December 2003 - cypherpunks-legacy

Privacy Problems with the IAHC New TLD Report SLD Policies
by Bill Stewart 17 Dec '03

17 Dec '03

The International Internet Ad-Hoc Committee released its report on new Top Level Domains for the Internet. It's interesting, and resulted from much political wrangling and religious conflict, and for the most part I think it's taking a reasonable approach to the problems, and I'm certainly not going to go postal like Postmaster Karl Denninger :-) A few particularly nice features: - .nom TLD, for name-based domains - Multiple registrars per name space, reducing the monopoly problem - trying to keep governments or PTTs from controlling it, though it's a bit big-business oriented for stability reasons. Mostly I wasn't worried, because sensible people were going to make sure they didn't do anything totally disastrous. Apparently I _should_ have been watching more closely, because the SLD _Second_ Level Domain part has some policies that seriously interfere with the privacy of potential domain name users. References and long quotes are below... To a large extent, they've been trying to avoid getting stuck in trademark problems by collecting lots of information and defining jurisdiction. In the process, they're asking you to sign away your first-born child in return for getting your name in the Yellow Pages(tm), and they're requiring all the Registrars to reject your application unless you do. The rules are especially inappropriate for the .nom domain, which is for personal names and such, and don't need overkill. There's a place for serious high-value commerce behaviour, and much of this isn't too inappropriate for .firm - but even that ignores the radical communication-pushed changes in the economy that make everybody able to run a worldwide business. It's not just that they want your email address (highly reasonable) or your phone and physical address (ought to be optional) or your IP address (they don't ask) or domain name (ok) or digital or written signature. It's not even just obnoxious things like demanding that you swear (against _my_ religion...) to a bunch of things, like "the reason for requesting this particular domain name" or what you're planning to do with the domain name (perfectly reasonable things to ask for as optional extras, and business may want to reveal these, but "Decline to State" or "" or "MYOB" are perfectly reasonable responses.) It's things like designating an agent for service of process, and "submits to the personal and subject matter jurisdiction and venue of a competent tribunal in the country where the registrar resides". Aside from believing that you ought to be able to choose what governments, if any, you're going to subject yourself to, I'd also expect that this would be annoying to people who don't live in one of the <=28 countries that get Registrars in them. And certainly if you're going to designate someone as an agent for service of process (you can use the Registrar) there'd better be some contractual language available so you can tell what you're swearing to. Is it reasonable to have a policy that users need to indicate how they'd like to receive communications about name and trademark disputes? Sure. And that they hold the Registrar harmless in such disputes? Probably. And which dispute resolution organization they're willing to have resolve disputes over names (a _much_ milder statement than "submit to personal and subject matter jurisdiction"....)? Yeah, even if the default is "the Registrar can disconnect your name if you don't respond to trademark complaints in N days." Certainly the Registrar ought to have some options here. ======================== REFERENCES =================================== The Final Report is at http://www.iahc.org/draft-iahc-recommend-00.html (nice name for a "final" report :-) The Application Forms for SLDs aren't in the draft on the web page, so I'm assuming they're referring to something similar to the December draft's Appendix. Mailing list archives are at http://www.iahc.org/iahc-discuss/ ========================================================================== QUOTES FROM THE REPORT ========================================================================== 6.1.5 Second-Level Domains SLD application Application for a second-level domain name must include: Sufficient contact and intended use information Appointment of an agent for service of process Agreement to jurisdiction in the event of trademark litigation. Mediation and arbitration clause (discussed in a later section) A separate document entitled "SLD Applications" (see section 1.4) contains the information that must be included in a SLD application. Applications submitted electronically must include state of the art electronic identification; written applications must be signed by the applicant, if an individual, or by an officer or other legally authorized representative if the applicant is an entity. Renewal and non-use To promote accountability, discourage extortion and minimize obsolete entries, SLD assignments must be renewed annually. Appendix B, attached, includes the information that must be included in a renewal application. Renewal applications submitted electronically must include state of the art electronic identification; written renewal applications must be signed by the applicant, if an individual, or by an officer or other legally authorized representative if the applicant is an entity. In addition to requiring annual renewal, CORE will develop policies to ensure the recovery of sub-domains which no longer have an authoritative source (lame delegations). 