December 2003 - cypherpunks-legacy

None Zero-knowledge commit
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim C. May styles his facial hair to look more like pubic hair. /_/\/\ \_\ / Tim C. May /_/ \ \_\/\ \ \_\/

2 1

NSA on GAK
by John Young 17 Dec '03

17 Dec '03

Excerpts of remarks by NSA head William Crowell to NISSC96, October, 1996: Key recovery may prove essential in making encryption scalable on an international basis. We are not the only country wrestling with the public safety implications of unbreakable cryptography. France, Israel and Russia recently imposed import and domestic use restrictions. Several Asian, South American and African countries have had similar restrictions in place for years. Others may impose them as strong cryptography proliferates. For many overseas, as well as here, the logic of the need to balance business imperatives with public safety concerns argues for key recovery. The European Union and other confederations are considering key recovery-based KMIs. The world's major standards bodies are designing future standards so that key recovery can be accommodated. International standards and protocols for key recovery may prove essential to hand off national restrictions on strong encryption, to promote a broad export market for cryptography and to establish a key management infrastructure acceptable for general international use. This would accelerate the realization of the promise of information technology, and that would be in everyone's best interest. Working in partnership, government and industry together need to lay the foundation necessary to sustain and strengthen information security for America. I wish to emphasize that the infrastructure for key management will be built by industry as a commercial venture. This task is huge. Collaboration among many partners will be essential if we are to establish a KMI that promotes the use of encryption worldwide. ----- For full talk: http://jya.com/nsagak.htm

1 0

Re: SSL weakness affecting links from pa
by Robert Hettinga 17 Dec '03

17 Dec '03

At 3:41 am -0400 on 4/13/97, Rich Graves wrote: >I've been told that the main reason > almost the entire MSN team left Microsoft about a year ago is that they > were prohibited from pursuing more efficient non-proprietary solutions. Hettinga's paraphrase of Gilmore's Law: "A geodesic economy sees monopoly as damage and routes around it." Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 1

Re: NSA on GAK
by geeman 17 Dec '03

17 Dec '03

[I think the other exceprt was based on this one, from Charles IX of France in 1563] Printing press registration may prove essential in making printing and literacy managable on an international basis. We are not the only country wrestling with the public safety implications of printing presses. France, Israel and Russia recently imposed import and domestic use restrictions. Several Asian, South American and African countries have had similar restrictions in place for years. Others may impose them as printing presses proliferate. For many overseas, as well as here, the logic of the need to balance business imperatives with public safety concerns argues for printing press registration. The European Union and other confederations are considering printing press registration-based infrastructures. The world's major standards bodies are designing future standards so that printing press registration can be accommodated. International standards and protocols for printing press registration may prove essential to hand off national restrictions on printing and literacy, to promote a broad export market for printing presses and to establish a infrastructure acceptable for general international use. This would accelerate the realization of the promise of information technology, and that would be in everyone's best interest. Working in partnership, government and industry together need to lay the foundation necessary to sustain and strengthen information security for America. I wish to emphasize that the infrastructure for printing press registration will be built by industry as a commercial venture. This task is huge. Collaboration among many partners will be essential if we are to establish a PPRI that promotes the use of printing and literacy worldwide. =========================================================================== At 10:47 AM 4/13/97 -0400, John Young wrote: >Excerpts of remarks by NSA head William Crowell to >NISSC96, October, 1996: > >Key recovery may prove essential in making encryption scalable >on an international basis. We are not the only country wrestling >with the public safety implications of unbreakable cryptography. >France, Israel and Russia recently imposed import and domestic >use restrictions. Several Asian, South American and African >countries have had similar restrictions in place for years. Others >may impose them as strong cryptography proliferates. > >For many overseas, as well as here, the logic of the need to >balance business imperatives with public safety concerns argues >for key recovery. The European Union and other confederations >are considering key recovery-based KMIs. The world's major >standards bodies are designing future standards so that key >recovery can be accommodated. > >International standards and protocols for key recovery may prove >essential to hand off national restrictions on strong encryption, to >promote a broad export market for cryptography and to establish >a key management infrastructure acceptable for general international >use. This would accelerate the realization of the promise of information >technology, and that would be in everyone's best interest. > >Working in partnership, government and industry together need to >lay the foundation necessary to sustain and strengthen information >security for America. I wish to emphasize that the infrastructure for >key management will be built by industry as a commercial venture. >This task is huge. Collaboration among many partners will be >essential if we are to establish a KMI that promotes the use of >encryption worldwide. > >----- > >For full talk: > > http://jya.com/nsagak.htm > > >

1 0

PaleoAnthro: Mail List Life Cycle
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: list.srv.cis.pitt.edu: majordom set sender to owner-paleoanthro using -f Date: Sun, 13 Apr 1997 01:06:22 -0400 (EDT) From: Matt Fraser <mattf+(a)pitt.edu> X-Sender: mattf(a)unixs2.cis.pitt.edu To: Paleoanthropology List <PaleoAnthro(a)list.pitt.edu> Subject: PaleoAnthro: Mail List Life Cycle MIME-Version: 1.0 Sender: owner-paleoanthro(a)list.pitt.edu Precedence: bulk Reply-To: PaleoAnthro(a)list.pitt.edu Hey All, Dug this up from another list that I've been on for a few years now. Thought it might be of interest. Matt ----------- THE NATURAL LIFE CYCLE OF MAILING LISTS Every list seems to go through the same cycle: 1. Initial enthusiasm (people introduce themselves, and gush alot about how wonderful it is to find kindred souls). 2. Evangelism (people moan about how few folks are posting to the list, and brainstorm recruitment strategies). 3. Growth (more and more people join, more and more lengthy threads develop, occasional off-topic threads pop up). 4. Community (lots of threads, some more relevant than others; lots of information and advice is exchanged; experts help other experts as well as less experienced colleagues; friendships develop; people tease each other; newcomers are welcomed with generosity and patience; everyone -- newbie and expert alike -- feels comfortable asking questions, suggesting answers, and sharing opinions). 5. Discomfort with diversity (the number of messages increases dramatically; not every thread is fascinating to every reader; people start complaining about the signal-to-noise ratio; person 1 threatens to quit if *other* people don't limit discussion to person 1's pet topic; person 2 agrees with person 1; person 3 tells 1 & 2 to lighten up; more bandwidth is wasted complaining about off-topic threads than is used for the threads themselves; everyone gets annoyed). 6a. Smug complacency and stagnation (the purists flame everyone who asks an 'old' question or responds with humor to a serious post; newbies are rebuffed; traffic drops to a doze-producing level of a few minor issues; all interesting discussions happen by private email and are limited to a few participants; the purists spend lots of time self-righteously congratulating each other on keeping off-topic threads off the list). OR 6b. Maturity (a few people quit in a huff; the rest of the participants stay near stage 4, with stage 5 popping up briefly every few weeks; many people wear out their second or third 'delete' key, but the list lives contentedly ever after) _____________________________ Robert Warner rwarner(a)electrotex.com I speak but for myself,.... _____________________________ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

