December 2003 - cypherpunks-legacy

RE: rant on the morality of confidentiality (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Note that any errors in transcription are mine, I had to re-edit this to get it to fit on a 80 column screen. Forwarded message: > From: Wayne Radinsky <waynerad(a)oz.net> > Subject: RE: rant on the morality of confidentiality > Date: Wed, 14 Jan 1998 20:32:15 -0800 > The reason morality is impossible to nail down is because it does not exist > al all in any absolute sense, Morality is an individuals or societal groups beliefs of right and wrong. Of course there is no more absolute right morality than there is a right flavor of ice cream, this entire line of reasoning is a non sequitar. Ethics is the issues of what is correct or permissible in relation to a particular human activity such as scientific research or law. When you use 'science' and 'morality' in a comparison you are in actuality comparing apples and oranges. Science is related to *how* one does a particular activity, it is not concerned in the least with *why* that activity should (not) be done in the first place. Science and its philosophy are *not* applicable to all areas of human discourse anymore than the Bible is applicable as a methodology to study quantum physics or aerodynamics. > at least as far as science is concerned. Science isn't concerned with right, wrong, morality, etc. It *is* concerned with a systematic way to ask questions in a *specific* area of discourse. To apply science to religion is as much a disservice to science and religion as it would be to try to apply it to art. > According to the principle of natural selection, all people, including > scientists, exist purely to maximize their own inclusive genetic fitness. Exactly whose theory or principle of natural selection? At the current time I am aware of several different theories that fit the data but which in many aspects are mutualy exclusive. This is entirely too broad a statement to have reasonable merit. We simply don't know enough about what is going on with the processes of life to justify this sort of leap. > Keep in mind that all natural selection really does is decide which genes > are allowed to propagate, Natural selection isn't doing anything. It is a term we apply to a process we observe occurring. That process seems to occur at several levels besides just the genes. > and since genes are just digital information stored on DNA molecules I'm afraid it's a bit more complicated than that. We start with the base pairs, which really are informationaly isolated from the codons which are triplets of base pairs which form a 'word' in the genetic code. It is of some import to realize that the genetic code itself is *not* dependant on the actual mechanism of expression, in other words you can talk about the genetic langauge without any reference to the base pairs themselves. It is the codons that are important. There is a fundamental symmetry break at that level. Each of the codons is mapped to one of 20 amino acids. Since there are 4 bases arranged in 3's there are 64 combinations. This means that for any particular amino acid there is more than one way to code it. There are also several 'stop' codes which break the transcription process as well. >, what we call "life" is really just a complex > interaction of matter/energy which determines which bits of information > continue to exist over time. That works equaly well as a definition of the cosmos. Keep this up and you'll become a pantheist...;) > The underlying reason people benefit by promoting themselves as moral > people, in general, is because of the benefit of what evolutionary > psychologists call reciprocal altruism. With reciprocal altruism, both > parties benefit if they are in a non-zero-sum situation. Because most > situations are non-zero-sum and the benefits are so great, everyone has > a stake in promoting themselves as a good reciprocal altruist, in other > words, a good, trustworthy, moral person. This is how natural selection > explains the existence of the concept of "morality". Oh boy... Not all moralities or religions accept the premise of altruistic behaviour. Further, if you look at the prisoners game, you actualy accrue more from intermittent moral behaviour than from consistent moral behaviour. Human morality has no place in any consistent theory of natural selection that I have ever seen. Please explain how a moral theory as you propose will increase the participants likelyhood for reproduction? Further, if you look at primate research (both non-human and human) what you find is a tendency for promiscuity in both sexes. Males tend to be 'in heat' at all times while females (at least when they are just entering the mating group) tend to follow a estrus or lunar based cycle. Recent studies of primates in Africa have found that the previous theory that band members don't intermingle is actualy incorrect. Upon extended monitoring they find that when the females go into heat each month they sneak off and mate with outlying members of other bands (who are usualy un-paired males). They intentionaly hide this activity from their band mates because if caught they will face a physical assault and potentialy death. This raises the question of whether chimps have morality under your view because it is clearly a measure of right and wrong. Are you willing to give chimps some sort of equal status to humans as a result? Studies of human females find this same sort of behaviour in the young just entering the mating pool. Studies find that young women tend to wear more provocative clothing and explore non-familiar peer groups in relation to their menstrual cycle. > So it is a myth that scientists live to find deep truths or to benefit > humanity. Absolutely, unfortunately the fallicy with such an assertion have nothing to do with the reasons you expound. > They may do those things, but their real goal is maximizing their own > inclusive fitness. So being a scientist increases ones probability for mating? Please be so kind as to offer some proof. Do scientist tend to have more offspring than non-scientist? I think you will find that the actual studies show that the more intelligent and well educated tend to have *fewer* children. This would seem to run contrary to your hypothesis. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Ryan Lackey 17 Dec '03