6.2 Discussion In order to ensure consistency of basic service across registrars, certain information is required in all applications for SLDs under gTLDs. It is desirable that a domain name application include sufficient information regarding the applicant and the applicant's intended use of the domain name to ensure applicant accountability and to ensure that sufficient information is available to enable trademark owners to assess the need for a challenge to the proposed SLD domain. ================= [more stuff] ================================================ 7.1.3 Publication All applications for SLDs in the gTLDs will be published on a publicly available, publicized web site, immediately upon receipt by the registrar. Such publication entries will include: Name of the SLD; Contact and use information contained in the application; A permanent tag or label (created by CORE) indicating whether the applicant chose the option of waiting 60 days prior to assignment of the requested SLD or chose to forego the 60 day wait; Entry validation using accepted digital signature and timestamping techniques. Those applicants choosing not to wait will not be in a position to claim the defensive benefit of the waiting period against a challenge, at any time, by a trademark owner. =================================================== ======================================================================= APPENDIX FROM DRAFT - SLD APPLICATION REQUIREMENTS ======================================================================= 11.1 Appendix A - SLD Application Requirements Every application for assignment of a SLD must include the following elements (incomplete applications must be returned to the applicant for completion): 1.Applicant's name, business or residential address, email address, fax and phone number(s). 2.The state or country of incorporation or partnership (if applicable). 3.The name and address of a designated agent for service of process where the registrar is located, which may be the applicant in the case of an individual. (The applicant may designate the registrar as the agent for service of process.) 4.A sworn statement by the individual applicant or by an officer or general partner of a corporate or partnership applicant: 1.that there is a bona fide intent to use the domain name publicly within 60 days of registration, and a bona fide intent to continue such use in the foreseeable future; 2.that the domain name will be used for [fill in the blank, e.g., "for a web site to advertise applicant's candy manufacturing business"]. This may be a broad statement and is not intended in any way to restrict actual use. However, to the extent that a commercial use is intended, this statement should identify the industry in which the use is intended to be made and should indicate which of the following uses will be made: web site, email, bulletin board and/other describe); 3.that the applicant believes that the intended use of the domain name will not infringe any rights of any other party; 4.that the reason for requesting this particular domain name is that it conforms to [check one of the following]: ___ applicant's company name or variation thereof ___ applicant's trademark or variation thereof ___ individual applicant's name or variation thereof ___ other (provide full explanation) 1.that the applicant submits to the personal and subject matter jurisdiction and venue of a competent tribunal in the country where the registrar resides for purposes of any action brought under trademark law, unfair competition laws, or similar/related laws arising out of actual or intended use of the domain name applied for; and applicant waives all rights to challenge such personal jurisdiction, subject matter jurisdiction and/or venue. ============================================================================ ======== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My letter to Long Island Newsday regarding David Kahn's pro-GAK editorial was published today. You can read it at http://www.newsday.com/mainnews/rnmi052u.htm What's odd (?) is how they editied it. I directed my comments toward Mr. Kahn's views, which they changed to "Newsday" (odd, since I've never seen them print an editorial one way or another on GAK; does this mean they are taking a stand? -- Kahn is an editor at Newsday). I wrote "The greatest flaw in the argument is it's very reason, 'criminals... are increasingly using encryption to conceal their plans and activities'" which they changed to "It reports...". I never considered an op-ed piece as "reporting", even if it states a fact. The following paragraph There are also a variety of technical problems associated with escrowing encryption keys, mainly, how to do so securely? A single `backdoor key' (or set of keys) for a popular product can become an easy target for crackers who can jeopardize the security of an entire system. Software can be easily hacked to disable or damage the key escrow features, and there are techniques to hide even the presence of a message in something innocuous as a digitized image. (Mr. Kahn seems to have forgotten to mention that the FBI not only wants to overhear cellular phone conversations but also read E-mail and any other encrypted files people have.) was changed to just There are also several technical problems associated with escrowing encryption keys, mainly, how to do so securely. They did leave the last two paragraphs relatively intact, though. Yeah, yeah... the piece could have been much longer & detailed, but it's only a letter to the editor... - --Rob -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvhdzgTNlSxdPy6ZAQEw8Qf9FnDSSd/m+XwUxU1CCJnwVOrvS4qyIubX 2E18o2rrS+F8TDjkhVsaDR3lJNqikdOzAL2GfjX53/cBEOhYcYcip7IHkd8UxqY6 zDHp2LwWnSuF8wwxeKw/DyPhAURsxYAl+LCJbsJjK+zxpgPU1Z0YzFkj3Am6bscv t8qiPoTxUF3tusueT5I3xQsRgEAx1SNwRHgQGzLS+zPwdFBT9ZsIsp4EbZ0fx1cE ZpbIxu1koDCWhkmJdTiL5HXXJ6mROJvCIGHfr1NU099AlIOO/FXq2UTnti2TzQn7 wYF73490ru1AFMEViLipj3zXzJsIGBo32La37yDozBEItd32B0L/+w== =3wRg -----END PGP SIGNATURE----- ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Newt's phone calls
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Dr.Dimwit L)amentation( Vehement K)retin(OTM enjoys sucking the puss from his syphilitic homosexual friends. /\_./o__ Dr.Dimwit L)amentation( Vehement K)retin(OTM (/^/(_^^' ._.(_.)_