A Rumor and Reputation Paradox...
by Robert Hettinga 17 Dec '03

17 Dec '03

Here's something from cyberia which talks about the persistence of anti-reputation memes even in the presence of perfectly contradictory information. We've all heard about apocryphal stories, the $50 Corvette and the like, but here's a case which has financial reprocussions. It reminds me of the "satanism" claims about the Procter and Gamble moon and stars corporate symbol a while back. My first attempt at tackling this would be some kind of distributed reputation system, but it seems to me that if someone I trusted said something bad about Mr. Hilfinger, in the absence of any other respectable data, I would believe them. I guess that means the need for reputation "rental", like what financial intermediaries do, and also what we now call journalism, will increase, not deminish, in geodesic markets. Cheers, Bob Hettinga --- begin forwarded text Mime-Version: 1.0 Date: Sat, 12 Apr 1997 23:58:30 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Larry Kolodney <lkk(a)WORLD.STD.COM> Subject: Re: America Online and liability... the Horror To: CYBERIA-L(a)LISTSERV.AOL.COM >Recall the libertarian maxim that the best response to >offensive speech is more speech. To anyone who actually believes this bit of 18th century enlightenment mythology, I would recommend the article "Dirty Linen: Why are they saying all those mean things about Tommy Hilfiger?" by Lakshmi Gopalkrishnan in the current edition of Slate (http://www.slate.com/TangledWeb/97-04-10/TangledWeb.asp) In essence, the article documents a number of vicious rumours which have been spread on the internet about the clothing designer Tommy Hilfiger and allegedly racist comments that he made on the Ophrah Winfrey show. Not withstanding the fact that 1) Mr. Hilfiger never appeared on the Winfrey show and never made the statements in question, and 2) Hilfiger Co. has engaged in an online P.R. campaign to counter these rumours, they are persistent and widespread. According to the article: BEGIN QUOTE A spotty paraphrase of the allegations appeared in a Nov. 13, 1996, article in the Philippine newspaper Isyu. Titled "Eat Your Clothes, Mr. Racist Designer," the piece has been excerpted on the Official Philippine Anti-Tommy Hilfiger site. The writer tiptoes around the charges, but is markedly less tentative when expressing her outrage. "I am shocked," she fulminates. "If [Hilfiger] really did insult my people, you can bet I will do every single thing I can in my power to make sure that his label never makes it here." Forums ranging from soc.culture.african.american to talk.rumors and Streetsound have been thick with anti-Tommy talk of late. When rumors of the designer's alleged racist outbursts filtered into the mainstream media, they were debunked by Time magazine, USA Today, and the Washington Post. But that didn't stem angry calls for a boycott of his products. Nor did the official response of the Hilfiger Corp. Claiming to have become aware of the brouhaha only recently, the company has posted a memo on various anti-Tommy sites detailing the "simple and incontrovertible facts": Hilfiger has never been on Oprah. Hilfiger has never been on Style. Far from wanting to limit his appeal, Hilfiger is on record about wanting to cross ethnic lines to appeal to everyone everywhere. *** In theory, the Web should be as good at eradicating legends as it is at cultivating them, but in practice, denials are quickly buried by new messages and updates. A week ago, Hilfiger's official response clogged newsgroup indexes. Today, it has been swamped by even newer anti-Tommy postings and returning favorites. END QUOTE Lest you think that such rumours are just a minor irritant and part of doing business, consider that, according to the article, "In the late 1980s, purported connections with the Ku Klux Klan so damaged the reputation of athletic-wear manufacturer Troop (whose name was rumored to be a Ku Klux Klan acronym for "To Rule Over Oppressed People") that it was forced into bankruptcy." So here we have vicious rumours being spread about a company with millions of public relations dollars at its disposal, and it is helpless in the face of a rumour that has not one grain of truth to it. After reading this account, how could anyone seriously argue beleive individuals such as the hapless Mr. Zeran have the slightest ability to counter defamation with "more speech" over the internet? (Note that Mr. Zeran did not even have an internet account!) Larry Kolodney --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

3 2

Re: How to IGNORE massive To: and Cc: spams
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

ichudov(a)algebra.com (Igor Chudov @ home) writes: > > [this is only of interest to UNIX(tm) users. Windows users, please ignore] I suspect that a typical Windows user with a POP account usually has a unix account and a home directory (although its shell may be /etc/false or some such); he may be able to ftp to it and create a .forward file pointing to procmail, who will look at the incoming mail before passing on to his PPP. I don't really know shit about this, so don't flame me if this doesn't work. :-) --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 4

