December 2003 - cypherpunks-legacy

Re: CFV: comp.org.cauce moderated -- support privacy and anonymity
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

[This message has also been posted.] [I am objecting to a proposal that seeks to ban one-way anonymous remailers and other forms of unrepliable addresses such as spamblocked addresses]. In news.groups, WD Baseley <wbaseley(a)mindspring.com> wrote: * [my apologies to the net at large for replying sans *snecks* - I don't * know which group is read by the person to whom I'm replying.] * In article <3447bfd7.22958863(a)128.2.84.191>, phelix(a)vallnet.com * >On 14 Oct 1997 11:57:07 -0400, moz(a)server2.mich.com (John C. Mozena) wrote: * >>Igor Chudov @ home <ichudov(a)algebra.com> wrote: * >>>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and * >>>use of spamblocked addresses. Go to news.groups and find the * >>>CFV for comp.org.cauce, with the ballot enclosed. * >> * >>Vote for comp.org.cauce, which protects the utility of a newsgroup and the * >>freedom of postmasters to not run anonymous posting services should they * >>not so desire. * > * >Well, I just started reading this, and I didn't really know which way to * >vote. But such an anti-anonymnity stance makes the choice clear: * > * >vote *NO*. * * Since you just started reading this, I think you need more background * before coming to a decision. I'm not trying to influence it one way * or another; I'm just trying to give you more complete information. * I'm posting and emailing, and I'm sure that if I get it wrong I'll be * jumped upon thoroughly in the newsgroups - feel free to look there and * see if that happened. By all means, as one of the opponents of the proposal and supporter of anonymity, I ask you to do so and also get your privacy-concerned friends to take a close look at the debate. For example, here's what the proponent said: Mozena>>But, what do you have against anonymity? Mozena> Mozena>Nothing. What right do you have, though, to force me and others to Mozena>inconvenience ourselves so you can post anonymously or protect yourself Mozena>from spam? * The RFD requires posters to use addresses which receive, and reply to, * email; in other words, no munged, faked, spamblocked, or other * bouncing or redirecting addresses. There is nothing that says you * must use your real name, or any other identifier, that tells who you * really are. If "the-return-of-zorro(a)example.com" receives and replies * to email, it can be used to post to the proposed group. "Anonymity", * the ability to post without anyone knowing your true identity, is not * really the issue. Even anonymous remailers will work if they forward * email in both directions. But mungs and spamblocks will not work. These are not anonymous remailers, they offer a much lower security, they are not very reliable by their very design, and the only *true* anonymity can come from a one-way remailer. The proposal, as it stands, seeks to outlaw the one-way anonymous remailers. * John Mozena's comment on anonymous posting services stems, I'm pretty * sure, from an alternative offered by several folks. The idea was: * posters would add an 'X-Real-Address' line to their posts; the * moderation bot would use that line for correspondence, but remove it * before making the post public. John Mozena and others at CAUCE were * unwilling to do this because of possible legal ramifications; John * likened it to running an anonymous posting service, and wondered what * the consequences would be should someone use it to post copyrighted or * sensitive information. Well, this is NOT true. John objected to it with the argument that he does not like unrepliable addresses appearing in newsgroups. Anyway, all this talk about the X-Real_Address: field is NOT related to true anonymity, by the very definition of the latter. -- - Igor. The average American spends a total of six (6) months in prison.

1 0

Rules of Engagement on Video
by Jim Burnes 17 Dec '03

17 Dec '03

I know this isn't directly cypher related, but oh well. An award winning film, "Waco: the rules of engagement" is now available on video. Previously running at Art Houses and Film Festivals it was produced by a few revolutionary media people. Somehow it occurred to them that all the right-wingers had beaten them to the punch making civil rights abuses known to the public. Can't have any of that now, can we? Why should *they* have all the fun? Anyway its been lauded as a very well balanced work. Not like those other people -- talking about evil, new world order conspiracies. ;-) Probably most noteworthy is the included FLIR FBI footage (Forward Looking InfraRed) which, under expert scrutiny, appears to show LEFs raining automatic fire down on citizen units trying to escape the final conflagration. Here expert scrutiny is defined as the head of research for the army night vision development group. Its definitely the cure for those times when GAK starts looking like reasonable, sensible and prudent alternative. I have absolutely no involvement or monetary connection to these people. I just wish they would have put it on video first. "Is your religion BATF approved?" ---------- Forwarded message ---------- Date: Wed, 15 Oct 1997 12:34:04 -0700 (PDT) From: SomFord Entertainment <somford(a)worldnet.att.net> To: somford(a)worldnet.att.net Subject: "Waco: The Rules of Engagement" Video Order Form Thanks for your interest in obtaining the video of "Waco: The Rules of Engagement". We are pleased to announce that it is finally available! Please check the website periodically for ongoing reviews, press, announcements and updates to the order form. http://www.waco93.com/ "Waco: The Rules of Engagement" Video Order Form Print, Complete, And Mail This Form With Check Or Money Order To: SomFord Entertainment, 8778 Sunset Bl., Los Angeles, CA 90069 Questions: 310-289-3900 1. E-Mail Address:............................................... 2. First Name:................................................... 3. Last Name:.................................................... 4. Street Address:............................................... 5. Apt. No., Other Info:......................................... 6. City:......................................................... 7. State/Province:............................................... 8. Country:...................................................... 9. Postal Code:.................................................. 10. Phone:....................................................... 11. "Waco: The Rules of Engagement" Video.........Quantity:...... $25.00 for 1 tape. $22.50 each for 5 tapes. $20.00 each for 10 tapes. Bookstores and Catalogues, Call for Bulk Order Info. All Prices Include Domestic Shipping and Handling. CA Residents Please Add 8.25% Sales Tax. 12. Total:....................................................... Make Check or Money Order Payable to: SomFord Entertainment. Comments Or Special Delivery Instructions:....................... Please allow three weeks for delivery. Thank you for your order

3 2

Re: FC: FBI is allowed to keep file on civil rights leader (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 16 Oct 1997 18:01:46 -0400 From: Marc Rotenberg <rotenberg(a)epic.org> To: declan(a)well.com Subject: Re: FC: FBI is allowed to keep file on civil rights leader > > <B>FBI allowed to keep file on New York man's lawful activities<P> > WASHINGTON (AP) - The Supreme Court today refused to order the FBI >to purge its file on lawful activities by the former head of a charitable >foundation. Classic error for a news report on the Supreme Court. The Supreme Court denied cert. Lance Lindblom v. FBI, 97-82, Oct. 14, 1997. It did not rule on the merits of the case. The Court did not order the FBI to purge the files. It did not tell the FBI to buy Mr. Lindblom a cup of coffee. It simply decided not to review the decision of the lower court. Welcome back. M.

