our new technology. Our multimedia products are going to make your life so much easier. Star Trek is here, right now and our smart communications platform will bring it to you. AT&T, MCI, and Sprint, look out there is a new major player in town. We will only work with a limited number of individuals to launch this company. If you think you have what it takes or have proven that you do, do not wait a moment longer. This is a ground floor business opportunity, with a compensation package potentially 300% more lucrative than our nearest competitors. Would you agree I have something here that spells opportunity? If yes, we need to talk further, immediately. Call for information and cassette 1-800-741-6240 or e-mail us at technology(a)tectel.com Please indicate your name, address, and telephone number in the body of your response. ************************************************************ Removal Instructions... It is in no way my intention to send anything to anyone who is not interested in the information; If you would like to receive future updates, simply reply to this message with "subscribe" in the subject line to subscribe(a)tectel.com and indicate your name, address, and telephone number in the body of your response. Please complete all information. If we do not hear from you, you will be automatically removed from future updates and will not be contacted again.

1 0

Document on Customizing OpenBSD after install
by Marshall Midden 17 Dec '03

17 Dec '03

Is there a checklist someplace on what to do after the install of OpenBSD 2.2? I'm thinking like: 1) Go into /etc a) Verify disks and network interfaces configured correctly. Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain. You might wish to turn off multicast routing in /etc/netstart. b) Edit motd to make lawyers comfortable and delete "Welcome". c) Fix passwd via "vipw" to change passwords, set up users, etc. Make sure password on "root". Default is no password from console, and disabled from network. Make sure to edit "group" for any user groups, and to put people into the wheel group if they need root access. d) Any local configuration change in: rc.conf, rc.local e) printcap, hosts.lpd Get printers set up f) Tighten security: fbtab Set security for X inetd.conf Turn off extra stuff, add that which is really needed. rc.securelevel Turn on Network Time Protocol. g) kerberosIV Get kerberos configured. Remember to get a srvtab. h) aliases Local mail delivery (set postmaster, etc). Run newaliases after changes. i) bootptab If this is a bootp server. j) ccd.conf If using concatenated disks (striped, etc). k) exports If this is an NFS server. m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc. n) ifaliases for www, etc. o) daily, weekly, monthly. p) "amd" directory if using this package. q) rbootd if needed for remote booting (ethernet MAC address to IP translation). r) Any other files and directories in /etc. 2) crontab -l. Do you need anything else? 3) After the first nights security run, change ownerships and permissions on things. Best bet is to have permissions as in the security list.