Re: A Rumor and Reputation Paradox...
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > be it. Anti-free speechers, including Larry Kolodney and including those > who support libel and slander laws, would have us believe that "false > speech" is not as protected as "true speech" is. Foo on that.) That from a vocal supporter of Cocksucker John Gilmore's plug-pulling... --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: SSL weakness affecting links from pa
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:41 AM 4/13/97 -0700, Rich Graves wrote: >Or blame it on the client. Microsoft handled the utter absence of security >in their WFW/Win95 SMB implementation by claiming, falsely, that Samba was >sending "illegal commands." After a thorough public thrashing, the Win95 >product manager eventually changed that to "specific networking commands," >with no retraction and no indication that the document had changed. Heh. Sending illegal or unexpected commands to a program is _the_ standard way to break security; if they can't defend against that, they're hosed. I'd reserve the phrase "utter absence of security" for systems that let you ignore the permissions by just asking nicely :-) ><URL:http://www.research.microsoft.com/research/os/main.htm> Interesting paper. I was surprised it didn't explicitly mention Plan 9 when it was discussing other operating systems, though mentioning Inferno does include that indirectly. It also didn't mention security - it talked about the kind of world where you can just buy a computer, turn it on, plug it in, and it'll find whatever resources it wants in the One Big Operating System. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Competitive Betrayal
by John Young 17 Dec '03

17 Dec '03

Weekend FiTi reports on "the enemy within" corporations and the growth of "competitive intelligence" as cold war spy tactics are adapted to big business. Excerpts: Nobody in the surveillance business really knows how much commercial spying goes on. A lot of the eavesdropping is done, perfectly legally, by managers listening in to their own staff. It is, of course, in the interest of equipment suppliers and corporate consultants to maximise the dangers that companies face. "All companies are paranoid about their own security," said the spokesman of one well-known British multinational. "They don't seem to mind paying consultants to tell them things they know already." Yet all agree that the field of "competitive intelligence", as it is politely termed, is an expanding one. The privatisation of whole economies, the deregulation of monopoly markets, the globalisation of business, the spread of foreign investment and contested takeovers, the proliferation of technology and the sheer volume of information - all have made companies more aggressive, and more vulnerable. A consultant called in to investigate a theft may find himself pitted against another. In order to sanitise the business, a professional association called the Society of Competitive Intelligence Professionals has been set up. Its 5,000 members are meant to follow a code which vaguely urges them to obey the law, identify themselves when asking questions, and avoid "unethical practices". SCIP is influenced by the Association of Former Intelligence Officers, a group described as "very powerful" by Andre Pienaar, a young manager at the corporate investigators Kroll Associates who has written a doctoral thesis on business and intelligence. "Company information has become very valuable," he said, "more valuable than physical assets." Protecting that information is becoming ever more difficult. It is not just the tappers, buggers and hackers who are the problem, however. The problem is the loyalty - or lack of it - of employees in a world of short contracts, rapid turnover and big inducements. Tony McStravick, former acting head of the Metropolitan police Fraud Squad in London, has worked for Kroll and is now at Control Risks Group. "It all comes down to management in the end," he said. "Companies have lost the hearts and minds of their employees because of performance pay, delayering, downsizing." "You have to have a culture of honesty, from the top down. You must find the balance between maximising profits and being fair and honest. A lot of the time, companies forget they are dealing with human beings." ----- For full article: http://jya.com/tew.txt

1 0

Re: APRIL BAY AREA CYPHERPUNKS MEETING
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 02:32 4/10/97 -0700, Bill Stewart wrote: >The April Bay Area Cypherpunks Meeting will be held jointly with the >Clan MacDude Back To The Beach party, April 12 at Bonny Doon Beach. >( www.macdude.org , http://www.macdude.org/aprbeach.htm for event >description.) >Among other things, John Randolph was planning to do a >Great Wall of Fire with his leftover moving boxes, and various >other cypherpunks are part of the Glorious Clan, which is a generally >silly organization. While I couldn't make it this time, I'd be interested in showing up for the next Bay area meeting if somebody could provide transportation to/from the airport/train-station/bus-station. A place to crash for a night would be a big plus. Anyone volunteering to help will get "Jim Bell" autographs. Might be worth something some day... ("Get them while I can still give them"!) Jim Bell jimbell(a)pacifier.com

2 1

http:--www.cnn.com-US-9704-13-mcveigh.trial-
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo navigation Infoseek/BigYellow/Pathfinder/Warner Bros. Main banner Samsung. Meeting the challenge. rule MCVEIGH CASE COULD SET PRECEDENT FOR JURY ANONYMITY jurors.sketch April 13, 1997 Web posted at: 4:01 p.m. EDT (2001 GMT) From Correspondent Susan Candiotti DENVER (CNN) -- Unless they decide to tell the world, the jurors who decide the fate of accused bomber Timothy McVeigh may remain forever anonymous. Trial Judge Richard Matsch assigned each jury candidate a number, and permanently sealed their records. But he has gone even further to protect their identities, ordering a partition to hide the jury box from the view of most courtroom spectators. For example, reporters must sit on one side of the court, where it's impossible to see behind the wall. matsch Georgetown University law professor Paul Rothstein says Matsch "has gone a little overboard." Unless there is evidence of danger or threat to the jurors, he says, "the presumption should be for an open trial in every respect, including being able to view the jurors." But Andrew Wolfberg, who served on the jury for the trial of Eric and Lyle Menendez, says protecting jurors' identities in the Oklahoma City bombing trial is important. "I think with this trial, there involved the death of many people ... which can in some way cause the jury to feel they have something to fear from this defendant," he said. In high-profile cases such as the O.J. Simpson trial, jurors' names are protected until the trial is over. And where TV coverage is allowed, faces are not shown on camera. mcveigh.jury Despite the secrecy, once the trial was over, some Simpson trial jurors hired agents, wrote books and hit the talk show circuit. Despite Matsch's caution and concern, some observers say he might be setting a precedent. "It's turning our system of justice upside down," says Jane Kirtley of the Reporters Committee for Freedom of the Press. "Because what it means is that the public really has no idea of who is sitting in judgment of people accused of heinous crimes." Decisions like Matsch's, opponents like Kirtley say, deny the public's right to "know" who sits on a high-profile jury. OKC Trial Special Section T R A N S C R I P T S / O V E R V I E W / T H E P L A Y E R S T H E B O M B I N G / C N N S T O R I E S / L I N K S rule What You Think Tell us what you think! You said it... [INLINE] Samsung. Meeting the challenge. rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Tim `C' Mayonnaise's obsessive masturbation has lead to advanced degree of blindness and hairy palms. ||||||||||| \~0/ \0~/ < (0) > --oOO--/|||\--OOo- Tim `C' Mayonnaise