1 0

Re: Security flaws introduced by "other readers" in CMR
by Greg Broiles 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> wrote: >Truly sensitive stuff--stuff about takeovers, foreign production plans, new >products, etc.--will be encrypted with channels having no nosy security >guards or Corporate Crypto Compliance Police silently listening in. > >Which means we're back to square one. So why does PGP, Inc. bother? Because they've got customers who will pay for CAKware. Why will customers pay for it? Same reason the FBI wants GAK, even though motivated/well-informed crypto users will superencrypt or otherwise bypass the enforcement mechanisms. If you're the C in CAK or the G in GAK, access to some data is better than access to no data - and the possibility of enforcement radically alters the risk/benefit calculus of even intelligent actors who see their interests as contrary to those of the [C,G]. As Jon Callas confirmed at the recent Cpunks physical meeting, the current CAK/CAM/whatever system has very weak code re policy enforcement - for example, it'll allow otherwise forbidden messages to pass through its filters if even the "--- BEGIN PGP MESSAGE ---" lines are altered or removed. It won't disassemble tar or zip or uuencode packages, or otherwise attempt to discover simple attempts to bypass the enforcement mechanisms. They're not trying to stop determined covert communicators - that's not their threat model. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

3 2

Re: Document on Customizing OpenBSD after install
by K.R. Lewis 17 Dec '03

17 Dec '03

At 10:46 AM 10/15/97 -0700, J. Joseph Max Katz wrote: AND Randy Lewis has a remark about JJMK's response....below >Re... > >In the coming weekend, I'll be updating the newuser FAQ >(for things like PPP and 2.2). I'm sure a post-install checklist would be >a welcome addition. > >B U T . . . . > >Not everyone runs things like Kerberos or DNS. Keep in mind that many >people use OpenBSD for many things and in many environs. The OpenBSD setup >on my firewall at the office is much different than the Sparc, Alpha, and >P5/133 I run it on at home. The setup on my router machine at home is also >much different than the other machines in my house. There are ways people >have setup OpenBSD on embeded systems to do things like manage the >fuel/air mix ratio on their Corvettes (OK, one person I know of planned >that, but couldn't get the financing for the car...) I hope that draws the >picture. > >As for the verification after install, that is sort of "auto-manditory"-- >if a filesystem isn't mounted right, /etc/fstab has to be checked out. If >the network doesn't work, the network files must be examined to "make it >go." As oopposed to attacking this as a checklist, how about it is >attacked as "If networking doesn't work, check hostname.(interface)"-- but >there is more to that then just files in /etc (boot -c in order to >reconfigure hardware addresses) As a user of OpenBSD, and having tried to manage projects with it for implementation of added features for customers...I could not agree with the above position. You see, if you are ALREADY familiar with OpenBSD then you will most likely know exactly what to do when installing and seting up a system. New User's Notes / Installation Checklist's will most likely be ignored by you. However, if you are brand new to the system, then an Installation / Setup Checklist (a good one) will prove to be essential. Wouldn't it be great if just about every post to these groups from a new user was one like "..hey! This OpenBSD thingy works great! The installation was a snap!.." or something like that. We all know that hardly happens now...but, it could..... I, for one, believe strongly that a good 'Overview', 'Setup Notes' and 'Installation Checklist' must somehow find it's way into the distribution. It is also clear that the machine / arch specific differences will require unique versions for each. Randy > >/---------------------------------------------------------------- >/ Jonathan Katz, jkatz(a)cpio.org / http://www.cpio.org >/ Student, Unix geek, Security guy / http://posse.cpio.org >/ President and Founder: Corinne Posse / http://jon.katz.com >/ Phone: +1 (317) 590-7092 / "OpenBSD: Secure!" >/ "The meek may inherit the earth, >/ but Gale and I will seize the stars!" > >On Wed, 15 Oct 1997, Marshall Midden wrote: > >> Is there a checklist someplace on what to do after the install of OpenBSD 2.2? >> >> I'm thinking like: >> 1) Go into /etc >> a) Verify disks and network interfaces configured correctly. >> Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain. >> You might wish to turn off multicast routing in /etc/netstart. >> b) Edit motd to make lawyers comfortable and delete "Welcome". >> c) Fix passwd via "vipw" to change passwords, set up users, etc. >> Make sure password on "root". Default is no password from console, and >> disabled from network. Make sure to edit "group" for any user groups, >> and to put people into the wheel group if they need root access. >> d) Any local configuration change in: rc.conf, rc.local >> e) printcap, hosts.lpd Get printers set up >> f) Tighten security: >> fbtab Set security for X >> inetd.conf Turn off extra stuff, add that which is really needed. >> rc.securelevel Turn on Network Time Protocol. >> g) kerberosIV Get kerberos configured. Remember to get a srvtab. >> h) aliases Local mail delivery (set postmaster, etc). Run newaliases >> after changes. >> i) bootptab If this is a bootp server. >> j) ccd.conf If using concatenated disks (striped, etc). >> k) exports If this is an NFS server. >> m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc. >> n) ifaliases for www, etc. >> o) daily, weekly, monthly. >> p) "amd" directory if using this package. >> q) rbootd if needed for remote booting (ethernet MAC address to IP translation). >> r) Any other files and directories in /etc. >> >> 2) crontab -l. Do you need anything else? >> 3) After the first nights security run, change ownerships and permissions on things. >> Best bet is to have permissions as in the security list. >> > > >.. . () | Kenneth R. (Randy) Lewis _/_/ _/_/ _/_/ | email: krl(a)vicomp.com _/ _/ _/ | phone: +1 919 644 6306 _/ _/ _/ | fax: +1 919 644 6409 _/ _/ _/ | smail: V.I Computer, Inc. _/ _/ _/ | 531 Encinitas Blvd _/_/ _/ | Bldg 114 _/ _/_/_/ | Encinitas, CA 92024 . . computer corp. | http://www.vmepower.com

1 0

update.341 (fwd) [edited]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From physnews(a)aip.org Wed Oct 15 14:00:06 1997 > Date: Wed, 15 Oct 97 10:28:48 EDT > From: physnews(a)aip.org (AIP listserver) > Message-Id: <9710151428.AA08697(a)aip.org> > To: physnews-mailing(a)aip.org > Subject: update.341 > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 341 October 15, 1997 by Phillip F. Schewe and Ben > Stein > > THE 1997 NOBEL PRIZE FOR PHYSICS has been won by [text deleted] > THE FIRST SOLID MATERIAL THAT CAN REVERSIBLY > SWITCH BETWEEN METAL AND INSULATOR at room > temperature and pressure, and without changing its chemical > makeup, has been created by researchers at UCLA (James Heath, > heath(a)chem.ucla.edu) The researchers prepare a Langmuir film, > an ultrathin layer of material on a water surface. The film consists > of a 2-D hexagonal pattern of silver nanocrystals (only nm size) > with each nanocrystal's surface capped by compressible organic > molecules. Applying pressure to the film can decrease the distance > between adjacent nanocrystals from 12 to 5 angstroms. When > compressed, the film becomes shiny and its optical properties match > those of a thin metal film. Prior to compression, the film has the > optical properties of an insulator: in this state, the > nanocrystalsbehave as semi-isolated particles and they do not share > electrons. As the separation between nanocrystals decreases, the > researchers observe a transition from "classical coupling" (adjacent > nanocrystals induce the movement of charge in each other and > thereby transfer energy) to "quantum coupling" (nanocrystals begin > to share electrons simultaneously and electrons delocalize, or cease > to occupy a specific position in the material). (C. P. Collier et al, > Science, 26 September 1997) >