17 Dec '03

> man in the middle attack on people signing code How would you do this? There is code. You sign that code with your personal pgp key, which you are assumed to keep secure. Cases: A) The code is authentic, but backdoored: you will look at it when verifying it and refuse to sign it, optionally posting how it is flawed to the world. B) The code is not the actual code used in the product, but unbackdoored: In this case, you sign it, but when someone tries to compile, the real code is not signed, and thus the attacker is no better off. C) The code is not the actual code used in the product, and is backdoored: The NSA is really stupid, then. D) The code is the authentic code, and is unbackdoored: you win. The only attacks would be if you could sneak a bug by the verifiers. With modern execution environments, it is *possible* there could be unintended consequences to almost anything. That's why I think one of the first pieces of code verified should be the JVM. Another attack would be having 5 NSA agents sign a piece of code, but you could prevent that by having the list made up of distinct well known individuals who are unlikely to all be bought -- if the NSA wants to give $100m each to the most frequent 100 posters on cypherpunks, I want to get in line :) -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Sorry Ryan, I'll need more context to answer this one. Would it be too much to ask for more than a fragment of one sentence...:( Forwarded message: > Subject: Re: how to release code if the programmer is a target for coercion (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 15 Jan 1998 01:41:01 -0500 > > man in the middle attack on people signing code > > How would you do this? There is code. You sign that code with your personal > pgp key, which you are assumed to keep secure. Cases: I've probably sent out somewhere in the neighborhood of 40+ messages in the last two days, several have related to signing documents in different contexts. I don't recognize this particular fragment. Sorry, I don't memorize my traffic nor do I keep archives of it and I'm way to lazy to go searching the cypherpunks archives at 2am. I'm assuming this has something to do with the eternity server/black_net discussion that has been going on. So I'll take a stab at it, not that it may make any sense in the actual context ... - You generate the code and sign it - You deliver the signed code to a data haven server of some architecture (note that you don't know where it is or who runs it, I'll assume you use some particular usenet newsgroup as your drop point) - Somebody else comes along and sees a list of available items and selects yours (again through a usenet based request mechanism). - They receive the code signed with 'your' key and decide they want to verify the signing (through yet another usenet channel). The problem with this model is in the second step. What is to keep them from removing your signatory, moding the code, and then resigning it. If the recipient desides they want to check the sign they have two choices: - select an anonymous key that has been previously stored on some sort of key server. (if they are running a eternity server blind they could be running a key server blind as well, it follows that at least some of the users of your software wanting to verify the signing will go to this server and hence have corrupted code, if we're using the usenet model this is even more likely since they could be running a feed point for other usenet feeds downstream and hence capture many if not all requests for the product, especialy if they were the only server to actualy carry a copy.) - contact you the author directly (I'm assuming of course you were silly enough to put a publicly available key directly traceable to yourself on it in the first place) in which case they simply intercede from a upstream tap and verify their request in your behalf. In either case there is no guarantee that what comes off the server is what you the source put on there. Hence the long term security of the key is compromised. In particular, in the second case, since they already know who provided the illicit data to the server there motive is clearly to track the users. This breaks the anonymity of the data haven. Implicit in a workable data haven model is the goal of both source and sink anonymity. This means that any signed data on the server must provide a mechanism for the user to verify the sign by access to a suitable key to generate the appropriate hash and compare it to the one that the server delivered. If they match you should have the correct unadulterated document. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