2 1

Re: Bombing Denver? / Or: How Capt. Button Learned to Stop Worrying and Love the Bomb
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

The story thus far: An United States A-10 warplane on a live bombing run breaks formation and spends the next hour flying toward Colorado. Just short of Vail, it changes course, headed toward Denver, and then shortly thereafter changes direction, heading south, only to reverse its course, and once again head toward Denver/Vail. During this whole time, the Air Force contends that no radio contact was made, nor did they know where the plane was. They offer no explaination except an extremely weak claim that perhaps the pilot was suicidal or stressed. The bottom line is that the media seems to be totally ignoring the fact that even the military's shakey explaination of these events suggests that the American public may have been in great danger from a mentally unbalanced Air Force pilot in control of a war-machine capable of creating mass destruction upon an American city. Even the least bit of scrutiny of the trail followed by the A-10 suggests a pilot who had a destination in mind, had to take evasive action upon nearing his target, and then doubled back toward his original target. And the best explaination that the military can provide is that a U.S. warplane capable of doing major damage to a U.S. city just flew around for over an hour, with no way for the military to prevent it from bombing our citizens. The military tells us that a warplane approached some of the most sensitive military installations in the country, without being noticed or intercepted. The fact is, the military is in a no-win situation, whether they reveal that U.S. citizens were potentially endangered by the military's lack of control over U.S. warplanes, or reveal that they were forced to intercept and shoot down a U.S. warplane intending to attack a U.S. populated area. I have no doubt that the military, given time, will come up with a cover story which contains "plausibal deniability," etc., etc. The big mystery is why the media seems incapable of even raising questions probing at the obvious holes in the government's irrational explainations of this affair. TruthMonger http://cnn.com -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

4 3

Patent Giveaway Bill - House vote could be week of April 14th
by Robert Hettinga 17 Dec '03

17 Dec '03

Got this one off one of my favorite um, hydrophobic, right-wing lists. Actually, I *like* the idea of adopting the Japanese model, a patent system which was designed from the gitgo to strip technology from the original patentholders and accellerate its transfer to people who could implement it faster. Evolution in action, and all that. Of course, I expect that, <duck> geodesic markets </duck> will reward people who come up with new stuff -- and not people who control old stuff -- by exponentially depreciating old information as fast as it's created. "Piracy" being the most efficient form of information transfer on a ubiquitous network, and, with so-called watermarking, cryptolopes, etc., only being able to tell you who your copy was "pirated" from, the first copy of anything will be auctioned off dear, and subsequent copies will be sold dear in radiating secondary markets. Jason Cronk just wrote a paper on this, based on his rump-session talk at FC97. I don't have the URL handy, but his email address is <mailto:rjasonc@purple.reddesign.com>. Cheers, Bob Hettinga --- begin forwarded text Resent-Date: Sun, 13 Apr 1997 15:12:56 -0500 (EST) X-Authentication-Warning: NS1.Content.Net: byxbe set sender to rightnow-request(a)MailList.Net using -f X-Sender: eagle(a)accessus.net (Unverified) Date: Sun, 13 Apr 1997 11:58:35 -0500 To: eagle(a)eagleforum.org From: Eagle Forum <eagle(a)eagleforum.org> Subject: Patent Giveaway Bill - House vote could be week of April 14th Mime-Version: 1.0 Resent-From: rightnow(a)MailList.Net X-Mailing-List: <rightnow(a)MailList.Net> archive/latest/116 X-Loop: rightnow(a)MailList.Net Precedence: list Resent-Sender: rightnow-request(a)MailList.Net PATENT GIVEAWAY BILL House vote could be week of April 14th April 11, 1997 Phone or fax your Congressman (202) 225-3121 and urge him to vote NO on H.R. 400, which is misnamed the Patent Improvement Act but should be called the Patent Giveaway bill or the Ron Brown Sellout Legacy. This bill would write into law Ron Brown's Commerce Department news release of August 16, 1994, which promised the Japanese that we will change our patent law to acquiesce in the demands made by the Japan Patent Association in its written statement of September 1993 (which called our patent system "unsatisfactory" and demanded changes). That statement is impudent and insulting to Americans. H.R. 400 would transform the U.S. Patent Office into a private corporation that could accept bribes for the issuing of patents. Of course, the bill doesn't use the nasty word bribes; it just says that the Patent Office "may accept monetary gifts or donations of services, or of real, personal, or mixed property, in order to carry out the functions of the Office." With all the recent scandals about Asian money used to influence U.S. policy, this would be a terrible mistake. The entire text of H.R. 400 is a sellout to the Japanese demands. This bill would order all patent applications to be made public 18 months after the application is filed, whether or not the inventor has yet been granted a patent. This dramatic change from our traditional treatment of patents would be a grievous injustice to the individual inventor because it would allow foreigners and multinationals to use their enormous resources to steal the inventor's idea and beat him into production. H.R. 400 would loosen up the "reexamination" of U.S. patents already issued and allow foreign and domestic corporations to participate in the process after paying a "reexamination fee." H.R. 400 even specifies that the board of directors of the new private patent office shall include persons "with substantial background and achievement in corporate finance and management." That puts the multinationals in the driver's seat to ride roughshod over the rights of individual inventors. Instead of ratifying the Ron Brown sellout deal, Congress should stand up for one of our most important constitutional rights - the right of inventors to have, for limited times, "the exclusive right to their . . . discoveries." This unique provision in the U.S. Constitution (Article 1, Section 8) marked a profound turning point in world history; it started the marvelous series of American inventions that have raised our standard of living and built America into an industrial super power. H.R. 400 invites Asian money to diminish a precious American constitutional right. It is a scandal that Congress cannot afford to be involved in. Vote NO on H.R. 400. See our sample letter to Congress: http://www.eagleforum.org/conglet/1997/patents.html ============================================ EAGLE FORUM PO Box 618 Alton, IL 62002 Phone: 618-462-5415 Fax: 618-462-8909 Are you on our E-mail list? Just send us an e-mail message with SUBSCRIBE in the subject line! Tell a friend about us! URL: http://www.eagleforum.org E-mail: eagle(a)eagleforum.org ============================================ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= To unsubscribe from this mailing list, DISREGARD ANY INSTRUCTIONS ABOVE and go to the Web page at http://www.maillist.net/rightnow.html. New subscriptions can also be entered at this page. If you cannot access the World Wide Web, send an e-mail message to RightNow-Request(a)MailList.Net and on the SUBJECT LINE put the single word: unsubscribe --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Bombing Denver / Why has no one ever seen Jim Bell and Capt. Buttons together?
by null＠myemail.net 17 Dec '03