1 0

Re: [ADMINISTRIVIUM] Extradition treaties
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Drunkard Vilest K>rap<OTM wears satin lingerie embroidered with pink swastikas, prancing around for his faggot, AIDS infected lovers. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Drunkard Vilest K>rap<OTM | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

Re: AltaVista Tunnel
by Anil Das 17 Dec '03

17 Dec '03

Rick Osborne wrote: > > He triumphantly exclaimed that the encryption was 128-bit, but when > I said "128-bit what?" he cowered and muttered that he didn't know and went > on with his little speech. The rest of my crypto-specific questions met > with equal dark stares. And these are the people setting industry standards... I should be happy that you are bashing a competitor and all, but give them a break, OK? The marketing dweeb who has to do product pitches on roadshows is not the same as the design engineer who designs the system and sets technical standards. There can be a big difference in technical knowledge about the product, and even basic competency, between the two. -- Anil Das

1 0

OECD Waffles
by John Young 17 Dec '03

17 Dec '03

2-4-97. Reuters: Global group fails to endorse Clinton encryption plan Washington: An influential economic research group is preparing guidelines on computer encryption for its member countries but will duck some of the most contentious issues involved, according to a draft obtained by Reuters. The Clinton administration, seeking to rally support for its controversial policy on exporting encryption products -- which encode and decode e-mail and other computerized messages -- failed to win an endorsement from the Organisation for Economic Cooperation and Development (OECD), although the group did discuss the administration's approach. On perhaps the most difficult issue, the draft guidelines do not favour or oppose a requirement in the U.S. policy that data-scrambling encryption programmes provide a way for law enforcement officials to obtain keys to crack the codes when necessary. After indicating that governments should carefully weigh the costs and benefits of imposing so-called key recovery, the draft report said, "this principle should not be interpreted as implying that governments should, or should not, initiate legislation that would allow lawful access." On all the controversial areas in the draft, "the member countries of the OECD have strongly held views but they don't always coincide," John Dryden, head of the group's Information, Computer and Communications Policy division, said in a telephone interview from Paris. Some countries see widespread use of encryption as a way to protect the privacy of computer users and businesses, thereby encouraging global commerce, Dryden said. But others see encryption as possibly thwarting law enforcement's efforts to catch riminals and global terrorists, he said. The guidelines suggest encryption users should have access to products that meet their needs. Government controls should be "no more than are essential to the discharge of government responsibilities." Instead of reconciling the different views, the draft guidelines lay out competing interests and approaches. "It's not in itself a cryptography policy and it's not an attempt to draft a model national law that we're encouraging people to adopt," Dryden said. Cryptography refers to products and systems used in encryption. The guidelines also suggest encryption standards and usage should be "determined by the market in an open and competitive environment." "There's a strong view that the private sector should have the possibility to use information networks to the best of their potential in order to create growth and jobs," Dryden said. U.S. officials who have seen the preliminary draft praised the guidelines. "They're an important and helpful step forward," Undersecretary of Commerce William Reinsch said. "They're helpful because they put down on paper the proper foundation for getting into this," he added. Reinsch said most countries will follow the U.S. lead and require so-called key recovery features for law enforcement. Under the Clinton policy, domestic use of encryption is not regulated but the strongest coding products cannot be exported unless they include key recovery. U.S. companies that have opposed the Clinton policy, contending it stifles their ability to compete with unfettered foreign firms, drew little solace from the draft guidelines. "This is not helpful," said Netscape Communications Corp.'s public policy counsel, Peter Harter. Netscape and other companies preferred stronger language endorsing free-market policies, he said. The draft guidelines, approved by a group of government and private-sector experts at a meeting at the end of January, still must be approved by a top-level OECD officials from the group's 29 member countries, including the United States. -----

1 0

'Total Recall' Come True!
by John Young 17 Dec '03

17 Dec '03

Major Organizations Are Experimenting With Computer Chip Implants in Humans, According to EE Times Special Report Manhasset, N.Y., Feb. 4 -- The implantation of computer chips into humans and animals is now actively being funded, researched and experimented by major institutions such as Stanford University, British Telecom, the National Institute of Health (NIH) and major corporations, according to the first of a two-part special report published by EE Times (http://www.eet.com) Although the work is drawing fire from civil libertarians and conspiracy theorists, among others, many scientists and physicians defend the work for its potential to ease suffering. "It's 'Total Recall' come true! Our in-depth look into this state-of- the- art research reveals that the mix of electrical engineering and medical technologies to surgically implant computer chip-driven devices is here today -- a micro chip implant is simply one step beyond a pacemaker," said EE Times Internet Editor Larry Lange. According to the EE Times report, Mitsubishi Electric Corp. (Tokyo) recently developed a low-cost input device that can recognize human movement and convert it to commands for use in software applications. This device is expected to find its way into tools used by people with disabilities. On other fronts, the semiconductor research lab at Motorola Inc. is working on body-embedded electronic blood-sensors that may one day allow diabetics to measure their blood sugar levels without ever drawing a drop of blood. The special report, appearing in next week issue in print and online, looks at additional areas of research and the differing reactions to it. -----