1 0

Liberal lawyer joke from Cdn-Firearms Digest V2 #34
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

On 15 Oct 97 at 8:38, Cdn-Firearms Digest wrote: > FOCUS: A Liberal lawyer sitting in Parliament thinks that a new law will > fix anything. What is the difference between a Liberal lawyer sitting in > Parliament and a sturgeon? One is a scum-sucking bottom feeder, and the > other is a fish. >

1 0

kernal timezone options
by Matthew E. Patton 17 Dec '03

17 Dec '03

I'm not having much luck figuring out what values exist for the TIMEZONE and DST kernel options. The default is 0 and 0 which puts my machine off by about 4 hours. The installation routine put in the proper link to US/Eastern or on another box EST5EDT. This apparently is insufficient to get the date command to behave. Incorrect time obviously impacts the entire system. My bios clock is right on. So where are the integers defined that correspond to the various zoneinfo files? This is definately man page material. thanks for the continuing assistance. ps, I figure -1 or -4 is the correct value for DST

2 1

pna.show_story?p_art_id=409724&p_section_name=Sci-Tech
by Jim Choate 17 Dec '03

17 Dec '03

CNN Custom News logo [LINK] Home World U.S. Weather Sports Business Sci-Tech Showbiz Lifestyle alt On Target Customize Profile Help Feedback Switch User [ISMAP] InfoSeek [INLINE] October 16, 1997 3:29 am GMT [INLINE] Sci-Tech Title [INLINE] Ad Space ________________________ ___Word ___Theme ______________ Options [INLINE] The story below was selected from CNN Custom News - a new personalized service that delivers only the news that's important to YOU. Sign up now to receive your personal news stories, weather, sports scores, and stock quotes from over 100 different sources - all for FREE. If you're already a user, please login. Custom News NEW SURVEY SHOWS BIG RISE IN INTERNET USE, BUT NOT FOR SHOPPING LA Times 14-OCT-97 Consumers Don't Trust Internet Enough To Share Their Credit Card Information ORLANDO, Fla.--(BUSINESS WIRE)--Oct. 14, 1997-- More than one out of three Americans have become users of the Internet during the last year, primarily for information gathering, but decidedly not for shopping, according to a national survey reported today by a leading consumer researcher. "There is clearly something addictive about the availability of galaxies of information for the asking," said Britt Beemer, chairman of America's Research Group, the firm that conducted the research project, in his keynote address before the 21st Century Commerce & CALS Expo USA at the Orange County Convention Center. "However, it's a very different story for shopping," he adds, "where very few people (2.8 percent ) feel comfortable in using the Internet to make a purchase in cyberspace." Beemer, who pioneered the influence of fear of crime on shopping with his annual survey on the subject, says he is "surprised more people weren't actively patronizing the Internet to eliminate worry about their personal safety, particularly for shopping at night." When asked about the degree of trust they had for shopping at a store in the mall compared with a purchase via the Internet, respondents opting for the store (72.1 percent) outnumber Internet shoppers (6.7 percent) by more than ten to one, the survey indicated. According to Beemer: "Most people (77.9 percent) are reluctant for security reasons to give their personal credit card data via the Internet to a virtual salesperson, but many others (26.9 percent) don't want to buy something they can't see and touch; 14.9 percent say they always buy in stores; 11.6 percent report they like to pay cash; and 11.1 percent simply enjoy shopping too much to let their computer have all the fun." The few products that do sell at all via the Internet include computer software, books, apparel, and home furnishings, but the percentages of people actually buying are nominal, Beemer says. Consumer use of the Internet to get information in influencing various purchasing decisions does appear to be increasing, with many people (45.9 percent) reporting they sought information prior to shopping, and 9.6 percent indicating they were searching for both information and advertising. Those who use the Internet say the reason they do so is to acquire information (68.4 percent); to chat with and meet people (7.1 percent); and to keep track of their finances (6.1 percent). When it comes to information gathering, 41.0 percent are seeking the news of the day; 23.7 percent are getting data on companies; 12.8 percent are looking for help in school work; 6.4 percent are checking out stock and bond prices related to their financial status; and 5.8 percent are surfing for travel information, the study points out. "There is some hope down the road that people's fears and concern about using the Internet for various personal business purposes will ease," says Beemer. "When asked whether they would expect to make financial transactions in the future, nearly six out of ten said `no,' but nearly 10 percent (9.4 percent) answered in the affirmative," he reports. The survey was conducted during the last week of September, 1997 of a national sample of 1000 respondents. Of this number, 41.7 percent had no access to a computer either at home or at work; 24.6 percent both at home and at work; 17.7 percent at home; and 15.9 percent at work, only. The study has a margin of error of +/- 4.3 percent. America's Research Group is a leading consumer research firm, headquartered in Charleston, S.C. Its staff has interviewed three million Americans over the past dozen years, giving ARG the largest database of retail trends in America. Britt Beemer is the author of PREDATORY MARKETING, published early this year by William Morrow. Search the net: InfoSeek ___________________ ____ [Help] [INLINE] Ad Space Top Copyright © 1997 Cable News Network, Inc. A Time Warner Company ALL RIGHTS RESERVED. Terms under which this information is provided to you. [INLINE]

1 0

Perl 5.00401, gcc 2.7.2.3 ..
by Andreas Brusinsky 17 Dec '03

17 Dec '03

It was told in the mailinglists that with the integration of the gnu utillities into the source tree it is easy to keep up with changes of their utillities. So what is the reason to stay on little elder versions of perl and gcc? Shouldn't gcc 2.7.2.3 and perl 5.00401 be within the source tree? Why are they not? Does the source tree really depend on the 'old' perl? I got somehow the impression that gcc is a special adapted version so I could understand that this is not integrated but perl? Or am I utterly wrong because perl is a kind of compiler and gcc is a kind of compiler so they dont need to be chaged becaus they work and may be more fixed than real gcc/perl and utillities that demand perl5.00401 can just be twiddled to use OpenBSD/perl .. Thanks for comments. Bye Brusi by E-Mail: ab2(a)inf.tu-dresden.de Tel.-priv: 0351-8499347 (Germany/Dresden) \____