2 1

Technical Description of PGP 5.5
by Bill Stewart 17 Dec '03

17 Dec '03

Jon Callas presented a technical description of PGP5.5 at this month's Bay Area Cypherpunks meeting, as well as flak catching on the politics discussion; Phil Zimmermann and other PGP folks also helped. This posting is an attempt to summarize the technical parts and leave the politics for other messages. Perhaps there's been some technical discussion on OpenPGP, but feel free to forward this there if not. 1) PGP 5.5 API Toolkit - It's the core of the PGP5.5 GUI and SMTP tools. It'll be out Real Soon Now. It's a major change from the PGP 5.0 Toolkit, which is based on ViaCrypt's older code. The toolkit knows about all the features in the message formats, so even if the application programs from PGP don't provide a given friendly or hostile feature, you can still write it yourself, and so can the Bad Guys. 2) PGP 5.* message format - unchanged - uses the multiple recipients, without any indication of or dependence on relationships between the recipients. The format is approximately Recipient Record 1 - KeyID1, E(sessionkey, PubKey1) .... Recipient Record N - KeyIDN, E(sessionkey, PubKeyN) Message - E(Message, sessionkey) KeyID is the 32-bit KeyID, rather than a fingerprint. I don't know if the format or the PGP 5.x software can generate or accept messages with recipient records for two different keys with the same keyid (or whether it matters if the keys are for DH*, RSA, or both.) * DH can be spelled "E L G A M A L" -- Blame Cylink :-) While 5.0 did introduce new data formats, they're not stealthy, and features like the SMTP filters depend on being able to know how many recipient-key records a message contains, where their boundaries are, and what their KeyIDs are. 3) PGP 5.* public key format - The 5.5 features are actually present in the 5.0 key record formats, but there wasn't any implementation that used the extra fields. The record for keys is about like this, though I may have some of the details wrong. The record for the RSA Keys uses the old format; this format is for newer keys. Key Record type KeyID UserName Algorithm ID - the interesting combo is ElGamal and DSA Encryption Key OptionalCMRK_1: (Mandatory/Optional flag1, Msg Recovery KeyID1) ..... OptionalCMRK_N: (Mandatory/Optional flagN, Msg Recovery KeyIDN) (Note: the format allows multiple records, PGP5.5 only generates one, though it might accept and use multiple. Nobody indicated whether more than one CMRK indicates that the sender should encrypt to all CMRKs, pick one, or do something interesting like secret-share.) (Note: the KeyID is a 32-bit KeyID, not the full fingerprint, which has amusing deadbeef attacks. (Unless I remembered wrong.)) Signature Key Self-Signature on (Encryption Key, Signature Key, UserName) (I don't know if the self-signature includes the CMRKs, but I think it includes the user names.) Optional_Signature_1: (Signature KeyID1, Signature1) ..... Optional_Signature_N: (Signature KeyIDN, SignatureN) (I don't remember if it's just the KeyID or the full fingerprint.) (Note: Signatures are only on the signature key, so you can change the encryption key and keep your collection of web of trust signatures; this is secure because the encryption key is signed with YOUR sig key, and your sig key is signed by your friends' sig keys.) The signature structure is interesting, since it lets you implement forward secrecy somewhat conveniently - just change your encryption key. I don't know if the 5.0 / 5.5 implementations can easily handle multiple records for the same KeyID, so there may be some transition issues, but that's an implementation question, not a data format question. The CMRK** is obviously the new and controversial feature. The key is attached to the recipient's key, not the sender's program, which has some implications in who has to participate in any message escrow activities and where they take place. To some extent this is planned, and to some extent it's just the consequences of what parts of the system you have control over and what you don't. This approach has the recipient publish a CMRK KeyID, and has the sender decide whether to use it, rather than having the sender's system specify who gets the CMR copy. - Since this is the data format, it doesn't have any control over what the sender really does; any enforcement is in the sender's or recipient's client or in the SMTP mail filters. - The format just contains the CMR KeyID, not the key itself; looking up the key is a separate job. (** Corporate Message Recovery Key? Cover My Rear Key?) NOT TALKED ABOUT, but possibly relevant: www.pgp.com says: "Using PGPs Administrative Wizard, for example, administrators can set key generation configurations; require encryption for all email messages sent by a set of users; enable corporate message recovery; and limit the ability of users to perform certain actions, such as key generation." I assume the parts about key generation are limitations on the client, either generating PGP Crippleware? It can't be that heavy a restriction, since users could use PGP5.0, or 2.6.2 if the rest of the company can accept RSA keys, but it's sounds disturbing and it would be nice to see documentation. Could it be limits in the keyserver instead? Also not talked about - CERTIFICATE SERVER, and CERTIFICATE SERVER REPLICATION ENGINE which has lots of cool LDAP directory lookup stuff. The web page didn't say anything about policy administration on the server, but it's another obvious hook, assuming people in a company use it (e.g. a key server could only store keys with CMRKey set to Mandatory, though I don't know if the initial PGP CS version does that sort of thing.) 4) PGP 5.5 Implementation and GUI - - When you generate a 5.5 DH key, you have the option of specifying a CMRK and setting the Mandatory/Optional flag. I don't remember if there's an option to force you to use the CMRK, or to set a default CMRK or default value for the Mandatory flag, but the PGP folks kept saying things about always asking you things and always letting you know when it's going to do things. - The PGP 5.5 implementation puts at most one CMRK in the record, though it doesn't choke on receiving multiples. - If you receive a key record containing CMRKs, PGP 5.5 stores them; I don't remember if it alerts the user at that point or only when the user uses the key later on. - If you encrypt a message using 5.0, it ignores the CMRK. - When you are encrypting a message, the GUI lets you pick what keys to encrypt to. If one of the keys has a CMRK, if the Mandatory flag is not set, it asks if you want to set the CMRK as a recipient. If the Mandatory flag is set, it puts the CMRK as a recipient. Either way, you can delete the recipient, and it doesn't enforce it, and it also makes the CMR keys show up in red etc. It will nag you if you delete a mandatory, but won't stop you. (I think I got those details right.....) Also, if there's a CMRK KeyID, and your keyring doesn't contain the key for that KeyID, it asks if you want to fetch it from the keyserver. - As far as I remember, if you have a CMRK Mandatory set on one of your keys, and you receive a message addressed to your key, it doesn't check if the message was also addressed to your CMRK. A Bad Guy could build an implementation that did this, but the messages are interoperable with PGP 5.0 and don't contain any indication that any recipients use or are CMRKs, so it's easy to work around if they do. And a Bad Guy could also build in Passphrase Leakage or other evil things anyway. Again, the CMRK belongs to the recipient, not the sender, and deciding to encrypt to it belongs to the recipient. The ViaCrypt BusinessGAK version had a feature that let you compile in a Message Recovery Key that the sender was forced to use (which was a clone of the Always-Encrypt-To-Self code.) This is #defined out in both 5.0 and 5.5; the PGP folks tried to see what happened if they #defined it in when compiling, and it nicely dumped core when they used it. 5) SMTP filters - PGP Policy Management Agent for SMTP is really separate programs for Incoming and Outgoing mail. None of the PGP 5.5 features do more than nag you about using them; they don't have an enforcement mechanism. The SMTP filters, on the other hand, are designed for enforcement, and some of the interesting security and control issues come from the interaction between the filters and the PGP5.5. The PGP folks said that their particular implementation was a quick and basic job using the toolkit - so even though it's not particularly draconian or intrusive, it's easy for people to write their own that are more hostile. Neither filter, for instance, saves copies or forwards copies of mail to an archive or corporate enforcers or runs scripts - all they do is pass or bounce the mail (with configurable message). But you could write one that did, if you were that type of company. Source is not provided ("Look, we have to have _something_ to sell"), but some of the toolkit example code will be fairly similar. The filters don't look inside encrypted packets (so they don't have to manage private keys or other dangerous things). This does mean that they can check for encryption or signatures, but can't check if there's a signature inside an encrypted message. 