1 0

NFIC Warning About Sexygirls web site
by Robert Hettinga 17 Dec '03

17 Dec '03

I had to laugh when I read this... Cheers, Bob Hettinga --- begin forwarded text X-Sender: themet(a)pop.mindspring.com Mime-Version: 1.0 Date: Wed, 5 Feb 1997 01:50:36 -0800 To: fraudnews(a)silverquick.com From: Mark Taylor <themet(a)mindspring.com> Subject: NFIC Warning About Sexygirls web site Reply to: Mark Taylor <themet(a)mindspring.com> Here is an interesting twist on how some crafty scamsters can rack up money on your phone bill =========== National Fraud Information Center Monday, February 4, 1997 PORNO SURPRISE Consumers who visited a pornographic website (www.sexygirls.com) last month got a big surprise on their phone bills. After a few teaser pictures, surfer was told he/she needed to download a special program to view the archived images. That program was actually a viewer with an entire communications suite hidden deep inside (a non-self propogating Trojan Horse). The program disconnected user from his/her ISPs, shut off the volume on the modem if it was computer controlled, and dialed a number in Moldova -- a small, former republic of the Soviet Union wedged in between the Ukraine and Romania. All the while the consumer was on the website, and even if he/she then browsed other sites on the World Wide Web, the Internet access was being provided through the Moldova number, resulting in huge international phone charges! Consumers didn't know that until their phone bills arrived. According to the Toronto Star Business Reporter, there are Canadian reports of bills into the thousands. The Toronto star also reports that the Royal Canadian Mounted Police has requested all calls from Canada to that number in Moldova be blocked. Bell Canada is attempting to provide relief for Canadian consumers. US consumers should contact their long distance providers if they find these unexpected charges on their bill. The RCMP has also required the owners of sexygirls.com to place a disclaimer on the site, alerting consumers to the presence of the communications software in the viewer. The disclaimer also tells consumers how to disconnect if they do not wish to use the server in Moldava. In November, Internet Fraud Watch warned consumers concerning the possible dangers of downloading programs over the Internet. Some tips: Don't download unnecessary items. If it's just a piece of razzle-dazzle, don't bother. It will only take up space on your hard drive and perform no useful function. If there's no gain for you from the program, there's no reason to take a risk. Only download from sites you know and trust. While even a major corporations site can sometimes have a viral infection, a lone programmer might be using an attractive piece of code as a delivery vehicle for his pet virus. Don't download material directly onto a computer network at work. First download it onto a stand alone PC. Test it out. Make sure it doesn't have any malicious side-effects. Check that machine for known viruses. Only at that point should you install the downloaded program on a networked machine. If you feel you must download files, keep track of what files you have on your system and what files are created during a program installation. That way you can easily uninstall any program if you find it to be undesirable. This also helps in detecting new installed files that aren't supposed to be there. Remember, your main worry is an executable file (i.e. a program or application). Despite what you hear all over the Internet, you cannot get a virus from a piece of e-mail. If you are having a problem with calls to Moldova, the connection will only be made if you attempt to use the viewer. If you try to use the viewer, shut down your machine after you are finished at that site. If you wish to remove the viewer altogether, the file name is david.exe (for IBM users). If you are in Windows, it should be in your program folder. FraudNews is owned and published by : Mark Taylor: themet(a)mindspring.com All material published is copyright.It must not be reproduced in any form without the express permission of of the owner. ============================================================= This Newsletter is broadcast using the List and Newsletter Management facilities of Silverquick Communications You may subscribe to FraudNews and the Fraud-Discuss lists on the web pages at : http://www.silverquick.com ============================================================= --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: AltaVista Tunnel
by Dale Thorn 17 Dec '03

17 Dec '03

Anil Das wrote: > Rick Osborne wrote: > > He triumphantly exclaimed that the encryption was 128-bit, but when > > I said "128-bit what?" he cowered and muttered that he didn't know and went > > on with his little speech. The rest of my crypto-specific questions met > > with equal dark stares. And these are the people setting industry standards... > I should be happy that you are bashing a competitor and all, but give > them a break, OK? The marketing dweeb who has to do product pitches > on roadshows is not the same as the design engineer who designs the > system and sets technical standards. There can be a big difference in > technical knowledge about the product, and even basic competency, > between the two. HP in their first 17 years of making personal computers always sent real engineers along with salespeople to their product rollouts. Starting in late 1983 with their first MS-DOS computer, they did a 180-degree and eliminated the engineers, and started sending people who knew nothing about HP products, which is bad in the sense that some folks wanted to know "Why should I buy HP when I can get the real thing, i.e. IBM"? As a sales manager, I always had a hard time with that one. I blame HP in retrospect, for a moron mentality in their marketing department.

1 0

Newt's phone calls
by Anonymous 17 Dec '03

17 Dec '03

Dr.Dimwit L)amentation( Vehement K)retin(OTM enjoys sucking the puss from his syphilitic homosexual friends. /\_./o__ Dr.Dimwit L)amentation( Vehement K)retin(OTM (/^/(_^^' ._.(_.)_

1 0

Re: [ADMINISTRIVIUM] Extradition treaties
by Anonymous 17 Dec '03

17 Dec '03

Drunkard Vilest K>rap<OTM wears satin lingerie embroidered with pink swastikas, prancing around for his faggot, AIDS infected lovers. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Drunkard Vilest K>rap<OTM | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

Re: AltaVista Tunnel
by Anil Das 17 Dec '03

17 Dec '03

Rick Osborne wrote: > > He triumphantly exclaimed that the encryption was 128-bit, but when > I said "128-bit what?" he cowered and muttered that he didn't know and went > on with his little speech. The rest of my crypto-specific questions met > with equal dark stares. And these are the people setting industry standards... I should be happy that you are bashing a competitor and all, but give them a break, OK? The marketing dweeb who has to do product pitches on roadshows is not the same as the design engineer who designs the system and sets technical standards. There can be a big difference in technical knowledge about the product, and even basic competency, between the two. -- Anil Das

3 2

Re: Dissolving Choke Points
by Roy M. Silvernail 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In list.cypherpunks, gbroiles(a)netbox.com writes: > My mention of Usenet was somewhat tongue-in-cheek; I don't know if I'd bother > with the list if it were moved to (or gated with) Usenet, as Usenet has > become for the most part 100+ Mb/day of uselessness. An obvious point. But you go on to say... > The good side I see to a move to Usenet is that it lets people use the > comparatively better tools for managing messages [...] FWIW, I gate all my subscribed mailing lists to local newsgroups because my newsreading tools are much better than my mailreading tools. > The down side is that Usenet is more or less a sewer these days, and some of > it's bound to spill over. The unfiltered list already had spammers and flamers. Would you expect nore sewage, different sewage or a combination? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com, which works now -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMvgPUBvikii9febJAQElRwP+IC40bwrsV7w7NI0IMmdwGRPO8tHNo6qU pCb6i9UNSrtaFseZ6I04RIsy1mitoJbmDaoJqKcWz1smi4pr1Te/1QZDt8CLouP2 lXwZV9PojttoBbGlfrc1gY/ZEOnOtwwBemiMSiyIS0Md26f1VM9i1OMVR4RDpLY8 +VrFN9htVyc= =jMyg -----END PGP SIGNATURE-----