1 0

Checklist, expanded
by Marshall Midden 17 Dec '03

17 Dec '03

NOTE: if upgrading or restoring files, it appears that some group numbers have been changed. ----------------------------------------------------------------------------- New installation checklist, after install and multi-user boot. (Instructions for correcting not given.) 1) Login on console as "root". 2) Check the system date. Type "date". If necessary, set the system date, and/or change the symbolic link to get the correct Time Zone. 3) Put a password on root. Run "passwd". 4) Check hostname. Type "hostname". (man "hostname" if need to change, and you also need to edit /etc/myname.) 5) Verify network interfaces configured correctly. a) "ifconfig -a". Correct by editing /etc/hostname.{INTERFACE} and via "ifconfig" if you do not with to reboot. Loopback interface will look something like: lo0: flags=8009<UP,LOOPBACK,MULTICAST> inet 127.0.0.1 netmask 0xff000000 An ethernet interface something like: le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,LINK0,MULTICAST> inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 [Will someone else fill in the ppp and slip interfaces.] b) You may wish to turn off multicast routing in /etc/netstart by commenting out (place a # sign at start of line) the line: # route add -net 224.0.0.0 -interface $hostname c) Check for routing. ("netstat -r -n") It will look something like: Routing tables Internet: Destination Gateway Flags Refs Use Mtu Interface default 192.168.4.254 UGS 0 11098028 - le0 127 127.0.0.1 UGRS 0 0 - lo0 127.0.0.1 127.0.0.1 UH 3 24 - lo0 192.168.4 link#1 UC 0 0 - le0 192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 Fix via editing /etc/mygate, and using "route delete" and "route add" if you do not wish to reboot. d) If using the Bind Name Server (DNS), check /etc/resolv.conf. It might look something like: domain nts.umn.edu nameserver 128.101.101.101 nameserver 134.84.84.84 search nts.umn.edu. umn.edu. If using a caching name server add the line "nameserver 127.0.0.1" first. (Of course, you need to change "named_flags" in /etc/rc.conf and add the named.boot file in the appropriate place. Same holds true if this is the name server for you domain. Also make sure "named" is running. [Otherwise there are long waits while timeouts happen.]) e) If using "NIS" (old yellow pages), check "domainname" and edit /etc/defaultdomain to correct. [Will someone else fill in more here. I refuse to use this package.] 6) Check disks correct. a) cat /etc/fstab b) df Edit "/etc/fstab" and "umount" and "mount" as necessary. (See man pages.) c) You may want to do NFS partitions later, but you may do them now. d) If you are using concatenated disks, edit /etc/ccd.conf and use "ccdconfig -U" and "ccdconfig -C" till you have it correct. ("umount" and "mount" and edit /etc/fstab as needed.) e) Go into the "amd" directory if using this package. [Will someone else fill in more here. I do not use this package.] 7) The system should be usable now, but you may with to do more customizing, adding of users, etc. Many sections may be skipped if you are not using that package (for example kerberos!). My suggestions are to go into /etc ("cd /etc") and: a) Edit motd to make lawyers comfortable and make sure that no mention of the word "Welcome" appears. (Some U.S. lawyers have stated that the word "Welcome" is an invitation to come on in.) b) Add users. There is a "adduser" script. You can use "vipw", and edit "/etc/group" if you desire. Make sure to put people in "/etc/group", under the "wheel" group if they need root access (non-kerberos). Something like: wheel:*:0:root,m4 c) Check for any local changes needed in /etc/rc.conf, /etc/netstart, /etc/rc.local, rc.securelevel.. Turning on something like the Network Time Protocol in /etc/rc.local and /etc/rc.securelevel requires: A) Making sure the package is installed. (see http://www.openbsd.org under "Ports: a Nice Way to Get Third-Party Software). B) Uncommenting the lines in rc.local (delete the # signs). if [ -f /usr/local/etc/httpd/httpd ]; then echo -n ' httpd'; /usr/local/etc/httpd/httpd fi C) Uncommenting the lines in rc.securelevel (delete the # signs). if [ -x /usr/local/sbin/xntpd ]; then /usr/local/sbin/tickadj -Aq echo -n ' xntpd'; /usr/local/sbin/xntpd fi d) Edit /etc/printcap and /etc/hosts.lpd to get printers set up. e) You might want to tighten up security by editing: fbtab Set security for X -- when you install X ... . inetd.conf Turn off extra stuff, add that which is really needed. f) Go into /etc/kerberosIV and configure kerberos. Remember to get a srvab. g) Edit /etc/aliases. Set postmaster, etc. Run newaliases after changes. h) If this is a bootp server, edit /etc/bootptab. You will have to turn it on in /etc/inetd.conf, or run "bootpd" in stand-a-lone mode. i) If this is an NFS server A) make sure /etc/rc.conf has "nfs_server=YES". B) Edit /etc/exports and get correct. It is probably easier to reboot than get the daemons running, manually, but you can get the order correct by looking at /etc/netstart. j) Edit /etc/rbootd.config if needed for remote booting (ethernet MAC address to IP tranlation). k) Look at and possibly edit the /etc/daily, /etc/weekly, and /etc/monthly scripts. Your site specific things should go in /etc/daily.local, /etc/weekly.local, and /etc/monthly.local. l) Look at the other files in /etc and edit as needed. (Do not edit files ending in ".db" -- like aliases.db, pwd.db, spwd.db, nor localtime, nor rmt, nor any directories.) 8) Check what is running via crontab "crontab -l". Do you need anything else? Do you wish to change things? For example: 30 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 30 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 30 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 9) After the first nights security run, change ownerships and permissions on things. Best bet is to have permissions as in the security list (the first of the two listed permissions, and the first group number of the two). Use "chmod" and "chgrp" as needed. 10) Install packages to make the system more useful. A) Install your own. Easiest way is to copy source and compile it. B) Copy vendor binaries and install them. You will need to install any shared libraries, etc. (hint: "man -k compat") C) Install any of a large number of Third-Party Software that is available in source form. (See http://www.openbsd.org under "Ports: a Nice Way to Get Third-Party Software). You may have "fun" installing due to various compiling errors. Don't get discouraged easily! Sometimes checking the mailing lists for past problems that people have encountered will result in a fix posted.