17 Dec '03

So, according to the Air Force, an armed warplane was allowed to approach within a few miles of one of the most important underground military installations in the country, without anybody noticing. Are bears Catholic? Does the Pope shit in the woods? Are cypherpunks revisionists handling the current military disinformation campaign on this event? An armed warplane capable of delivering its payload upon unwary U.S. citizens gives every indication of making an attempt to do so, and no major media even broach the possibility of this being the case. I think perhaps I'll drop my cable news channels and subscribe to the 24-hour a day "Happy Days" network. If I'm going to live in fantasy land, I'd rather watch the Fonz raise his eyebrows when mentioning the Bobsie twins, without once suggesting that he would like to bang the living shit out of them. TruthMunster ************************************************************************ This Anonymous email has been relayed by http://www.MyEmail.net/ MyEmail.Net is a free anonymous mailing service. No records indicating the identity of person(s) who originated this message are retrieved electronically, or as a requirement to submit. Your email address can be blocked to prevent further contact from this service, please refer to the URL above for instructions on how to do so. ************************************************************************

1 0

Bombing Denver / Why has no one ever seen Jim Bell and Capt. Buttons together?
by null＠myemail.net 17 Dec '03

17 Dec '03

So, according to the Air Force, an armed warplane was allowed to approach within a few miles of one of the most important underground military installations in the country, without anybody noticing. Are bears Catholic? Does the Pope shit in the woods? Are cypherpunks revisionists handling the current military disinformation campaign on this event? An armed warplane capable of delivering its payload upon unwary U.S. citizens gives every indication of making an attempt to do so, and no major media even broach the possibility of this being the case. I think perhaps I'll drop my cable news channels and subscribe to the 24-hour a day "Happy Days" network. If I'm going to live in fantasy land, I'd rather watch the Fonz raise his eyebrows when mentioning the Bobsie twins, without once suggesting that he would like to bang the living shit out of them. TruthMunster ************************************************************************ This Anonymous email has been relayed by http://www.MyEmail.net/ MyEmail.Net is a free anonymous mailing service. No records indicating the identity of person(s) who originated this message are retrieved electronically, or as a requirement to submit. Your email address can be blocked to prevent further contact from this service, please refer to the URL above for instructions on how to do so. ************************************************************************

1 0

lambda 3.02 - Big Brother goes international
by owner-lambda-en＠freenix.fr 17 Dec '03