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by Matts Kallioniemi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jeremiah A Blatz wrote: >On the choke points note, mailing lists are better than usenet because >legendary AOLers with there 5 free hours of fame and their ilk usually >don't figure out how to pester mailing lists. Being on a mailing list >usually requires a commitment, that is enough of a barrier for many of >the usenet underirables. Another way to get rid of the totally clueless and involuntary subscribers would be to require subscription requests to be PGP signed and acknowledged by the subscriber. Matts -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMviI5xVFhWUyiUQRAQFdEwf/ZI2WW/2OVKq4xdwmsPNzCP3yJj7NfsOP JSBegY21WX/Oa+gT/Zmo5lrOh9wWQlF2OpFlzggvBef1Vm5qidge5dRqSxmUPipc 5/HZFK1KxQI5uLjC7pZo5pMfjIroPYI4pldfYP2fjn3qo82sg8IWEn1FSH3b5iEE qrL71rWmG3ekx7qDMvZPGKrjwi7XNJlKUT7qIjQaR25sg3U4KsntV5FZ+Iof6FRz cFX0G2bQ5r1tE/QIqrMm94cD27KNFshSArBFgTqNqqCJtym2v+oOtiCpm8uqirlB oREDHaIs7pJyUA3VkdQnVwKbN+c/Ln9nBAZ9V0BGBg4rZMp/rDRo+Q== =YOIl -----END PGP SIGNATURE-----

2 1

Re: New X-Ray Imager
by jim bell 17 Dec '03

17 Dec '03

At 01:18 AM 2/4/97 -0800, Dale Thorn wrote: >Steve Schear wrote: >> New X-ray gun trades privacy for safety >> Reported by Andy C >> Seen in The Nando Times on 13 August 1996 >> "I'm incredibly concerned," said John Henry Hingson, a past president of the >> National Association of Criminal Defense Lawyers, meeting here this past >> week. "The entire nation could become a victim of illegal searches and >> seizures and the law is powerless to protect them from these police abuses." >> But in these nervous times following the the crash of TWA Fight 800 and >> bombings at the Olympics, Oklahoma City and the World Trade Center, many >> Americans are now willing to trade some of their privacy and civil liberties >> for greater security. >> A poll last week by the Los Angeles Times found that a majority of people -- >> 58 percent -- said they would curtail some civil liberties if it would help >> thwart terrorism. Thirteen percent said it would depend on what rights were >> at stake. The poll didn't ask people to single out any rights. > >The L.A. Times quotes this "poll" all the time, and in fact probably >just made it up. Why do I know that? Because they ran a "letter" >from a "teacher" in the valley somewhere about a year ago which said >exactly this same thing. The "teacher" ran a poll of her students >and they agreed to give up the rights without even knowing which >rights they were giving up. Wouldn't it be nice if, in a new poll, they asked the following question: "Do you believe that the people who ask you, in other polls, whether or not 'you'd be willing to give up a little freedom to thwart terrorism' have any proof it's possible to, in the long run, 'thwart terrorism' by sacrificing freedom?" Jim Bell jimbell(a)pacifier.com

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by aga 17 Dec '03

17 Dec '03

On Tue, 4 Feb 1997, Dave Hayes wrote: > Steve Boursey writes: > > Well EFF itself is a lie--the were very well exposed by Wired Mag. a > > while back as being nothing more than a corporate whore. They represent > > the interests of owners not consumers--the ACLU has been very open > > in their critisism of the EFF in this regard. A large corporation > > waves some money in front of their noses and tells them to bend > > over you can be sure they'll bend over. > Actually, the EFF is meaningless, and not worth discussing. It was just a bunch of hippy faggots that got financed by the greatfull dead, and since the greatfull dead died, the EFF should just also die. I mean come ON, with queers at the organization, NOBODY is going to give it any credibility. > It's not clear from where I sit that the EFF is intrinsically evil. A But it has John Gilmore there, and he is the evil censor. > case can be argued for their initial good intentions followed by the > subsequent poisoning of this intent by people with lots of money. Of > course, -any- organization is as susceptable to infiltration as their > weakest member. > > > Respectable free speech advocates do not associate with EFF. > > If one is going to advocate free speech, I strongly suggest one > learns to deal with one's own greed and one's own need for power > first. Greed and avarice may be bad, but wealth and control are good. The power must always go to those who do not "need" it but who know how to use it. Not everybody is qualified to carry a gun.