1 0

Re: Traffic Analysis (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 03 Oct 1997 01:34:56 -0400 > From: "Robert A. Costner" <pooh(a)efga.org> > Subject: Re: Traffic Analysis > Remailers in general will throw away messages at times. Sometimes on > purpose, sometimes by accident. This is not replaced by any cover traffic. Perhaps this should be added. > For purposes of argument, we could say that a remailer throws away > messages that violate usage policies. This accounts for some amount of > traffic, let's just say 10% to name a figure. Way too high for commercial use. Get it down to something like .01 and that would be workable I suspect (haven't done the math). Course this raises the issue of who pays for dumped mail on a commercial box. Should the customer pay since it was their action that instigated the drop? Or perhaps the remailer since they were selling a service which they didn't provide at their discretion? > Of course this sounds > reprehensible, Not to me. It's your box and your money, set any policy that you desire. If I as a user don't like it, I'll beat feet... > so you ask what sort of message gets thrown out? Some > examples might be: > > * 3,000 copies of the same message to the same person > * Any mail from Sanford Wallace at Cyberpromo.com > * A 300MB mailbomb Let's generalize a bit to see if we can get a clearer picture. - traffic that seems to be duplicate. What if the digital signature on each one is valid implying the originator intended to send the 3,000 pieces. Do you dump them and take the money? - traffic from specific parties whose reputation capital is low. As a business should this really matter as long as the creetin pays the bill? - traffic of an abnormal format Don't see any issues with this one. Are there any other classes that you can think of that you might want to filter on? > Basically some messages that constitute abuse (without examining actual > content) get tossed. Ok, so you are doing header filtering. > These are "valid" messages from people which the > remailer might decide to not continue to send. Much of this mail never > even reaches the remailer code as it gets tossed at an earlier level. > Since about 10% of incoming traffic gets tossed, it would seem that this > would somehow effect traffic analysis. This traffic is not replaced, and > much of the dropped traffic is not even know to the remailer. How much > would this actually effect traffic analysis? Let's see if we can put some numbers to it... We receive n pieces of mail. n/10 is tossed at reception based on header filtering. For each mail that gets to the remailer code we sent m cover messages and 1 real message. So the remailer handles a total of (n - n/10) + (m + 1)(n-n/10) pieces in a given time period, t. Let z stand for (n - n/10) the actual number of processible traffic, we can reduce this to z + (m + 1) z. Let's assume now that we go ahead and transmit cover for those emails we get something like z + (m + 1) z + m ( n/10 ). We don't add a 1 to the m(n/10) because we don't have a real outgoing to process. So the total traffic load of the remailer can be represented by: L = z + (m + 1) z + m ( n/10 ) or, L = (n - n/10) + (m + 1)(n - n/10) + m(n/10) Now if you look at a travelling salesman problem you see quickly that the complexity grows quite quickly. This produces a traffic analysis load of something of the form, T = L ^ v Where v represents the complexity factor in dealing with the possible combinations possible. So, without actualy plugging numbers in there, I would say it looks like a small increase in output could grow pretty quickly because of the power growth factor in the extra traffic and processing it. > As a side point, software problems will at times cause chained messages to > get tossed. From time to time certain remailers become incompatible with > each other, or user held public keys do not get updated properly. This > will also cause messages to get tossed. Ok, let's add a 'software failure' category. > Cracker sends messages as "Anonymous" and does not allow replies to be > returned to the sender. Redneck on the other hand allows each user to pick > a pseudonym and allows relies to be returned to the sender. This is known > as a "nym". The whole point of a nym is to be able to receive replies (as > well as establish reputation capital). People who have nyms on the > remailer want to receive email back to them. Nyms are managed and > authenticated with PGP. My question is would it foil traffic analysis if a > number of remailer server generated messages were to go out to the nyms > without ever having matching incoming traffic? If I understand you the remailer would send outbound traffic to its input for distribution to your subscribers? I don't believe it would factor into the analysis at all if all the source destinations are the same. Outbound traffic from party A that went to party B would be important to track. So, if you wanted to do this sort of stuff and you wanted Mallet to chase their tail I would randomly pick source addresses from my subscriber base and send the bogus messages to my subscribers making shure nobody received an email from themselves. Then it looks like everyone is involved in a conspiracy... > >A commercial remailer should not keep records of its use. However, I suspect > >that eventualy remailers will be required to keep usage records by law. > > I'd be willing to be involved in a first amendment challenge against any > such law. I suspect we would win in the US. At least we won the last 1st > amendment challenge against remailers. (ACLU vs Miller) It has nothing to do with limiting speech so I doubt you'd have a 1st leg to stand on. Furthermore, the 1st doesn't guarantee the right to anonymity. If you want to claim that as a fundamental right you'd need to use the 9th and 10th. It does have to do with being able to trace the perp back if needed. I am not saying I agree with it, just recognize that reasonable people will see this lack of tracability via a court order as a clear threat to their security at all levels. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: "Show me an example of terrorists using the Internet or (fwd)
by Blanc 17 Dec '03

17 Dec '03

Jim Choate wrote: >> Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real >> animals from the animal kingdom, strike at the most inopportune times, when >> there are no officially sanctioned police forces around to be of help. > >I have to object to the inclusion of drug addicts, they do what they do >because the legislators and police want to stick their noses in other >peoples business. If drug addicts resort to crime then society as a whole >must garner some of the responsibility of putting them in that situation. .................................................... We weren't discussing why people commit crimes against others, Jim. We were discussing the disagreeability of having & using guns. And yes, killing doggies is also a Bad Thing. Generally. ('cept when they're foaming at the mouth, snarling, with red blazing eyes, lunging directly at you. That is a Very Bad Doggie.) .. Blanc

1 0

NYTimes Editorial slams F[reeh,uck] and calls on Clinton to stamp it out!
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The lead editorial, the stated opinion of the paper itself, in this mornings NYTimes slams F[reeh.uck]'s initiative as "crossing the line" and that Clinton "needs to stamp out a bad idea." strong words, newspaper policy editorial, important words. The NYTimes actually has a clue, a strong clue. support the NYTimes! The NYTimes syndicate feeds thousands of the US papers, particularly the small town papers and is considered gospel by many. http://www.nytimes.com/yr/mo/day/editorial/03fri4.html The Clinton Administration has proposed several unworkable plans over the years to keep powerful encryption programs that scramble telephone and computer messages out of the hands of foreign terrorists and criminals. But it has never tried to put the need to eavesdrop on criminals above the privacy rights of ordinary Americans. Last month the F.B.I. Director, Louis Freeh, crossed that line by urging Congress to outlaw the manufacture and distribution of encryption programs the Government cannot instantly crack.... ...The plan is unworkable because uncrackable encryption software is readily available abroad. Congress could try to forbid Americans to use any unbreakable encryption, regardless of who makes it. But that would trample on rights that Americans jealously protect to communicate free of Washington's interference. The best way to reduce many types of industrial and financial crime is to provide citizens powerful encryption so they can communicate without fear of corporate spies and thieves.... ... Before encryption controls pick up more momentum, the White House needs to stamp out a bad idea. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDS47L04kQrCC2kFAQFFJAQA1/jnXjczlvUyVZ/8G6iVnLdD7+dmGw5k 8DnMy5Gw4nuR6cPBFjGLnomvZI2OXgJ4RFR/8Mv3pG9MBohPxOKq6nGdWjZV60F/ 8GpInE/Unb6hzFIxjET7a3wbjgt93PrmZjjSwfHCSiUBqUQXYcH0RUpyNF9zl0o8 HD7uS5WgVow= =7ZNz -----END PGP SIGNATURE-----

1 0

Low blow (but a *good* one!)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Alex Le Heux wrote: Anonymous <anon(a)anon.efga.org> wrote: >Let's also take a look at the Dutch performance during their >occupation. While there certainly were many courageous Dutch people >who helped refugees (at great personal risk, to say the least), and >there were many courageous Dutch people who were in the resistance, >there were also many Dutch people who did not perform so well. Not >only were a large number of Jewish people turned in by Dutch >informers, but there were even Dutch SS units. You have a nerve. You, coming from a country where people are still regularly killed in the name of racism, tell me this?! Alex ------------ The Same Old Guy replied: Want the cold, hard facts of life, Bubba? You didn't put WWII 'behind' you. We did! Gun-loving Americans conquered your continent and gave you your countries back instead of enslaving you, like every other winner in history has done. *** Certified Low Blow *** Some of us discriminate against Jews. Do you know why? Because we HAVE some! *** Certified Low Blow *** We were giving them refuge while Europe was massacring them by the millions. Now you have the balls to say we're not all treating them right all of the time. Buy a fucking clue!