BAY AREA CYPHERPUNKS MEETING, SATURDAY 1/17, OAKLAND
by Bill Stewart 17 Dec '03

17 Dec '03

The January Bay Area Cypherpunks Meeting will be Saturday afternoon at C2 Software's office in Oakland. Agenda: Export Laws - Lee Tien and Greg Broiles Work in Progress Lots of discussion from RSA Conference. Time: 12-6pm followed by dinner - program starts at 1:00 Location: C2Net Software, Inc. 1440 Broadway Suite 700, Oakland, CA Phone: (510) 986-8770 Fax: (510) 986-8777 Public Transportation - about two blocks from the 12th St BART station. This is the best way to get there from San Francisco, and parking for BART trains is easy. :-) Driving - From South - take 880N to Broadway exit, about .9 mile, park From San Francisco - Take the Bay Bridge to Grand Ave, turn right on Telegraph and continue on Broadway. Map URL: http://www.mapblast.com/yt.hm?FAM=mapblast&CMD=GEO&SEC=find&IC=0%3A0%3A5&IC… Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Ryan Lackey 17 Dec '03

17 Dec '03

Jim Choate writes: > more than a fragment of one sentence...:( > I'm assuming this has something to do with the eternity server/black_net > discussion that has been going on. So I'll take a stab at it, not that it > may make any sense in the actual context ... Yes, you guessed right :) > > - You generate the code and sign it > > - You deliver the signed code to a data haven server of some architecture > (note that you don't know where it is or who runs it, I'll assume you > use some particular usenet newsgroup as your drop point) > > - Somebody else comes along and sees a list of available items and selects > yours (again through a usenet based request mechanism). > > - They receive the code signed with 'your' key and decide they want to > verify the signing (through yet another usenet channel). > > The problem with this model is in the second step. What is to keep them > from removing your signatory, moding the code, and then resigning it. If the > recipient desides they want to check the sign they have two choices: The problem reduces to one of distribution of public keys. In my model (er, actually Lenny Foner's model, in this case), you distribute something that has intrinsic verifiability -- the eternity source. So whether or not rdl's eternity-dds signing key is compromised is irrelevant to the users -- in fact, the assumption is that since I am a known target, I've been killed or compromised. So, there's this potentially untrusted code out there. People who have known public keys then inspect and sign the code. It is assumed these people have distributed their public keys far and wide, signed by lots of people, etc. As long as you can assume the "PGP web of trust", the distributed software signing thing works. I agree that the current state of PGP use is probably not enough for the "PGP web of trust" -- I've *never* used a key and found it signed by anyone I know. However, I think even the current system puts a pretty high barrier to fraud, and if there started to be fraud, people would start signing each other's keys. A keyserver serving keys like "rdl's eternity-dds release signing key" might be subject to traffic analysis, true. However, as you suggest, you could put the keyserver inside Eternity. Then, the problem just gets shifted -- now you need (a) pgp signing key(s) which has/have signed all of those keys. I think it is unreasonable to think merely signing a key (and distributing your own personal key securely) will be a felony before anything has been done with that key. More to the point, I think it is unreasonable to think the government will go after people purely for signing the source code to a piece of software -- signing does not imply you use it, does not imply that you wrote it, does not imply anything other than that you've looked at it, verified it, and signed it. The government would do just as well to track down the posters to cypherpunks and kill them. -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