1 0

Re: John's: In anarchy -everyone responsible
by jim bell 17 Dec '03

17 Dec '03

At 09:05 PM 2/4/97 +0000, Attila T. Hun wrote: >on or about 970204:0312 Greg Broiles <gbroiles(a)netbox.com> said: >+ Is the desire for an anarchic community at odds with a desire for >+ good use of resources? Actually, it is quite possible that an "anarchic community" is _more_ efficient in the use of resources than some sort of organized community. It is explained, for example, that the reason there are so many different kinds of life on earth is that there are so many ecological niches to fill. > In a "popular" anarchy, Jim Bell's assassination politics make > perfectly good sense; but, a "popular" anarchy is not an _anarchy_. I guess I don't understand the distinction you are trying to make, between a "popular anarchy" and an "anarchy." Maybe you were trying to distinguish between "dictatorship of the few (or one)" and "dictatorship of the many (perhaps a majority)" but it didn't come out very understandably. Put simply, "anarchy is not the lack of order. It is the lack of _orders_." > anarchy is only possible in an ideal world where _everyone_ > assumes not only responsibility for themselves, but for the common > good. no malice, no greed, no need for assassination politics.... No, that's traditional thinking and that's wrong. See AP part 8. Freud believed (as "everyone" else believed, even myself, before AP) that anarchy was inherently unstable. But it ISN'T, if the tools of AP are used to stabilize it. And no, no altruism is necessary for AP to work as well; no individuals are being asked to sacrifice themselves for the common good. Rather, they are given the opportunity to work to achieve a reward offered, cumulatively, by a number of citizens. Jim Bell jimbell(a)pacifier.com

2 1

Cypherpunks FOIA request
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 1/18/97, I sent freedom of information act requests to the FBI (main and San Francisco offices), CIA, NSA, and Secret Service, asking them for copies of information in their files relating to or referring to the cypherpunks list, the cypherpunks meetings, and copies of any messages sent from or to "cypherpunks(a)toad.com". To date, I have received three responses: one from the SF office of the FBI, indicating that they have no records responsive to my request; one from the NSA, indicating that they are processing my request, and one from the Secret Service, asking for a copy of my signature. (I've got no clue why they want that; unless I screwed up, I believe my initial request was signed.) Copies of my requests and the responses are available online at <http://www.io.com/~gbroiles/cp-foia/>. I'm not sure what I think about the response from the SF FBI branch - it seems unlikely that they'd never have paid any attention to the list, given the media coverage in Wired and other places. On the other hand, maybe the FBI doesn't read Wired. :) While they're not supposed to be monitoring noncriminal domestic activity, I figured they'd at least have something about the Mykotronix stuff. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvhHPf37pMWUJFlhAQGBSAf/XIdNAMrxn3flb6O7Q1TZYL1xd/RHAAZv YsuuXs/n6Dih/SnJVqc35tF5/33N0gK0xWhyPCBWdIitVCgHpt+214WEOg3IWBqO KGcnbXg/YMs4xN50zLgpV+Xoim4rjfwCROqNNWvrBqwo6RicAyJbLRoRGE+KdDkx WSslCzxsVYzRHzzkF48rhbYAXqU2vUesG0t8Alg17R/2w4TvjAzlQ3PpclUukB8U VglMVB+dicn+5B2zITt1WG21xMmSHQea5rpwKpDxZdjBvBKXLhgH8L1Hdl6nu3zI sqDEENxeV+bI5UdSzemQDy+TDQoy7BSN7Tby8JgwXE9x3AitY2A05g== =S1Zy -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: More on Cellular Encryption Docs
by Bill Stewart 17 Dec '03

17 Dec '03

>>>Here's more on the controlled documents for cellular encryption >>>from TIA/EIA we described in a 26 January post to cpunks: ... >>Of course, ITAR as recently modified says it's ok to send this >>stuff overseas to foreigners, as long as it's on paper. >>There may be separate restrictions on sending it, or on copying, >>but they're based on copyright or contractual non-disclosure. > >Given that high-density inkjet printers can do 600x600 dpi resolution, it >should be possible to achieve the equivalent of 100x100 bpi of >easily-recoverable data on ordinary paper. That's about 800 kilobits, or >100 kilobytes. What does ITAR say about this? These are text, perhaps with occasional illustrations, so the current interim export rules say it's ok. For optically-scannable printed data, the government's announcement says it reserves (somehow) its right (acquired in unspecified manner :-) to re-evaluate the exportability at a later time. I think they haven't settled on whether they'd be more embarassed by banning it (which bans export of printed material, risking serious Constitutional challenges) or by not banning it (having people laugh at them while exporting source code or even binaries in OCR-A on loose-leaf paper with page numbers and checksums.) Of course, by moving crypto off the Munitions List, and allowing export of printed material, they're also reducing their exposure to ridicule for not responding to Raph's T-shirt CJ request.... (huh-huh... made you say Unconstitutional ... huh-huh....) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

'Total Recall' Come True!
by John Young 17 Dec '03

17 Dec '03

Major Organizations Are Experimenting With Computer Chip Implants in Humans, According to EE Times Special Report Manhasset, N.Y., Feb. 4 -- The implantation of computer chips into humans and animals is now actively being funded, researched and experimented by major institutions such as Stanford University, British Telecom, the National Institute of Health (NIH) and major corporations, according to the first of a two-part special report published by EE Times (http://www.eet.com) Although the work is drawing fire from civil libertarians and conspiracy theorists, among others, many scientists and physicians defend the work for its potential to ease suffering. "It's 'Total Recall' come true! Our in-depth look into this state-of- the- art research reveals that the mix of electrical engineering and medical technologies to surgically implant computer chip-driven devices is here today -- a micro chip implant is simply one step beyond a pacemaker," said EE Times Internet Editor Larry Lange. According to the EE Times report, Mitsubishi Electric Corp. (Tokyo) recently developed a low-cost input device that can recognize human movement and convert it to commands for use in software applications. This device is expected to find its way into tools used by people with disabilities. On other fronts, the semiconductor research lab at Motorola Inc. is working on body-embedded electronic blood-sensors that may one day allow diabetics to measure their blood sugar levels without ever drawing a drop of blood. The special report, appearing in next week issue in print and online, looks at additional areas of research and the differing reactions to it. -----