6) Incoming SMTP filter - Really simple Remember - CMRKs are attached to the recipient, not the sender; this is the only place you can enforce that for your employees. Incoming mail is checked to see if it's acceptable, and either passed to a "real" SMTP server or bounced with a message (typically includes a policy statement or URL and/or a pointer to a key server handling the CMRKs.) Note that all the filtering is based on KeyIDs - not email senders or email recipients or transport info. Messages can be rejected if they're unencrypted, or rejected if the encryption recipients don't include one of a set of keys. Unless I'm remembering wrong if the list of keys was not dependent on the recipients, so you can't do things like "If Recipient=PurchasingClerk Require PurchasingBoss", though you can require "One Recipient in set PurchasingBoss, SalesBoss, EngrBoss", etc. Unfortunately, this pushes the company toward using one CMRkey, since it's not very flexible, though it can easily handle multiples. There may have been an option to accept signed mail, or that may have only been in the Outgoing SMTP server. There wasn't an option to reject unencrypted mail. (You could probably fake this by accepting unencrypted messages while also requiring encrypted messages to include a recipient whose key is not published anywhere and not publishing that keyid so nobody runs a deadbeef attack on it. I haven't verified this...) There wasn't an option to email a copy to the archive; you could write your own, but presumably any site that wants to save copies of all encrypted messages is already saving copies of all unencrypted messages already. Or they're really only making sure there's a CMRKed copy of the session key so they can decrypt the message on the late recipient's disk after he gets hit by a bus or a subpoena. 7) Outgoing SMTP filter - more complex. IF Sender_IPaddr in LIST, Evaluate RULE (parameter KeyIDList) -> -> Accept (fwd to SMTP server) OR Reject with parameterized bouncemessage. You only get one list of IP addresses, and you can only accept/reject, but the rulesets are flexible, and you can chain multiple filters together (the filter can run on Port 25 but can also run on other ports, and can forward to an SMTP server on other ports, so you can stack a bunch of these on a single box and chain them together.) Note that this doesn't look at the sender's or recipients' email addresses, just the sender's IP address. This is sometimes limiting (consider mail servers with multiple users, or multi-user machines, or people who do multiple functions from one machine), but it's more secure than trusting easily forged information like the sender and sender's address. A fancier system would include these in filtering capability. That capability may have been left out on purpose, or it may just be limited development time. (I don't remember if you can use multiple rulesets, but you can stack.) I also don't remember all the possible rules, but this is close: - Require Encryption (yeah!) - Require Encryption to Key on KeyIDList -- remember that CMRKs are attached to recipients' keys, not to senders' keys or mail packages, so the senders have to include any required keys themselves unless the recipients' CMRK keys are administered jointly with the SMTP server. (Sending them enough bounce messages may give them a hint, but the sender's PGP5.5 system won't do it automatically.) Thus, it's easy for CompanyA BuildingA to make sure that messages to CompanyA BuildingB employees are encrypted to one of CompanyA's CMRKs, but it doesn't have a clue about CompanyB's CMRKs or RandomRecipient's CMRKs, though if the recipients put their keys and CMRKs on some public keyserver a more sophisticated (and slower) SMTP gateway could check. - Require Signature (Remember that it can't look inside encrypted messages, so it only does this for unencrypted signed messages.) - Require Signature from KeyIDList - since this ruleset is used along with IP address lists, you could require things like "All email from Purchasing's machines are signed by Purchasing" "All email from the PR department is signed by the Marketroid Key" "All email from PR users is also signed by someone technical" :-) "All email from technical people is signed by Corporate Security" :-( "All email from the company president's key is signed by PR and Legal" (Note that this doesn't let you say "All email purporting to be from the company president" since it doesn't read email headers.) "All mail from the company president's real key is signed by the company president or her secretary" - Block encrypted mail, block signed mail (I think both of these were there, and if they weren't, you could implement them by some combination of features.) - Clear Text - you can allow this or block it. Storage Keys vs. Signature Keys vs. Message Encryption Keys - As described above, PGP5.* does use separate keys & algorithms for signatures and encryption, except for the old RSA keys. Storage Keys are a different issue - the main distinctions between storage keys and message encryption keys are - storage keys are used by the owner, while message encryption keys are used by someone other than the owner for items that will be given to the owner. - storage keys are useful when you have the storage media, message encryption keys are useful when you have a copy of the message, either legitimate or eavesdropped. - message encryption cyphertext gets mailed; stored cyphertext just sits there :-) PGPdisk is a pure storage key system, and perhaps there would have been less political furor if PGP had done Corporate Storage Recovery Keys, but it's not a mainstream product for PGP Inc., and only runs on Macs. Doing the storage job right means integrating with backup servers (disk drives get crashed or scribbled far more often than employees get hit by trucks...) which isn't PGPInc's specialty. In reality, users often use PGP for storage, including for messages they've received (depending on their mail GUI) and for files on disks (encrypted to themselves.) File-by-file encryption is easier to back up securely than whole-disk encryption, which requires either dumping the whole disk to backup media or copying to the backup in the clear. The latter is especially useful if the backup server is also an encrypted storage system, but the copying may be a security risk, unless you do really fancy things, and there's the whole question of whether the backup storage is encrypted with the same keys as the primary (hit-by-truck risk) or with a different key (corporate message access equivalence risk.) Business environment and documentation - [Mostly non-technical] PGP is a real business. They've got deadlines, they've got accountants, they've got people beating them up to ship code by the end of the quarter so they can bill people, they've got customers telling them they won't buy stuff until they get Feature X added or removed, all the usual stuff. The design consultants who used to do their export controlled web site left them a maze of twisty little CGI scripts, all different, so getting actual technical documentation out has taken far more work than anybody had time to do before a release date. (Some documentation is claimed to exist :-) Their SMTP packages could have had far more features, but they felt this at least minimally met their requirements, and there was some thought toward extensibility. While 5.0 did introduce new data formats, they're not stealthy, because they haven't seen much (any?) paying-customer demand, and features like the SMTP filters depend on being able to know how many recipient-key records a message contains, where their boundaries are, and what their KeyIDs are. So they recommend that people who want stealth go work OpenPGP and build formats that work to pressure PGP Inc. into using it. One of Phil's goals had been to design a system that provided the business message recovery features their customers were asking for without providing access to users' private or signature keys, as a counter-argument to the GAK advocates who claim they need it. [ As might be expected, much heated discussion occurred on this issue. :-) ] Some things that time pressure makes it difficult to think about, or at least implement, beside stealth, are features like secret-sharing the session keys to CMRKs (it's not possible to do this cleanly, without affecting a bunch of other things), or making session key recovery a difficult and slow process so it doesn't get done often (e.g. zeroing the bottom N ~ 32-40 bits of session key so recovery requires some brute force as well as the keys.) Building in the ability to crack messages using a single master key is really bad (though at least it can be a different master key per user or per message); perhaps when 5.6 or 6.0 handles multiple CMRKs it will implement them by secret-sharing rather than making them each full recipients. - Customers - Some of the customers do want to "recover" all their users' traffic. Others wanted to make sure that mail to a customer service rep got encrypted to the other customer service reps also, or at least to the rep's boss, so someone could handle the business if the original recipient was away. One of the more obnoxious customers was implementing CAK by having the Corporate Security department generate keys and hand them to the users on floppies; this gives them a less obnoxious approach that they're willing to try. One of the customers was really paranoid about making sure their employees didn't leave their CAD drawings encrypted and then steal them or extort money from the company for decrypting the plaintext when they quit; apparently the idea of using a document management system like programmers use for source code control had never occurred to them.... Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