1 0

BXA Wassenaar Rule
by John Young 17 Dec '03

17 Dec '03

BXA published today its interim rule for implementing the Wassenaar Arrangement: http://jya.com/bxa-wa-rule.txt (354K) Or compressed, self-extracting Zip: http://jya.com/bxa-wa-rule.exe (80K) ---------- Federal Register, 15 January 1998 [Excerpt] [[Page 2452]] Bureau of Export Administration _______________________________________________________________________ 15 CFR Parts 732, 740, 742, 743, 744, 746, 762, and 774 Implementation of the Wassenaar Arrangement List of Dual-Use Items: Revisions to the Commerce Control List and Reporting Under the Wassenaar Arrangement; Rule DEPARTMENT OF COMMERCE Bureau of Export Administration 15 CFR Parts 732, 740, 742, 743, 744, 746, 762, and 774 [Docket No. 971006239-7239-01] RIN 0694-AB35 Implementation of the Wassenaar Arrangement List of Dual-Use Items: Revisions to the Commerce Control List and Reporting Under the Wassenaar Arrangement AGENCY: Bureau of Export Administration, Commerce. ACTION: Interim rule with request for comments. ----------------------------------------------------------------------- SUMMARY: Representatives of thirty-three countries gave final approval July 12-13, 1996 in Vienna, Austria to establish the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. The thirty-three countries agreed to control all items in the List of Dual-Use Goods and Technologies with the objective of preventing unauthorized transfers. They further agreed on a target date of November 1, 1996, for implementation of the Wassenaar Lists. The purpose of this interim rule is to make the changes to the Commerce Control List necessary to implement the Wassenaar List. In addition, this interim rule imposes new reporting requirements on persons that export certain items controlled under the Wassenaar Arrangement to non-member countries in order to fulfill the information exchange requirements of the Wassenaar Arrangement. The Department of Commerce, with other concerned agencies, is reviewing the Export Administration Regulations to determine whether further changes will be required to implement the information sharing provisions of the Wassenaar Arrangement and to make the necessary adjustments to existing country groups. This rule also revises part 740 of the EAR by removing License Exception availability for certain items controlled for missile technology reasons. Although the Export Administration Act (EAA) expired on August 20, 1994, the President invoked the International Emergency Economic Powers Act and continued in effect, to the extent permitted by law, the provisions of the EAA and the EAR in Executive Order 12924 of August 19, 1994, as extended by the President's notices of August 15, 1995, August 14, 1996 and August 15, 1997. DATES: This rule is effective January 15, 1998. Comments on this rule must be received on or before February 17, 1998. ADDRESSES: Written comments should be sent to Patricia Muldonian, Regulatory Policy Division, Bureau of Export Administration, Department of Commerce, P.O. Box 273, Washington, DC 20044. FOR FURTHER INFORMATION CONTACT: James Lewis, Director, Office of Strategic Trade and Foreign Policy Controls, Bureau of Export Administration, Telephone: (202) 482-0092.

1 0

Sealand (was Re: (eternity) autonomous agents)
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Lucky Green wrote: >Sealand, about which I wrote about on this list before, was an example >that should be studied by the offshore advocates. Based in an old >oilrig housing platform, Victorian sea-fort, AFAIR. >some unlucky investors attempted to establish >their own country. They began issuing stamps and passports for their >"country". As any reasonable person should have expected, nobody would >move their mail and nobody recognized their passports. Which wasn't the point; the majority of those they sold were just for fun, not serious attempts at being recognized. However, I noticed a newspaper article over Christmas about a woman who's selling professional-looking passports in the names of countries which no longer exist or changed names; the intention, presumably, being that immigration officials won't realise that the passports aren't real. >They went bankrupt. I'd be interested to know where you got your information from, because both Strauss ('How to start your own country') and the Micronations Web page tell different stories; that Sealand was set up mostly for fun by a couple of guys who made a lot of money from pirate radio and it lasted at least fifteen years. Of course this doesn't detract from the main point, which is that you won't get away with offshore data-havens unless you are able to defend them against invaders; Strauss claims Sealand was invaded by some German businessmen at one point, and any such data-haven will soon be visited by cops or warships. Mark