1 0

OECD Waffles
by John Young 17 Dec '03

17 Dec '03

2-4-97. Reuters: Global group fails to endorse Clinton encryption plan Washington: An influential economic research group is preparing guidelines on computer encryption for its member countries but will duck some of the most contentious issues involved, according to a draft obtained by Reuters. The Clinton administration, seeking to rally support for its controversial policy on exporting encryption products -- which encode and decode e-mail and other computerized messages -- failed to win an endorsement from the Organisation for Economic Cooperation and Development (OECD), although the group did discuss the administration's approach. On perhaps the most difficult issue, the draft guidelines do not favour or oppose a requirement in the U.S. policy that data-scrambling encryption programmes provide a way for law enforcement officials to obtain keys to crack the codes when necessary. After indicating that governments should carefully weigh the costs and benefits of imposing so-called key recovery, the draft report said, "this principle should not be interpreted as implying that governments should, or should not, initiate legislation that would allow lawful access." On all the controversial areas in the draft, "the member countries of the OECD have strongly held views but they don't always coincide," John Dryden, head of the group's Information, Computer and Communications Policy division, said in a telephone interview from Paris. Some countries see widespread use of encryption as a way to protect the privacy of computer users and businesses, thereby encouraging global commerce, Dryden said. But others see encryption as possibly thwarting law enforcement's efforts to catch riminals and global terrorists, he said. The guidelines suggest encryption users should have access to products that meet their needs. Government controls should be "no more than are essential to the discharge of government responsibilities." Instead of reconciling the different views, the draft guidelines lay out competing interests and approaches. "It's not in itself a cryptography policy and it's not an attempt to draft a model national law that we're encouraging people to adopt," Dryden said. Cryptography refers to products and systems used in encryption. The guidelines also suggest encryption standards and usage should be "determined by the market in an open and competitive environment." "There's a strong view that the private sector should have the possibility to use information networks to the best of their potential in order to create growth and jobs," Dryden said. U.S. officials who have seen the preliminary draft praised the guidelines. "They're an important and helpful step forward," Undersecretary of Commerce William Reinsch said. "They're helpful because they put down on paper the proper foundation for getting into this," he added. Reinsch said most countries will follow the U.S. lead and require so-called key recovery features for law enforcement. Under the Clinton policy, domestic use of encryption is not regulated but the strongest coding products cannot be exported unless they include key recovery. U.S. companies that have opposed the Clinton policy, contending it stifles their ability to compete with unfettered foreign firms, drew little solace from the draft guidelines. "This is not helpful," said Netscape Communications Corp.'s public policy counsel, Peter Harter. Netscape and other companies preferred stronger language endorsing free-market policies, he said. The draft guidelines, approved by a group of government and private-sector experts at a meeting at the end of January, still must be approved by a top-level OECD officials from the group's 29 member countries, including the United States. -----

2 1

Re: Silly Americans
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:37 PM 2/4/97 -0500, Rick Osborne wrote: >The original poster was talking about the UniSys GIF >patent, and this was the reply: > >>Broaden your view. I can do anything I want with the GIF format >>without asking _anyone_, and so can almost everyone in the world - >> except those poor americans who chose to live under a "broken" >>patent law which allows protecting _algorithms_. Totally silly. Not true, of course - other countries also have broken patent laws that permit patenting algorithms. For instance, IDEA is patented in places besides the US. The differences in the US are that perhaps our patent people became stupid earlier, and that US patent law allows you to apply for a patent up to one year after publishing, while European patent laws don't let you patent anything that's been disclosed to the public. >a philosophical note, why *do* we allow the government to regulate >algorithms? (Implementations, I can understand, but *algorithms*?) Because they're bigger than we are and better-armed? Because there's lots of money to be made by people patenting things? Because big companies can use it to interfere with competition? Because it's good for the economy because it encourages inventors of algorithms to publish them and make money by doing so? (I'll take the first three of those arguments :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My letter to Long Island Newsday regarding David Kahn's pro-GAK editorial was published today. You can read it at http://www.newsday.com/mainnews/rnmi052u.htm What's odd (?) is how they editied it. I directed my comments toward Mr. Kahn's views, which they changed to "Newsday" (odd, since I've never seen them print an editorial one way or another on GAK; does this mean they are taking a stand? -- Kahn is an editor at Newsday). I wrote "The greatest flaw in the argument is it's very reason, 'criminals... are increasingly using encryption to conceal their plans and activities'" which they changed to "It reports...". I never considered an op-ed piece as "reporting", even if it states a fact. The following paragraph There are also a variety of technical problems associated with escrowing encryption keys, mainly, how to do so securely? A single `backdoor key' (or set of keys) for a popular product can become an easy target for crackers who can jeopardize the security of an entire system. Software can be easily hacked to disable or damage the key escrow features, and there are techniques to hide even the presence of a message in something innocuous as a digitized image. (Mr. Kahn seems to have forgotten to mention that the FBI not only wants to overhear cellular phone conversations but also read E-mail and any other encrypted files people have.) was changed to just There are also several technical problems associated with escrowing encryption keys, mainly, how to do so securely. They did leave the last two paragraphs relatively intact, though. Yeah, yeah... the piece could have been much longer & detailed, but it's only a letter to the editor... - --Rob -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvhdzgTNlSxdPy6ZAQEw8Qf9FnDSSd/m+XwUxU1CCJnwVOrvS4qyIubX 2E18o2rrS+F8TDjkhVsaDR3lJNqikdOzAL2GfjX53/cBEOhYcYcip7IHkd8UxqY6 zDHp2LwWnSuF8wwxeKw/DyPhAURsxYAl+LCJbsJjK+zxpgPU1Z0YzFkj3Am6bscv t8qiPoTxUF3tusueT5I3xQsRgEAx1SNwRHgQGzLS+zPwdFBT9ZsIsp4EbZ0fx1cE ZpbIxu1koDCWhkmJdTiL5HXXJ6mROJvCIGHfr1NU099AlIOO/FXq2UTnti2TzQn7 wYF73490ru1AFMEViLipj3zXzJsIGBo32La37yDozBEItd32B0L/+w== =3wRg -----END PGP SIGNATURE----- ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