5 7

Equal rights for receivers
by Anonymous 17 Dec '03

17 Dec '03

Remind me again: Why was it OK when the SENDER could choose to encrypt to an additional key, but it's a threat to the free world if the RECEIVER is allowed to request the same thing?

2 2

"21 Days To Freedom"
by delta7＠onlinebiz.net 17 Dec '03

17 Dec '03

How do you feel about taxes? Every dollar you save in taxes is... MONEY IN YOUR POCKET. Do you want to learn how to legally save a FORTUNE in taxes...starting TODAY? We will show you how to BUILD WEALTH QUICKLY. And protect your assets. You will never worry about creditors, ex-spouses, or government intervention again. CREATE FREEDOM for yourself. NOW. This information is available to taxpayers in the United States, and also foreign countries. For an exciting FREE REPORT, please send any e-mail message to Strikegold(a)answerme.com. You will receive your FREE REPORT immediately.

1 0

Re: Stronghold
by Casey Iverson 17 Dec '03

17 Dec '03

At 02:35 PM 10/12/97 -0400,John Young wrote: >Dimitri, Allah bless his carcass, is a learned and deft provocateur. Wrong! Vulii is a KGB loving, decrepid, diseased ridden sack of Russian puss and excrement. His only reason for existence is to spread lies, disinformation, and filth. He shouldn't have the protection of the U.S. Constitution and the toleration of this list.

1 0

Bill Gates and Gun laws
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> > Cdn-Firearms Digest Tuesday, October 14 1997 Volume 02 : Number 031 > cdn-firearms-digest(a)sfn.saskatoon.sk.ca [mega-snip] > ------------------------------ > > Date: Tue, 14 Oct 1997 12:43:32 -0600 > From: Dave Hammond <DHammond(a)novatel.ca> > Subject: FW: USA - Bill Gates wants your guns > > Don't like Bill Gates or his octopus like grip on the software market? Been > looking for a reason to give Microsoft the finger and shop elsewhere? Well, > here it is......... > > > by HUNTER T. GEORGE > OLYMPIA, Wash. (AP) - A gun-control measure on the Washington ballot has > turned into a Western shootout in this state, where nearly one out of > five residents owns a pistol. > In this gun battle, the two sides are armed with cash and > soundbites. > On one side is the state medical association, law enforcement > leaders, religious groups, the state's largest teachers union and > Microsoft chairman Bill Gates, among other Seattle-area business > leaders. > They back the measure, which would require handgun owners to > pass an exam or take an eight-hour safety course to get a license. > It would also require trigger locks on all handguns sold or > transferred in the state. > On the other side are gun rights organizations, like the > National Rifle Association, and police groups, which say the > measure is an invasion of privacy, an infringement of the right to > bear arms and a smokescreen for a hidden agenda: registration and > eventual confiscation of handguns. > ``What they're doing is basically using children and hiding > behind a phony handgun safety ballot title,'' said Alan Gottlieb, > chairman of the Bellevue-based Citizens Committee for the Right to > Keep and Bear Arms. ``These people don't want education. They want > to make it very hard for people to buy a handgun or use one, and > that's exactly what this initiative does.'' > If voters OK the measure on the Nov. 4 ballot, Washington will pass some > of the strictest gun laws in the nation. > Only a dozen states require some sort of handgun permit or > license, and just two - Massachusetts and Connecticut - have passed > laws requiring trigger locks, but only at the retail level. Washington's > would require them on all guns sold, even person to person. > Nine of the nation's largest gun makers announced Thursday that > they would provide childproof locks with all of their new handguns > - - about 80 percent of those sold in the United States. President > Clinton has pushed for legislation requiring the locks, but House > and Senate committees rejected the provision earlier this year. > No public polls on the measure have been released so far, but > some of the richest people in the state back it: Gates gave > $35,000; his father, lawyer William H. Gates, donated $150,000, and > philanthropist Harriet Stimson Bullitt contributed $50,000. > The safety requirements, they say, would be like taking a > driver's test before getting a license. The goal is to reduce > accidental shootings, particularly those involving children who find > loaded guns in the home. > A study in the Journal of the American Medical Association found > that 30 people 19 or younger died in unintentional shootings in > Washington state between 1991 and 1995. And 211 others were > hospitalized for gunshot wounds. > `I'm personally unwilling to tolerate that kind of carnage in > our state,'' said Dr. Roy Farrell, campaign spokesman and a gun > owner. ``Terrible tragedies happen that shouldn't happen if the gun > was stored properly.'' > > ------------------------------ [snip] > Mailing List Commands: majordomo(a)sfn.saskatoon.sk.ca