17 Dec '03

--- lambda 3.02 April 14, 1997 Sender: owner-lambda-en(a)freenix.fr Precedence: bulk * Private Communications Under International Scrutiny: --> Key escrow encryption: The OECD says no, individual countries endorse it --> A global pact for universal wiretapping gains ground in Europe, with support of the U.S. and other industrialized nations * Short-Circuits: --> Social security data causes privacy concerns in U.S., France * * * * * OECD tries to prevent privacy abuses on encryption policy The Paris-based Organization for Economic Cooperation and Development released on March 27 its "Guidelines For Cryptography Policy," after more than a year of intense talks between officials from the 29 governments (see http://www.oecd.org/dsti/iccp/crypto_e.html) Yet there was one pleasant surprise: the guidelines do not explicitly urge governments to establish "key escrow" encryption schemes, although individual countries will be able to act according to its own wishes, for "national security" purposes. According to the Washington, DC-based Electronic Privacy Information Center, among the eight basic principles adopted by the OECD, one is the rejection of key escrow encryption (see point 6, "lawful Access"). "The U.S. sought endorsement for government access to private keys. Initial drafts of the guidelines included this recommendation. The final draft does not. OECD countries rejected this approach," said EPIC. The good point is an "endorsement of voluntary, market-driven development of crypto products. The OECD emphasized open, competitive markets to promote trade and commerce in new cryptographic methods." However, the United States, France and Britain have taken steps to pursue key escrow schemes -- but northern Europe isn't signing on. * USA: From EPIC Alert 4.05: "The White House has released a new draft proposal on key escrow encryption to the Congress. The draft (dated March 12) is entitled the 'Electronic Data Security Act of 1997.' The legislation is the latest attempt to push forward the result the Administration sought to achieve with the failed Clipper Chip initiative -- ensuring government access to all encrypted communications through government-escrowed keys." Resources: http://www.epic.org/crypto/ http://www.cpsr.org/cpsr/nii/cyber-rights/web/crypto_amer.html * France: A decree that will clearly establish the next trusted third-party scheme for business and individuals has not yet been released by the government. Draft proposals (see lambda 3.01) mentioned certain "national" preferences for future TTP agencies. These proposals have divided government officials (it may be an obstacle to common-market principles covering the free flow of capital and workers in the European Union). And the OECD clearly states (see point 8, "International Cooperation") that: "In order to promote international trade, governments should avoid developing cryptography policies and practices which create unjustified obstacles to global electronic commerce. Governments should avoid creating unjustified obstacles to international availability of cryptographic methods." * Britain: The U.K.'s Department of Trade and Industry released its proposal last month on licensing encryption services. According to Ross Anderson, the famed Cambridge University-based cryptographer: "Their effect will be to ban PGP and much more besides," because licensing will be mandatory. An excerpt of the draft regulations say: "We intend that it will be a criminal offence for a body to offer or provide licensable encryption services to the UK public without a valid licence. [...] Public will be defined to cover any natural or legal person in the UK. [...] Encryption services is meant to encompass any service, whether provided free or not, which involves any or all of the following cryptographic functionality - key management, key recovery, key certification, key storage, message integrity (through the use of digital signatures) key generation, time stamping, or key revocation services (whether for integrity or confidentiality), which are offered in a manner which allows a client to determine a choice of cryptographic key or allows the client a choice of recipient/s." Anderson commented: "The licence conditions imply that only large organisations will be able to get licences: small organisations will have to use large ones to manage their keys (this was the policy outlined last June by a DTI spokesman). The main licence condition is of course that keys must be escrowed, and delivered on demand to a central repository within one hour. The mere delivery of decrypted plaintext is not acceptable except perhaps from TTPs overseas under international agreements." The DTI report: http://www.cl.cam.ac.uk/users/rja14/dti.html Other resources: http://www.cpsr.org/cpsr/nii/cyber-rights/web/crypto_brit.html * Scandinavia: Despite these measures, the Nordic countries meanwhile released user-friendly plans to offer a secure and non-escrowed electronic mail system, called the Nordic Post Security Service (Denmark, Finland, Norway and Sweden). Every Scandinavian citizen will soon be offered the possibility of opening an e-mail account using smart card technology that allows for digital signatures and strong encryption of up to 1024 bit-length keys, a high level security. The private key will be embedded on the card, and no TTP system is planned. * * * * * Europe is launching a universal wiretap network The British watchdog group Statewatch revealed confidential documents from the European Union's intergovernmental meetings that show a global wiretapping system is under way among Europe, the United States and other industrialized countries. Legally speaking, the resolution and memorandum agreed among the EU's 15 countries have not yet been accepted by national parliaments, so it has no value except as a clear and profound indication of political will. See the full report, archived on the lambda's server thanks to Statewatch: http://www.freenix.fr/netizen/swreport.html Tony Bunyan, the director of Statewatch, published a communique at the end of February explaining the basic purposes of the wiretap plan: -- fwd message -- "The Council of the European Union and the FBI in Washington, USA have been cooperating for the past five years on a plan to introduce a global telecommunications tapping system. The system takes advantage of the liberalisation of telecommunications -- where private companies are taking over from national telephone systems -- and the replacement of land/sea based lines and microwave towers by satellite communications. Telephone lines are now partly land-based or under sea or via microwave land-based towers but the new generation of telecommunications will be totally satellite-based." The EU-FBI initiative notes the demise of: 1. state-owned telephone companies 2. nationally-based telephone systems is concerned about: 3. the problems faced with intercepting "mobile" phones and encrypted communications and wants to ensure: 4. there is harmonisation of national laws on interception 5. to ensure that telecommunications provider business cooperate with the police and internal security 6. the equipment produced has standards which can be intercepted 7. as many countries as possible to sign up and thus create a de facto global system (through provisions of equipment etc to third countries). A related disclosure in a book by Nicky Hager shows that instead of "suspects" and "targets" the ECHELON system simply trawls the airwaves for "subversive thoughts" in written form and increasingly in verbal form. ECHELON is run under the 1948 UKUSA agreement by the US, UK, Canada, New Zealand and Australia." -- end of fwd message -- * * * * * Short-Circuits: Social security data causes privacy concerns in U.S., France The Internet site of the U.S. Social Security Administration was closed due to privacy concerns, in that it supplied information about an individual's personal income and retirement benefits, the Washington Post reported April 10. Abstracts from the Edupage press review: "The shut-down followed receipt by the Administration of a harshly critical letter written by a bipartisan group of legislators who said the site's security systems were inadequate. To obtain information, a computer user needed merely to supply a name, address, telephone number, place of birth, Social Security number, and mother's maiden name -- items that are available in many private databases." In France, the government adopted on April 2 a draft law that extends the use of social security numbers, known as NIR, to tax authorities (the French equivalent to the U.S.'s Internal Revenue Service). The NIR is one of the most sensitive pieces of social data in Europe, since it classifies individuals according to their place of birth and is linked to all social benefits files. Earlier attempts in the 1970s to extend the NIR to other parts of the government had failed. The government passed these measures officially to fight fraud in social benefits households (minimum salary, housing aid, family pensions, etc.). The national data privacy commission, the CNIL, along with the League for Human Rights, expressed great concerns about the plan, which, if implemented by parliament, could especially harm low-income people. --- end of lambda 3.02 --- www.freenix.fr/netizen/302-e.html Jerome Thorel, April 1997. English proof-reader: K. N. Cukier --- To unsubscribe the lambda bulletin, send to majordomo(a)freenix.fr the following command: unsubscribe lambda-en to subscribe: subscribe lambda-en <your e-mail> ###