1 0

IPO ALERT: C.H. Robinson Worldwide, Inc. Available Through Wit Capital
by edwin＠witcapital.com 17 Dec '03

17 Dec '03

Wit Capital Corporation is pleased to announce that we are able to provide first-come first-serve participation in the following initial public offering: Issuer: C.H. Robinson Worldwide, Inc. is the largest third party logistics company in North America with 1996 gross revenue of $1.6 billion. The company is a global provider of multimodal transportation services and logistics solutions through a network of 116 offices in 38 states and Canada, Mexico, Belguim, The United Kingdom, France, Spain, Italy, Singapore and South Africa. Security: Common Stock Expected Size of Offering: 10,578,396 shares Expected Price Range: $15.00 to $17.00 Managing Underwriters: BT Alex Brown Incorporated, Morgan Stanley & Co. Incorporated, Piper Jaffray Inc. If you think you may be interested in this Initial Public Offering available first- come first-serve through Wit Capital, please visit http://www.witcapital.com. You can view, print or download the Preliminary Prospectus from our New Issues Section. Investors can also call Wit Capital at (888) 4-WITCAP for more information. A REGISTRATION STATEMENT RELATING TO THESE SECURITIES HAS BEEN FILED WITH THE SECURITIES AND EXCHANGE COMMISSION BUT HAS NOT YET BECOME EFFECTIVE. THESE SECURITIES MAY NOT BE SOLD NOR MAY OFFERS TO BUY BE ACCEPTED PRIOR TO THE TIME THE REGISTRATION STATEMENT BECOMES EFFECTIVE. THIS COMMUNICATION SHALL NOT CONSTITUTE AN OFFER TO SELL OR THE SOLICITATION OF AN OFFER TO BUY, NOR SHALL THERE BE ANY SALE OF THESE SECURITIES IN ANY JURISDICTION IN WHICH SUCH OFFER, SOLICITATION OR SALE WOULD BE UNLAWFUL PRIOR TO REGISTRATION OR QUALIFICATION UNDER THE SECURITIES LAWS OF SUCH JURISDICTION. Wit Capital Corporation Member NASD SIPC

1 0

Re: Stronghold
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

>Nope. Like I said, I'm not selling Stronghold or any competing product, I >don't lose anything when someone foolishly buys it, so why should I present >any evidence? I (and several other people on this mailing list) were threatened >by C2Net's lawyers; so to avoid unpleasant disputes, I told them I won't be >publishing whatever I might know about their product. > So, why don't you (and several other people on this mailing list) use the ananymous remailers to present your evidence. Others have wondered why people would use remailers. Here's a prime example. Use the remailer (if you have anything to say).