1 0

Re: Telstra Australia admits it lied about net
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Of course any stats put forward by Telstra are probably a complete fabrication. Telstra's arrogance exists due to its century long tradition of government backed monopoly resulting in a drain on Australia's resources and misallocation of capital on such a scale it defies imagination. It is par for the course for Telstra to now be seeking funding from US taxpayers/consumers. (PS. I heard the same figures you quote below being bandied about here about a week or so ago.) Bill Stewart writes: > According to an article in today's Mercury News or SFExaminer, > Telstra has also decided that 70% of the bits on US-Australia > Internet connections are now going from Australia to the US > rather than the earlier ~100% US->Australia direction - > so it wants a major reevaluation of who pays for the > trunks connecting the Internets in the two countries > (currently Telstra pays most of the costs.)

1 0

Start Saving Now...
by courier＠message4U.com 17 Dec '03

17 Dec '03

Dear Money Saver.. Are you.. Paying MORE than 9.9 Cents Per Minute For Long Distance or 888/800 Service ? Paying a monthly minimum or access charge for your long distance or for an 800/888 number ??? Getting 6 second increment billing ??? If NOT... Give us a call... We can get you the service Without the hassle Without the games Without the extra charges Pay LESS For Phone Service (s) (812) 949-2205 NOON - 10 PM EDT MON - FRI OR VISIT: http://www.cyberamish.com courier(a)message4U.com P. S. We also have a SUPER RATE on phone cards...19 CENTS PER MINUTE ! NONE OF THE ABOVE PHONE SERVICES INVOLVE MULTI-LEVEL MARKETING TO BE REMOVED FROM THIS LIST REPLY TO THIS MESSAGE & TYPE REMOVE IN SUBJECT AREA ONLY

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Brief Background: In the last two months Australia (at this time under a so called conservative Liberal Government) has re-affirmed its anti-market controlled economy approach to economics with the establishment of an IT bureaucracy, forcing ISP's to 'join' the TIO and fund its operations, establishing the framework for a possible cencorship regime on the internet, proposed legislation for key escrow wrt VPN's and pursuing its favoured entrail reading approach to economics by yet again believing it can 'pick winners' in the market and allocate resources more efficiently than the market can; an approach any socialist or totalitarian would be proud to support. There is very little organised effort to oppose these measures. I expect that people elsewhere will soon be able to look to Australia as a testing ground for all the worst case scenarios long discussed on cypherpunks. Now the State has announced it's intention to forcefully mandate authentication on the internet by imposing yet another taxpayer funded bureaucracy and to hell with the market solutions already provided at no cost to citizens. Shame on you Australia. (Are politicians genetically selected on their ability to make precisely the wrong decision in any given circumstance? Actually wrt authentication there is no problem to solve. Doing nothing was the best thing to do. Of course what this is really about is limiting entry to markets, corruption and fraud on the public.) http://www.theage.com.au/daily/971015/news/news7.html Push to tie up loose ends on Internet By GERVASE GREENE, Canberra Online commerce may exceed $6 billion by 2001, but it will be of little use if customers and businesses cannot identify each other on the Net. Federal Cabinet yesterday approved steps to create a national system for online authentication. The Government will establish a body to oversee all authentication systems. The Communications Minister, Senator Richard Alston, said this would significantly boost electronic commerce. "With predictions that electronic commerce in Australia will increase more than four-fold to $6.3 billion by 2001, the Government is well aware that development of trust and confidence by businesses and consumers in the reliability and security of online transactions will be critical to the development of the information economy," he said. A group of industry and government experts will report by March next year on possible functions and powers of the watchdog. This will include determining the technical standards required before an identification system obtains certification. Several corporations have marketed safety systems to exploit concern about the safety of online transactions. Sophisticated encryption will also be necessary before certification is granted. Civil liberty groups have called for anonymous transactions to be possible, while law enforcement bodies have sought access to records and transactions that would amount to an effective exemption from privacy obligations.