1 0

Re: Bombing Denver? / Or: How Capt. Button Learned to Stop Worrying and Love the Bomb
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

snow wrote: > > > The story thus far: > > An United States A-10 warplane on a live bombing run breaks formation > > and spends the next hour flying toward Colorado. > > And the best explaination that the military can provide is that a > > U.S. warplane capable of doing major damage to a U.S. city just flew > > around for over an hour, with no way for the military to prevent it > > from bombing our citizens. > > The military tells us that a warplane approached some of the most > > sensitive military installations in the country, without being noticed > > or intercepted. > > Well, Considering that A-10's can fly comfortably in "ground clutter", > or "trees" as civilians call them, it isn't suprising to me that they > couldn't track the fucker, and it is my firm belief that if the pilot > had wanted to dump his paylod over denver, coffin makers would be on overtime > right now. So you are basically claiming that Jim Bell's AP system opens the door for U.S. military personnel to participate, given the fact that U.S. defences are incapable of screening the mentally unstable from having possession of the latest in hi-tech armaments, or stopping them if they should choose to pick up a little cash on the side? Does your "firm belief" account for the fact that, upon changing direction near the end of the flight, as if in a bombing run for Denver or Vail, the A-10 suddenly reversed direction, as if taking evasive action, and then circled back to resume it's run, before disappearing? Even giving the least threatening scenario, that the pilot went for an innocent joyride and ran out of gas, it astounds me that the media could just wholeheartedly embrace the military's limp explainations of the fact that an armed warplane could wander at will through some of the most sensitive military areas in the country, and not bring this to the public's attention. Perhaps the bars and lounges that the news media personnel relaxed in during Desert Storm, while feeding the public the military's press releases verbatim were disassembled and moved to the U.S. It would be a shame if the media raised troubling questions in regard to this affair and the Pentagon raised the price of drinks in the media lounge. TruthMonger

1 0

Re: Bombing Denver? / Or: How Capt. Button Learned to Stop Worrying and Love the Bomb
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > The A-10 is believed by Reliable Sources to have been on its way to bomb > the Federal Building, while the McVeigh trial was starting, in Denver. > > (I'm on some strange lists and can't vouch for this revelation.) Which begs the question, "Would those lists be strange if you 'weren't' on them?" (Sorry, I couldn't help myself...) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

2 1

Re: anonymous credit
by Toto 17 Dec '03

17 Dec '03

Hal Finney wrote: > > Here is a simpler example of Wei's anonymous credit idea. We can call it > the "borrowing cryptographers". Hal, I have been following this thread with interest (no pun intended), and have had the foresight to not add to ideas that go beyond my own ability to follow. (I have to read your posts several times to even begin to grasp some of them.) I am wondering what other concrete examples you might be able to add to the one in this post which might point to an actual funtional implementation of the ideas you have been promulgating. Many of the CypherPunks discussions involve largely theoretical concepts which need much development to be practical, but it seems to me that in this post you are approaching a level where what you are discussing might actually be feasibly introduced in various microcosmic situations. Being a Canadian, and therefore semi-socialist by nature, I am thinking along the lines of Credit Union applicability of your ideas. Credit Unions often take the form of small groups of individuals or companies with common aims and/or backgrounds/interests. The basic idea behind many Credit Unions is that they are more prone to lend money to individuals or institutions which are promoting ideas which can be profitable, but which the average banker or loan agency would not understand sufficiently to advance money on. For example, having an interest in the issues you are discussing, I might be ameniable to getting involved in an effort to fund the development of the 'Hal-Wei Anonymous Credit' program. The advantage of a Credit Union setup is that I know that it is run with an eye to realistic chances of success being considered, but also will take into account efforts that should be funded which may have only a marginal chance of financial success, but will further the general cause of those things I am interested in. Truly there are a rising number of issues today which might benefit from the ability to participate anonymously in the funding of causes in which one has an interest. While AP is one of the more startling and newsworthy (?) aspects of anonymous lottery/credit systems, there are a multitude of minor causes which might benefit from the ability to engage in an anonymous credit system, as well. A simple example might be those who wish to financially back a legal challenge of their health-care system, without risking being denied benefits as a result of their participation. I think that some of the CypherPunks' contributions to computer technology go largely unrecognized because of the fact that they aide those who do not wish to draw attention to themselves, for the most part. There isn't a week that goes by without my receiving an email from someone who thanks me for the benefit they have gained by my introducing them to encryption or anonymous remailers, yet I doubt that many of them give the same feedback to those who provide those services. Remailer operaters seem to mostly receive shit and abuse for feedback, as a result of their efforts, yet I know from experience that there are many to whom their services have been a blessing. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

5 12

Digi-Cash IPO! $1.60 per share
by chairman 17 Dec '03

17 Dec '03

Greetings: Our market research indicated that this information may very well be very interesting to you! As you may know, initial public stock offerings confer upon QUALIFIED INVESTORS huge profit potential opportunities, IF they understand risk. Millennium Interactive Technologies Corp., developer of the first ever advertiser funded system of digital cash is offering 625,000 common shares directly to the public at $1.60 per share, with a 625 share minimum. MITNET is an E-commerce startup which will offer Digital Cash and a FREE smart card to every user who retrieves advertising E-mail from its Internet web site. MITNET DCUs (Digital Currency Units) can be redeemed to pay for your on-line charges, Or converted instantly into the currency of any nation. MITNET ad-mail is the future of Internet advertising! OFFERING CAN ONLY BE MADE BY WAY OF PROSPECTUS QUALIFIED INVESTORS of full age can obtain a printed copy of this offering prospectus, demo software, and the website URL, by sending a reply with name, street address, and day or evening phone number. (please specify) =================================================== This is neither an offer to sell, nor the solicitation of an offer to buy any securities. =================================================== Dislike commercial e-mail? Let us put you on our master *DO-NOT-MAIL* list which we supply to 400+ bulk e-mail firms. Simply reply with the word remove anywhere in your message. =================================================== mailto:ceo@mitnet.com