1 0

Re: "Show me an example of terrorists using the Internet or (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 03 Oct 1997 00:08:09 -0700 > From: Blanc <blancw(a)cnw.com> > Subject: Re: "Show me an example of terrorists using the Internet or > (fwd) > >> Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real > >> animals from the animal kingdom, strike at the most inopportune times, when > >> there are no officially sanctioned police forces around to be of help. > > > >I have to object to the inclusion of drug addicts, they do what they do > >because the legislators and police want to stick their noses in other > >peoples business. If drug addicts resort to crime then society as a whole > >must garner some of the responsibility of putting them in that situation. > > We weren't discussing why people commit crimes against others, Jim. We > were discussing the disagreeability of having & using guns. True but my objection is to the line of reasoning you use to get to where you are. Let me try another example... "Stalkers, thieves, rapists, Jews, perverts, etc., or just real animals..." ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Traffic Analysis (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 03 Oct 1997 05:41:58 -0400 > From: "Robert A. Costner" <pooh(a)efga.org> > Subject: Re: Traffic Analysis > At 02:07 AM 10/3/97 -0500, Jim Choate wrote: > >> For purposes of argument, we could say that a remailer throws away > >> messages that violate usage policies. > > > >Way too high for commercial use. Get it down to something like .01 and that > >would be workable I suspect (haven't done the math). > > You may be confusing actual traffic, with valid customer traffic. (BTW - > the 10% reject figure was totally pulled out of the air. Since there is no > logging on a remailer, I'm just making an educated guess.) Almost all > commercial sendmail implementations reject a large amount of traffic and > call it "spam filtering". It's very effective, but the fact is that > incoming mail traffic is blocked before any program such as a remailer can > see the messages. Some of this is done by IP address, some is done through > other methods. I'm merely suggesting that a commercial remailer will have > similar policies. Duh. Look you picked the numbers and the scenarios, if you got a bitch about 'em talk to yourself...their your ugly baby. > >Course this raises the > >issue of who pays for dumped mail on a commercial box. Should the customer > >pay since it was their action that instigated the drop? Or perhaps the > >remailer since they were selling a service which they didn't provide at > >their discretion? > > For usage policies, I would think it is the originating user's fault. Acceptable. > For > middleman mail rejects, it is the middleman remailer's fault. So how do we rollback the payments if say the nth hop breaks the delivery? If I were a user and one of the remailers dropped the traffic I would want all my money back, I'm paying for delivery to a specific party. It is clear that the n-1 remailers has no claim to the charges since the email was not delivered to the recipient. Yet, it is not fair to take their income simply because some other remailer dropped mail due to a policy problem, which they clearly didn't have since they delivered the traffic to the next hop successfuly. Perhaps the remailer with the restrictive hop should pay the n-1 remailers. This would certainly provide clear financial incentive for remailers to have liberal fair use policies (which I support fully) and act as true commen-carries simply doing a job mechanicaly like the phone system or the network infrastructure itself. The bottem line is that if commercial anonymous remailers will survive they have to be as liberal with handling traffic as my routed is. > For public > key errors, it is the originating user's fault. Is it? If this were commercial systems the key server would NOT be on any remailers involved otherwise we have a prime target for man-in-the-middle attacks. So, assuming the user gets the key and the remailers get the keys from a 3rd party server which delivers the incorrect keys for whatever reason. Who pays for the failure then? To me it looks like the key server, but they aren't involved in traffic control but key control. While it is clearly fair to charge them for costs (say 1 remailer hop) incurred due to bad keys (which could be the original submitters fault), who pays the other remailers who handle the traffic and loose the income through no fault of their own? Also, what happens if the key is good but the software glitches (which is indistinguishable from a bad key at the source level)? Are you proposing we re-send for free all along the chain? I don't think the remailers which succeded will take kindly to that. If the MTBF for a remailer is n then the MTBF for m remailers is n*m. In other words the remailer chain gets less reliable as it gets longer. > >If I understand you the remailer would send outbound traffic to its input > >for distribution to your subscribers? I don't believe it would factor into > >the analysis at all if all the source destinations are the same. Outbound > >traffic from party A that went to party B would be important to track. > > Giving an example that overly simplifies things... I think my idea here was > that for some number of nyms, they would each receive an average of, say, > five messages each day. All five messages would be addressed from the > remailer and PGP encrypted. Let me say it again, traffic analysis doesn't look at the contents, cryptanalysis does. Whether the contents are encrypted or not is irrelevant. The word 'encrypted' NEVER occurs in traffic analysis. You encrypt the contents because it is assumed that the network analysis has already succeeded. Ok, so the recipient has no way to reply to specific parties unless the contents contain the source address in a source encrypted block. In such a case Mallet is going to look at the recipient and begin traffic analysis on them. Which Mallet is going to do as soon as they either submit or recieve traffic from that node anyway. Seems moot. An effective Mallet collects statistics on all participants indiscrimenantly. This is another example of the apparently unrecognized and implicit assumption that Mallet is only going to look at one party in the chain. Bad assumption. Traffic analysis will succeed ONLY if the *network* is analyzed, not some specific node in that network. This sounds like a message pool where a recipient must attempt decode on every packet they recieve. The ones not meant for them fail. I don't believe this is a commercialy viable process because of the amount of work on the recipients machine. I have a further question. The cover traffic that shows up in the recipients mailbox unrequested is spam isn't it? Also, when the recipient uncovers the last block is it going to say "This space intentionaly left blank"? Or can users of your remailer expect to recieve email full of hex gibberish they can't decode since they don't have a key? My suspicion is that if you are sending cover traffic to anything other than a /dev/null recipient with an a priori agreement you are not going to keep your users long. > Four of the messages would be from real people > trying to communicate with the owner of the nym. One would be a bogus > message sent to confuse traffic analysis. Turn those numbers around and you might manage to cover the traffic. The cover traffic MUST be greater than the 'real' traffic to be effective. My suspicion based on about 4 months of playing with MixMaster 1.5 years ago is that this ratio must be several orders of magnitude unless your traffic is measured in the millions+ of transactions per day. > All four real messages would > come into the remailer encrypted to the remailer and addressed to the > remailer. My thought was that fake outgoing messages to the nym would look > identical to real messages, thereby helping obscure the "mix" just a little > better. This helps hide the identity of the sender of the email that is > headed to a nym. All the outgoing traffic better look the 'same' it's nothing but a standard TCP/IP routing header and the contents (which we never look at). The remailer software is irrelevant on this issue. Traffic analysis relies on the stability of the protocols and their source & destination info not what they are used for. As for the rest of it, take the equation I gave in a previous email and feed it into a spreadsheet. Develop the equations that define the network using the same sort of structures and proceedures you use for a travelling salesman problem (check a local library). If you're asking me to do that work then I need money, I'll talk about work for free - I don't do work for free. > email. The remailer keeps this info in an internal database (as it must) > and is not available to anyone other than the remailer software. The remailer only needs records of transactions while a transaction remains un-committed. The only long term record it should keep is the number of transactions processed and how much money is currently on the books. The records are not available unless somebody cracks the box and begins to tool around the OS ... Mallet is pretty sneaky he reads CERT and collects hacker software too. If your remailer is keeping records of transactions after the transactions close you are not secure. You are actualy providing further incentive to Mallet. > Having just spent a year and a half involved in a federal court case over > the 1st amendment right to anonymity on the net, and winning, I'd have to > disagree with you here. Our affidavit specifically mentioned remailers, > among other things. Just exactly where is anonymity mentioned in the 1st? And since it clearly is not how do you extend: ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. Is your claim that the remailer is a press? (I rhetoricaly bet not) If so then every computer irrespective of use is a press and protected. Are you going to follow this line in future cases? Or is your argument that the traffic is speech and therefore the carrier of the traffic is immune to prosecution? If so you may have some problems in the future when the judges and prosecutors get a better clue. Because the 1st's speech clause protects the source of speech not the carrier - that's why the founding fathers specificaly mention freedom of the press - to extend that protection to the carrier. Or did you use the commen-carrier approach? My money is that you used the second line of reasoning which means you can expect it to be over-turned in the coming years. Unless somebody manages to get a court to recognize computers as presses and extend those protections fully or networked computers (not the applications they are put to) in general as commen-carrier the battle isn't over. Now if you throw the 9th and 10th in there (which I further rhetoricaly bet you didn't) you got a winning combo. Rhetorical question: do you realize that all networked computers are remailers at the routed level? Did you extend your argument thusly? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

New PGP "Everything the FBI ever dreamed of"
by Martin Minow 17 Dec '03

17 Dec '03

An article in today's (Fri, Oct 3) New York Times (CyberTimes) <http://www.nytimes.com/library/cyber/week/100397pgp.html> describes the new release of "PGP for Business Security 5.5," which contains mechanisms that incorporate key recovery mechanism that can either be volontary or be enforced by using PGP's software for controlling a company's SMTP server -- the server can verify that all encrypted messages include the corporate public key (or conform to other corporate policies): "The new version also includes some of the most sophisticated techniques for enforcing this policy through the corporation. The most novel may be a new version of software controlling a company's SMTP server, the machine that acts as the central mailroom for a corporation. PGP provides a software agent that will read all of the mail to make sure that it complies with the corporate policy. This may include requiring all messages to be signed with digital signatures or include a backdoor that the management can use to read the message. If the software agent discovers a message violates the policy, it can either return it to sender or simply log a copy. "PGP implements the backdoor with a central key. Each message is encrypted with both the public key of the recipient and the public key of the management. The message can only be read by someone holding the corresponding private keys, in this case the recipient and the management. The software allows the management to use different master keys for different departments by customizing the software. ... "Bruce Schneier, an encryption expert and author of the popular book Applied Cryptography, said that the new announcement "sounds like everything the FBI ever dreamed of." He also predicts that criminals will find ways to circumvent the restrictions while honest people may be more vulnerable to illicit use of the master key." --- Coincidently, the same issue of the New York Times has an editorial <http://www.nytimes.com/yr/mo/day/editorial/03fri4.html> attacking FBI director Louis Freeh's request that Congress "outlaw the manufacture and distribution of encryption programs the Government cannot instantly crack. Martin Minow minow(a)apple.com

11 15

legal question of DSA-based signatures?
by Anonymous 17 Dec '03

17 Dec '03

I have before me a statement made by Information Security Corp.: "The Comptroller General has ruled that, for the purposes of electronic commerce, DSA-based digital signatures are as legally binding as hand- written signatures." Can anyone verify this?