1 0

Re: Encryption Program (fwd)
by Frank (Giff) Gifford 17 Dec '03

17 Dec '03

(I had only sent this to the 'other' mailing list and not here - my appologies to those who get this for a second time. -Giff) On Mon, 13 Oct 1997 semprini(a)theschool.com wrote: > Hello. I just posted an encryption program on the web. It uses a key- > generated pseudorandom stream of characters that get XORed with the > plaintext to produce the cyphertext. For decryption, the same stream > is run against the cyphertext. (Such is the nature of the XOR > operation.) You can download the program at: > > http://www.brigadoon.com/~semprini/3dmx > > I am interested in other people's views, comments, questions, etc. on > this program. Any questions, comments, etc. can be sent to me at > "semprini(a)theschool.com". > > Thanks, > > Dylan > I have downloaded the program and read over it's contents (the .frm files). It's Visual Basic, which I am familiar with. >From my reading of the code (assuming that the code I read was, in fact, the code which does the encrypting) - the key supplied is not used - or at least not directly. The user apparantly supplies three keys which are padded with 'random' stuff each to get them to 32 bytes in length. Then these are placed into a special array where each bit gets its own position and various scrambing is done 'randomly' on the data. This is dependent on the key values and what bits are on or off at a given time. During this process, the 'seed' for the RNG is reset to some unknown value (I believe the effective range for the seed is 0..65535) the entire time the bits are processed. Then, amazingly, those bits are not used again. >From the RNG, a 4 dimensional array (called a 'cube') is created with elements 0..15 for each of the four sides. The contents are filled from the RNG with a value 0..255. Then during the encryption process of a file, the program will choose four random numbers 0..15 to use as indexes into the cube. The number found there is XORed with the datafile byte to get the encrypted/decrypted answer. *whew* Hope you followed that, I'm trying to be complete and concise. The upshot seems to be (and I haven't written any code to try this out yet): This method fails to the chosen plaintext attack where I ask the opponent to encrypt a large file of (say) all zero bytes. The encrypted result I should then be able to XOR directly against the target file to get the original contents. A less efficient but more satisfing method is to simply try all seed values for the RNG. Even if I don't know the RNG process, if the seed values are only 0..65535 (as I believe they are), trying all possible decryptions by this manner will give me the correct answer. If I know something about the file (i.e. being English text) I should have no problem finding the right answer programmatically. If I am incorrect about my reading of the program or its operation, please let me know. -Giff

1 0

Free Sex Test Drive !
by scannmann＠nevwest.com 17 Dec '03

17 Dec '03

============================================ WARNING! ADULTS ONLY! This site contains Sexually Oriented Material. By entering this site you're consenting that you're over 18 and approve the viewing of adult material. ============================================ Hi my name is Lisa ! I would like to let you know about the hottest adult web site on the web, rated top 10 with FREE LIVE STRIP & STEAMING VIDEO CONTENT with lesbian, gay, fetish, domination, bizzare, group sex, one on one, we have to much to list. See to believe 1000+ hot pics & more. Also hot phone sex like this 1-800-LICK-CUM check it out FREE, FREE, FREE !!! http://www.69her.com http://www.cyberhardcore.com