NFIC Warning About Sexygirls web site
by Robert Hettinga 17 Dec '03

17 Dec '03

I had to laugh when I read this... Cheers, Bob Hettinga --- begin forwarded text X-Sender: themet(a)pop.mindspring.com Mime-Version: 1.0 Date: Wed, 5 Feb 1997 01:50:36 -0800 To: fraudnews(a)silverquick.com From: Mark Taylor <themet(a)mindspring.com> Subject: NFIC Warning About Sexygirls web site Reply to: Mark Taylor <themet(a)mindspring.com> Here is an interesting twist on how some crafty scamsters can rack up money on your phone bill =========== National Fraud Information Center Monday, February 4, 1997 PORNO SURPRISE Consumers who visited a pornographic website (www.sexygirls.com) last month got a big surprise on their phone bills. After a few teaser pictures, surfer was told he/she needed to download a special program to view the archived images. That program was actually a viewer with an entire communications suite hidden deep inside (a non-self propogating Trojan Horse). The program disconnected user from his/her ISPs, shut off the volume on the modem if it was computer controlled, and dialed a number in Moldova -- a small, former republic of the Soviet Union wedged in between the Ukraine and Romania. All the while the consumer was on the website, and even if he/she then browsed other sites on the World Wide Web, the Internet access was being provided through the Moldova number, resulting in huge international phone charges! Consumers didn't know that until their phone bills arrived. According to the Toronto Star Business Reporter, there are Canadian reports of bills into the thousands. The Toronto star also reports that the Royal Canadian Mounted Police has requested all calls from Canada to that number in Moldova be blocked. Bell Canada is attempting to provide relief for Canadian consumers. US consumers should contact their long distance providers if they find these unexpected charges on their bill. The RCMP has also required the owners of sexygirls.com to place a disclaimer on the site, alerting consumers to the presence of the communications software in the viewer. The disclaimer also tells consumers how to disconnect if they do not wish to use the server in Moldava. In November, Internet Fraud Watch warned consumers concerning the possible dangers of downloading programs over the Internet. Some tips: Don't download unnecessary items. If it's just a piece of razzle-dazzle, don't bother. It will only take up space on your hard drive and perform no useful function. If there's no gain for you from the program, there's no reason to take a risk. Only download from sites you know and trust. While even a major corporations site can sometimes have a viral infection, a lone programmer might be using an attractive piece of code as a delivery vehicle for his pet virus. Don't download material directly onto a computer network at work. First download it onto a stand alone PC. Test it out. Make sure it doesn't have any malicious side-effects. Check that machine for known viruses. Only at that point should you install the downloaded program on a networked machine. If you feel you must download files, keep track of what files you have on your system and what files are created during a program installation. That way you can easily uninstall any program if you find it to be undesirable. This also helps in detecting new installed files that aren't supposed to be there. Remember, your main worry is an executable file (i.e. a program or application). Despite what you hear all over the Internet, you cannot get a virus from a piece of e-mail. If you are having a problem with calls to Moldova, the connection will only be made if you attempt to use the viewer. If you try to use the viewer, shut down your machine after you are finished at that site. If you wish to remove the viewer altogether, the file name is david.exe (for IBM users). If you are in Windows, it should be in your program folder. FraudNews is owned and published by : Mark Taylor: themet(a)mindspring.com All material published is copyright.It must not be reproduced in any form without the express permission of of the owner. ============================================================= This Newsletter is broadcast using the List and Newsletter Management facilities of Silverquick Communications You may subscribe to FraudNews and the Fraud-Discuss lists on the web pages at : http://www.silverquick.com ============================================================= --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: BA Crypto Machine Photos
by doelke＠rockdal.aud.alcatel.com 17 Dec '03

17 Dec '03

> > >BTW, does anyone know the meaning of 'order wire mode' in the context of a > >crypto broadcast? This mode is found in the KWR-37 online crypto > >receiver. Please send all photo requests or responses via private E-mail. > > If it means the same thing as in the telecom industry, its an out-of-band > (often analof) channel between two locations connected by wide-band (e.g., > T1) facilities. Its primary purpose is to provide service personnel, at > each end point, the ability to converse with one another while performing > work on that link. > I would also guess it might be something similar to the orderwire in the telecom industry. I am more familiar with digital orderwire systems, but orderwires are generally all similar. You have a communications link, and some overhead on that link is dedicated to providing a voice channel for communications between sites so that people working on the line can communicate with each other. In a crypto system - I could see that the orderwire might be a in-the-clear transmission as part of the overhead so that people at each end of a hop can figure out why the data (i.e. encrypted) portion isn't getting through. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0