2 1

Netly News special report: "The Privacy Snatchers"
by Declan McCullagh 17 Dec '03

17 Dec '03

Recently the FBI has started to demand a creepy new anti-privacy law. It requires that all future technologies -- from cell phones to WordPerfect -- include a kind of electronic peephole to let law enforcement agents snoop through your private files and communications without your knowledge or permission. One House committee has already approved the FBI's bill. Such easy access is the fantasy of every unethical policeman and corrupt bureaucrat. Now, the police say they'll never peek through this peephole without a judge's approval. But history reveals that time and again, the FBI, the military and other law enforcement organizations have ignored the law and spied on Americans illegally, without court authorization. Government agencies have subjected hundreds of thousands of law-abiding Americans to unjust surveillance, illegal wiretaps and warrantless searches. Eleanor Roosevelt, Martin Luther King, feminists, gay rights leaders and Catholic priests were spied on. Even Supreme Court justices were monitored. Can we trust the FBI? Visit the Netly News for a special report on The Privacy Snatchers: http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html -Declan ------ http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html The Netly News (http://netlynews.com/) October 3, 1997 The Privacy Snatchers By Declan McCullagh (declan(a)well.com) ------ ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: Stronghold
by Anonymous 17 Dec '03

17 Dec '03

Jeff Barber <jeffb(a)issl.atl.hp.com> writes: > This is revisionist history. I can't recall any intimation at the > time that any messages were filtered from the unfiltered list. There were three lists. The unfiltered list did not go through the moderator's hands in any way and continued to received all messages (which is how unfiltered subscribers found out about the problem). The filtered list had the posts approved by the moderated. Then there was supposed to be a "flames" list where the moderator sent posts he had rejected. In theory, the moderated+flames lists should have the same contents as the unfiltered list. Here is the original statement by the moderator laying out his policy: > 3) Cypherpunks who wish to read all posts to the list may do so > by taking advantage of either of two optional lists. The first > (cypherpunk-flames(a)toad.com) will consist solely of messages > expurgated from the main Cypherpunks list. (Those who subscribe > to "flames" will be able to easily monitor my moderating > decisions.) The second (cypherpunks-unedited(a)toad.com) will > contain all posts sent to Cypherpunks. It will be the equivalent > of the current open, unmoderated list. It will appeal to those > who don't want list moderation. > > 6) Because every message submitted to Cypherpunk will be posted > to two of the three sister lists, I don't intend to lose much > sleep over whether or not this or that moderating decision was > perfect. I will do the best job I can, within the constraints > listed here. If I err, it isn't fatal. Everyone who wants one > will have two Cypherpunk venues for their posts. Sounds fair > enough to me. What do you think? Here is a message from a pseudonymous poster laying out what actually happened. Many list members may not have seen this message, unless they were subscribed to the unfiltered list. > Well, as it turns out, a number of messages have made it neither to > cypherpunks nor to cypherpunks-flames. Making matters worse, however, > not only are certain messages being suppressed from both lists, but > even messages mentioning that fact get suppressed from both the > cypherpunks and the cypherpunks-flames lists! and here is a letter to him from the moderator, confirming this fact: > Hi, > > On 7 Feb 1997, Against Moderation wrote: > > > What I object to more strongly and think is wrong is the > > fact that it went to *neither* list. > > Unfortunately, it's not as simple as that. As soon as I can > arrange it with John, I am going to stop moderating the list. > In the interim, I *will not* be sending your post onto either > the Flames or the Moderated lists. This is done for legal > reason. As it is, you have already published a libel on the > unedited list by repeating Dimitri's libel. This exposes you to > legal liability, but as an anonymous poster, you are somewhat > insulated from the consequences of your act. In sum, no messages were filtered from the unfiltered list, which is how cypherpunks who avoided moderation learned of the situation. The messages were eliminated from the regular (moderated) list, but they were not sent to the "flames" list, contrary to the stated policies. No hint was given to the subscribers to the moderated list, which was the majority, that this was being done. Messages referring to these facts were also filtered. A sad episode indeed.

1 0

Anne Wells Branscomb and other information
by Declan McCullagh 17 Dec '03

17 Dec '03

Anne Wells Branscomb has died. She was 68. A longtime communications and computer lawyer, she significantly shaped the world of information and Net-policy. (I met her once, at a Computers Freedom and Privacy conference.) Her short biography is at: http://www.ngi.org/AWB/ On a different note, congratulations to: * Solveig Singleton, the new director of information studies at the Cato Institute. * Bruce Schneier and EPIC's Dave Banisar, for their book released last month, "The Electronic Privacy Papers." * EPIC's Marc Rotenberg and Phil Agre, for their book released this month: Technology and Privacy: The New Landscape, edited by Philip E. Agre and Marc Rotenberg (Cambridge: MIT Press, 1997). * Bob Palacios, former webmaster for the Center for Democracy and Technology, who's moving on to a new job at a Rockville, MD software company. (I understand CDT needs a new webmaster.) Also, I hear the Competitive Enterprise Institute, a free-market thinktank in Washington, DC, is looking for a full-time analyst to do Internet policy work for them. Stuff like privacy, Net-regulation, free speech. Email me for contact info. -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: legal question of DSA-based signatures?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: kaye(a)popd.ix.netcom.com Mime-Version: 1.0 Date: Fri, 3 Oct 1997 12:18:36 -0700 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Kaye Caldwell <kaye(a)IX.NETCOM.COM> Subject: Re: legal question of DSA-based signatures? To: DIGSIG(a)VM.TEMPLE.EDU The document to which this refers is posted at: http://www.softwareIndustry.org/issues/docs-org/cg-opinion.pdf At 01:23 PM 10/3/97 -0400, you wrote: >I think I already know the answer to this, but it might be fun to have the >word with the bark on it... > >If you reply to this, I'll pass it on to the cypherpunks list. > >Notice that the question comes through an anonymous remailer. > >Cheers, >Bob Hettinga >--- begin forwarded text > > >Date: Fri, 3 Oct 1997 12:17:32 -0400 >From: Anonymous <anon(a)anon.efga.org> >Comments: This message was remailed by a FREE automated > remailing service. For additional information on this service, > send a message with the subject "remailer-help" to > remailer(a)anon.efga.org. The body of the message will be > discarded. To report abuse, contact the operator at > admin(a)anon.efga.org. Headers below this point were > inserted by the original sender. >Subject: legal question of DSA-based signatures? >To: cypherpunks(a)cyberpass.net >Sender: owner-cypherpunks(a)cyberpass.net >Precedence: bulk >Reply-To: Anonymous <anon(a)anon.efga.org> >X-Loop: cypherpunks(a)cyberpass.net > >I have before me a statement made by Information Security Corp.: > >"The Comptroller General has ruled that, for the purposes of electronic >commerce, DSA-based digital signatures are as legally binding as hand- >written signatures." > >Can anyone verify this? > >--- end forwarded text > > > >----------------- >Robert Hettinga (rah(a)shipwright.com) Philodox >e$, 44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' >The e$ Home Page: http://www.shipwright.com/ >Ask me about FC98 in Anguilla!: <http:www.fc98.ai> > > --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http:www.fc98.ai>

1 0