1 0

Clinton - Gore selling out Internet to ITU to Preserve Key EscrowEncryption?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 15 Oct 1997 09:01:54 -0400 Reply-To: cook(a)netaxs.com Originator: com-priv(a)lists.psi.com Sender: com-priv(a)lists.psi.com Precedence: bulk From: Gordon Cook <cook(a)netaxs.com> To: Multiple recipients of list <com-priv(a)lists.psi.com> Subject: Clinton - Gore selling out Internet to ITU to Preserve Key Escrow Encryption? X-Comment: Commercialization and Privatization of the Internet A COOK Report Editorial Exceedingly strange events are underway inside the Beltway. By January of this year a coalition of industry figures had decided that IAHC was a cabal of internet old timers out to create a clique that could impose a DNS "socialist" solution. This solution, they claimed, would ensure the failure of any private enterprise led initiatives to open a true free market in DNS services. They convinced the Clinton Administration to intervene to stop the cabal from what they also alleged was its threat to American sovereignty. Namely that, in involving the ITU as the repository of its MOU, it sought to deliver control of the Internet into the hands of a stodgy bureaucracy which was in fact an enemy of the net. Fast forward through eight months of Clinton Administration meddling and we have some rather shocking results beginning to emerge. The Inter Agency Working Group on DNS issues is drafting a report that says IAHC was right after all and that just a few tweaks are needed to open up the process. The draft shows no understanding of the DNS issues themselves and comes up with no clear alternatives to the much scorned WIPO role in DNS dispute resolution. These matters are now coming out into the open. In an article yesterday in Communications Week International, Ken Cukier writes: "They [the IAHC] laid a decent foundation and [we] need to modify the plan to build on that foundation," said Ira Magaziner, a senior adviser on Internet matters to President Bill Clinton. The IAHC seems "open and flexible" to the idea of changing portions of the plan based on increased Internet community input, Magaziner added." The article goes on to explain how the Administration is embracing the hated IAHC process that its intervention was initially designed to halt. But we remind our readers that another concern that led to government intervention was not just anger over IAHC but also fear of the ITU. But no problem, the fear of the ITU seems to be no more. We quote below from a just published interview with Pekka Tarjanne, the ITU Secretary General from Finland. While the IAHC initially promised that the only role of the ITU would be to act as repository for signatories to the MoU on DNS, Pekka Tarjanne now foresees the ITU as the most likely repository for all internet governance functions - including getting into issues of content. Brian Kahin and Mike Nelson have turned the enemy into the friend. Why? Such are the wondrous ways of life in DC. NTIA has been given the green light to shape internet policy within the US. To hell with the Congress, the FCC and the NSF. [Speaking of collateral congressional problems, we'd certainly like to see someone sue NSI to prevent the return of the 23 million from the infratsructure fund to NSF for NGI use.] We expressed our dismay about this last week in an open letter to NTIA head Larry Irving. We must have struck some raw nerves, for when Dave Farber posted our original complaint to Irving on his IP list, we received a few days later the following delightful reply (posted by Dave again to his list.) Date: Tue, 14 Oct 1997 11:14:52 -0400 From: "Gregory C. Simon" <simon(a)podesta.com> Cook: "Gregory Simon." Hmmm. Domestic affairs advisor to Al Gore? On the wrong side of privacy issues? Not much beloved by EPIC. On the wrong side of information issues. Point man for the administration a year ago at the WIPO meetings in Geneva, where the justly defeated treaty would have given publishers copy rights over virtually everything. See www.cic.org. Seems that Greg has left the White House and is working for the lobbying firm run by John Podesta's brother? Meanwhile John Podesta continues to work on the inside as one of President Clinton's most intimate advisors. In charge of Bill's daily schedule we are told. Greg seems to be offended that I am not a cheer leader for his ex-employer's policies. Simon: Dear All: The open letter from Gordon Cook to Larry Irving is profoundly misguided and uninformed. The basic premise is ludicrous -- that Henry Geller somehow set the parameters of NTIA's authority by his personal views. Cook: No. Wrong the premise was that Geller as first head of NTIA was fully in favor of the conditions agreed upon for its founding. That it could be an advocate for the desires of the President in telecom matters but that it would NOT make and originate policy. Simon: NTIA is the voice of the Administration on many matters but it is also part of the brain. During my tenure in the White House with Vice President Gore, we relied heavily on NTIA's institutional knowledge and analytical skills in formulating and executing policy decisions. Cook: In other words with NTIA as the brain, this administration, uses it to make policy. Simon: Larry Irving in particular has been astoundingly and unerringly prescient in identifying policy areas that will rise to the top of the public policy debate. His views have often carried the day with the President and Vice President. Cook: NTIA making telecom policy again contrary to the views of the original founders. I haven't talked to Elliot Maxwell at FCC, but Greg, you might like to give him a call. I am told that he shares these same views. And I am told this by someone who participated in the policy making at NTIA's founding with whom I have just had a conversation tonight. Simon: In my dealings with NTIA on the DNS issues I have detected none of the prejudice Mr. Cook asserts. Reading symbolism into such simple gestures as granting additional comment time and giving great weight to every bit of gossip emanating from a free give and take discussion within the government smacks of clinical paranoia. Cook: No Greg. It's having good sources who are so disgusted by the lack of cluefulness on the part of the administrations policy makers that they talk. I knew this was coming down the pike. Cukier's article published yesterday confirms it. Simon: Finally, is it necessary to wave the bloody shirt of encryption into every policy debate no matter how remote? Must everything be related to a government conspiracy to read your mail? Cook: Given the slipperiness of this Administration, I stand by what I said on this issue. If the minions of the administration, of which you are clearly one, can strip internet policy making away from NSF and Congress, then they can march ahead with their intent to give Freeh and Ft George Meade the keys to the private communications of every American citizen. And since Kahin and Nelson have decided to deliver the Internet via IAHC to the ITU after all, we could all wake up one day and find the keys to our most private correspondence turned over to an international organization called the ITU, which uses its treaty power like the World Trade Organization to overrule the sovereign power of the US Congress. The shame is that Ira Magaziner doesn't yet realize what Kahin and Nelson are doing to him. Note that the ITU also reflects the views of many European governments are far less willing than our own to even give lip service to the concerpt of a free Internet. Cook: Before you reply that I have lost my mind, Greg read the cogent paragraphs of the interview with ITU Secretary General Tarjanne below where the good man, sensing victory, says that he foresees the ITU playing a major role in Internet governance and foresees the possibility that the ITU may get involved not only in conduit but content as well. Someone exceedingly well familiar with ITU policy making noted in another conversation tonight that the ITU constitution has long allowed controls over encryption or in other instances has explicitly forbidden encryption and that the ITU has the tools for coordinating such restrictions internationally. Simon: Surely there must be a more honest way to disagree than to impugn everybody's motives all the time. And as for being cut off at the knees, I personally repudiate Mr. Cook for bringing that level of vileness and personal animus into the