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 14 Apr 97 6:46:43 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net #-+#***##*-# 1:20:48 99.99% hidden remailer(a)hidden.net *+.-###*#*## 33:34 99.97% lucifer lucifer(a)dhp.com +++++++*--++ 37:43 99.96% weasel config(a)weasel.owl.de ++-++---+-+ 2:26:15 99.94% winsock winsock(a)rigel.cyberpass.net -------+--- 3:02:13 99.88% balls remailer(a)huge.cajones.com * #######*## 1:25 99.87% reno middleman(a)cyberpass.net -___.--*+-** 8:53:42 99.72% dustbin dustman(a)athensnet.com ----- .+-+- 1:22:31 99.67% cyber alias(a)alias.cyberpass.net + ++ +*++** 32:39 99.66% replay remailer(a)replay.com -.-*-**** +* 48:24 99.59% mix mixmaster(a)remail.obscura.com -__.--++*-+ 13:31:30 99.54% squirrel mix(a)squirrel.owl.de -+-++- -+-+ 2:21:21 99.45% shaman remailer(a)lycaeum.org ++*+-++--+** 23:01 99.35% extropia remail(a)miron.vip.best.com _..---...- 22:24:15 97.51% exon remailer(a)remailer.nl.com *#* *__ * ## 3:49:43 95.05% jam remailer(a)cypherpunks.ca ** ** 8:26 26.45% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: SSL weakness affecting links from pa
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

Tom Weinstein wrote: >This particular feature (the HTTP referer header) has nothing to do with >corporations "having their way" with users. It was created so that web >authors could put "back" buttons on their pages. The security problem >arises when stupid CGI authors use GET forms to transfer sensitive >information. This is a security hole in the web site, not in the >browser. The browser follows the HTTP specification. If you have a >problem with that, contact the author of that specification. Or, better >yet, contact the web site (as far as I know, there are none) that has >this security hole. Stupid programmers abound even in large corporations. Bugs, patches and security holes are now normal everyday things. I agree with Toto. Companies should take more responsability in the programs they produce. Especially nowadays when a lot of people without any computer background or insight into the dangers are accessing the Net. Why does Netscape (and microsoft) warn users about secure and insecure forms? So they can say "I told you so!" when you get screwed by someone. Same thing goes for the GET method. Whatever a "stupid CGI author" does has little bearing on the issue. It's like saying the tire fell off my car because the person who built the road to spec ("GET" is allowed) is to blame not the car maker. I should be warned about certain roads by the car maker. If "GET" is allowed but unsecure YOU should warn me! Admit it! It did not occur to your programmers to warn about access to "GET" forms like it occurred to them to warn about http references inside a https-accessed document. Now we have to live with it. And you say "stupid CGI authors". What if they did it on purpose? Are you going to say "then its stupid web users"? I'd really like to hear you say that in public! >In the eyes of some, the referer header is a privacy violation. It >allows a site to see what site you visited before coming there. In the >case of Navigator, we ONLY send the referer header when you click on a >link. Not when you select a bookmark. Not when you type a URL into the >location field. This allows web sites to see who links to them. I >think that's something that a web author is entitled to know. NO WAY! The web author is NOT entitled to know where I came from. So if you go to Sears the saleperson is entitled to know you came from JCPenney's? If so, then I am just as much entitled to not tell him or at least entitled to know that there's a sign on my back that says where I came from. How many web users are aware of the HTTP REFERRER header? Not many, especially if they have not read the specs or looked at the logs from a web server. As an adminsitrator I AM NOT ENTITLED to that info. >So, you think we're doing something bad. Why don't you tell me what >you think we should do? Accept responsibility? Ok, that's wishful thinking. How about not blaming others? How about warning your users? You didn't do it in this case. If you do then you can say "I told you so!" Art Grapa agrapa(a)banamex.com

2 1

RE: [PGP-USERS] SFS and PGP
by Alec 17 Dec '03

17 Dec '03

>From: "James A. Tunnicliffe" <jim.tunnicliffe(a)inference.com> >To: "'pgp-users(a)rivertown.net'" <pgp-users(a)rivertown.net> >Cc: "'GWNapier(a)aol.com'" <GWNapier(a)aol.com> >Subject: RE: [PGP-USERS] SFS and PGP >Date: Mon, 14 Apr 1997 07:21:52 -0700 >-----BEGIN PGP SIGNED MESSAGE----- > >GWNapier(a)aol.com says: >> Lately I have heard a lot about SFS. The bits and pieces I heard >> about it said it integrated PGP into it. If anyone knows about where >> I can get more info about, I would appreciate it. If SFS has nothing >> to do with PGP and I have heard wrong, I give you my deepest >> apologies for bringing it up on this list. > >Peter Gutmann's SFS (Secure File System) is a highly regarded program >for encrypting entire disk partitions at the sector level. It's a >low-level device driver that encrypts your disk writes and decrypts >your disk reads transparently on the fly, so your disk is always in >an encrypted state. Apart from being a quality encryption product, >it has nothing to do with PGP, secure email, etc. It's for a whole >different (though very valuable) purpose... > >For more information, see: > http://www.cs.auckland.ac.nz/~pgut001/sfs.html > >Tunny >====================================================================== > James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny > Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 > tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C >====================================================================== > >-----BEGIN PGP SIGNATURE----- >Version: 4.0 Business Edition >Comment: Achieving civil liberty through complex mathematics > >iQEVAgUBM1I+iPAmQsmyRPddAQGltAf/Vsn7Mj9dJyl8za4gOcK8s5CbetyqPc2Z >giqxUr63ghdOSPhDYkRbfvroS6GrfVbTF4Gdhx7aZ+8J5FF5YXF1I1iHELkAJxTm >AFoErAkZZHLUH5D2RddV0dXJQBPFa0O2h8kxL8V24ktUnGyi5UOwXPoub9vwAVnM >+x1fu8J6/z8PkOLHOe/BczAUCRtgzHFD9XZ0wVSXQgLKgIkftxF5gfO/x0UM9w17 >rdiAx4QzLotwmUKKhVUVAm2glcvkRa0Zs0JQv5QdtVOvNCPSJpcz90yFqUbKiPJp >R0SQhcAmJveJMNEUoetQ68s3eMdoe1U0nGJOVg0tK5rdZzEDxyXxPA== >=XKVJ >-----END PGP SIGNATURE----- > >

1 0