debate on a policy issue. Larry Irving has devoted his professional career to public service, he deserves respect, not threats. Cook: Rather than turn my accusations into a personal attack, why you tell us what the real policy of the administration is on these matters, if it is indeed other than what I allege? Cook: No I just put together what I hear from highly credible and distinguished sources who for their own reasonss cannot go on record.and reflect that against my belief that the government must never try to take control of the internet. If it means saying that the high and mighty have no clothes, so be it. No matter. The cozy dance continues. Don Heath has announced that next INET conference will be held in Geneva at ITU headquarters. Cook: Now it also looks like we owe Charles Pickering, the Republican Chairman of the House Science Subcommittee on Basic Research, a debt of gratitude for the hearings of two weeks ago. Problem is the double dealing alleged there is not going on with IAHC. Sernovitz was wrong to accuse Jon Postel of wanting to ship US developed assets to Geneva. It would seem to be the White House that is the double dealer and the one ready to give American assets to the ITU. Sincerely, Greg Simon (In the interest of full disclosure, Mr. Simon, President and CEO of Simon Strategies is a consultant to SAIC, the parent company of Network Solutions.) Cook: In the interests of full disclosure let it be said that we drank at the federal till for 18 months working for the US Congress Office of Technology Assessment and driving from NJ to a rented bedroom on Capitol Hill every week. Since March 1, 1992 we have published the staunchly independent COOK Report on Internet from our front porch making our living outside the beltway and fully independent of the interests that Mr. Simon represents. We must say we were amused at the Bellcore and NSI private mail that Greg attached. Clearly we touched a raw nerve. :-) Here with some relevant quotes from the Cukier article (at http://www.emap.com/cwi/192/192news5.html) and the Tarjanne interview. "The U.S. Department of Commerce, backed by a White House group studying the Net's vital domain name system, is set to accept a modified version of the plan for competitive domain name registrars devised by the International Ad Hoc Committee (IAHC), which comprises Internet organizations and United Nations-affiliate agencies. "They [the IAHC] laid a decent foundation and need to modify the plan to build on that foundation," said Ira Magaziner, a senior adviser on Internet matters to President Bill Clinton. The IAHC seems "open and flexible" to the idea of changing portions of the plan based on increased Internet community input, Magaziner added. The move will lay to rest months of uncertainty over the United States' role in freeing Internet institutions from government control. Significantly, the Department of Commerce will require the current monopoly registrar of the popular .com domain, Network Solutions Inc., to release information pertaining to the system's operation, say Clinton administration officials. However, officials caution that the department's approach is not universally supported in the federal government, and the internal tensions may set the policy back. Additionally, the IAHC's proposals that Geneva-based U.N. agencies be involved in domain name governance was attacked by Charles Pickering, the republican chairman of the House Science Subcommittee on Basic Research, which sponsored the domain name system hearings. Jon Postel, the head of the Internet Assigned Numbers Authority (IANA), the Net's central authority on certain standards (CWI, 30 June), remains cautious, however. "I just don't know," he said when asked whether the U.S. government will promote Internet self-governance. But Postel added: "Discussions have been fairly open in the administration about endorsing the [Internet] community's plan," as represented by the IAHC. The Trajanne interview is found at http://www.teledotcom.com/1097/features/tdc1097interview.html The ITU's involvement with the Internet may not end with the DNS. In fact, it may just begin there, especially if the ITU's DNS solution holds sway. In a recent interview, Tarjanne not only defended the DNS accord but also predicted a growing role for the ITU in Internet governance, at the invitation of the world's government and industry leaders. The ITU could eventually become involved in such content-oriented issues as pornography on the Internet, Tarjanne says. "We are not there yet, and I don't know if we will get there, but there is a clear possibility," he said. Some acknowledgment of the ITU's expanding role on the Internet could be written into the U.N. agency's bylaws when the ITU holds its quadrennial plenipotentiary conference--a kind of constitutional convention for the organization--in Minneapolis next October, according to Tarjanne. Still, the Internet issue is pivotal for the ITU's future; without a role in the Internet, the ITU would become less and less relevant to global communications. Tarjanne is moving quickly to secure the ITU's future before his tenure as secretary general ends in January 1999. Tarjanne: Traditionally, when we've talked about standardization in the ITU family it has been mainly technical standardization. But more and more we are involved in things that are called standardization but that have to do with, for instance, issues related to the generic top-level domain names or numbering systems--country codes are almost becoming viewed as a limited natural resource. As it relates to the Internet, we are facing a very interesting situation where questions concerned with conduit and content are being blurred. Basically, we have always dealt with conduit and have had nothing to do with content. But the situation is not that simple anymore. We, the conduit people, have to know what is happening on the content side, and vice versa, and there are questions that are very much interlinked. What kind of content issues do you see as possibly requiring the ITU's attention? Tarjanne: There are lots and lots of things. Probably the most famous Internet-related questions have to do with all the kinds of content that are not considered to be legally or morally acceptable. These are very difficult for the national decision-makers alone to deal with because of the global nature of the network. The problems are those related to child pornography or things like that. They have not reached the point where there's any need for us to do anything except follow what's happening. But that is already a change. To be prepared for the future, we have to know what problems different countries have with respect to the content of international communications. Have your members asked you to look into these issues? Tarjanne: Members have asked us to look into it and to follow it, but there are no concrete proposals for us to really take these matters up more seriously than that--than to follow them and collect information and be prepared to disseminate information. There's nothing on the agenda of our next few conferences, nor anything really serious in our study groups. What would happen if the Internet community rejected ITU governance? Tarjanne: It's a theoretical possibility, but I don't think it's very realistic. But if they find a better forum than the ITU, we don't have any monopoly. Things can be done outside the ITU, sometimes in a better way than within the ITU. That's not a big problem. We are here within our mandate to be prepared to participate and help when asked to do so. That's what we have done. To go a little bit further, if something were to happen outside the ITU that would lead to problems because of the absence of a neutral global organization covering these issues, then of course it's up to the members of the ITU to look at things more carefully. But we are not there. It's a rather hypothetical question for the time being. ************************************************************************ The COOK Report on Internet For subsc. pricing & more than 431 Greenway Ave, Ewing, NJ 08618 USA ten megabytes of free material (609) 882-2572 (phone & fax) visit http://cookreport.com/ Internet: cook(a)cookreport.com New Special Report: Internet Governance at the Crossroads ($175) http://cookreport.com/inetgov.shtml ************************************************************************ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0