2 1

AT&T Database Reveals Unlisted Names From Numbers
by Robert Hettinga 17 Dec '03

17 Dec '03

Yet another reason for cash settled IP telephony? Actually, you can trace an IP address just as well, can't you?... Cheers, Bob Hettinga --- begin forwarded text Resent-Date: Wed, 14 Jan 1998 19:06:14 -0800 (PST) X-Authentication-Warning: weber.ucsd.edu: procmail set sender to rre-request(a)weber.ucsd.edu using -f X-Authentication-Warning: weber.ucsd.edu: Processed from queue /usr/spool/mqueue/rqueue Date: Wed, 14 Jan 1998 18:58:10 -0800 (PST) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: AT&T Database Reveals Unlisted Names From Numbers Resent-From: rre(a)weber.ucsd.edu Reply-To: rre-maintainers(a)weber.ucsd.edu X-URL: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: <rre(a)weber.ucsd.edu> archive/latest/1803 X-Loop: rre(a)weber.ucsd.edu Precedence: list Resent-Sender: rre-request(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 14 Jan 98 12:38 PST From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V07 #02 PRIVACY Forum Digest Wednesday, 14 January 1998 Volume 07 : Issue 02 ---------------------------------------------------------------------- Date: Tue, 13 Jan 98 10:05 PST From: lauren(a)vortex.com (Lauren Weinstein; PRIVACY Forum Moderator) Subject: AT&T Database Reveals Unlisted Names From Numbers Greetings. In a memorable scene from the 1975 film "Three Days of the Condor," CIA agent-on-the-run Joe Turner, played by Robert Redford, monitors a phone line with a telephone test set (known in telco parlance as a "butt set" or more popularly a "butt-in"). After taping and determining the touch- tone digits being dialed, he makes a call to an "operator" who provides the name and address of the party associated with that dialed number. His exchange with that operator was completely authentic. For decades telephone companies have operated "Customer Name and Address" bureaus, known colloquially as "CNA" bureaus. Presented with a phone number, the CNA operators provide name and address data, even for unlisted or non-published numbers. This service was and is ostensibly only for telephone company use. The telcos rightly considered this information sensitive, and CNA access numbers were always subject to frequent changing, but still leaked out. They were highly coveted by private detectives, phone phreaks, and others, for various investigative or even harassing purposes (few things can upset a person who thinks they have an unlisted number more than a bizarre call from an unknown person in the dead of night who knows their name...) Over the years, telephone subscribers have become more aware of the various commercial and other purposes to which their telephone listings have been subjected, and increasing percentages of folks have unlisted ("non-published" or "non-pub") numbers. In states like California, the majority of numbers are non-pub. Telephone company literature usually states that a non-pub status (for which subscribers now typically have to pay an extra monthly fee) also protects them from so-called "upside-down" listings and services--essentially published versions of CNA that provide listings in telephone number and/or house address order. Clearly the telcos realize that people are still very sensitive about their names and/or addresses being looked up by number. So it was with considerable concern late last year when I learned of an easily accessible AT&T database that provides a major portion of CNA--the provision of names from numbers, even for unlisted or non-published numbers. I have been engaged in a dialogue with various AT&T officials concerning this database since then. Getting an official response has taken some time (the holidays didn't help of course), and I've been told that I'm the first person to ever bring this issue to their attention (a familiar enough refrain when it comes to privacy issues...) The database in question is a "service" (which AT&T says is greatly appreciated by their customers) which ostensibly exists to allow automated access to number information by business customers. AT&T long distance business customers, upon calling their designated customer service number from their bills, enter a typical complex voice mail maze. After entering their main AT&T account number into the system, one of the choices available relates to "if you do not recognize a number on your bill." Choosing this option drops the user into an automated system which allows the direct entering of phone numbers. For each number entered, the system then attempts to read out (using a voice synthesizer) the name associated with that number. An option is also available to spell out the name, since text-to-speech handling of proper names can be less than optimal (remind me to tell the story of my "Touch-Tone Unix" synthesizer system from the '70's someday). The number entry/readout sequence can be repeated (apparently) as many times as desired. The need for a customer to find out who is associated with a truly unknown number on their bill can be a real one. Unfortunately, this database has a variety of negative characteristics: -- The database does not limit lookups to numbers actually on the customer's bill! Any numbers can be entered, and the system will usually provide the associated name, even if they are not on the current (or any) bill. Presence or absence from the bill is totally irrelevant. -- The database provides data for unlisted or non-published numbers just as happily as for listed numbers. This includes corporate internal numbers, modem and fax lines, residential second lines, and so on. -- For listed numbers, the database sometimes provides not the name associated with the listing, but rather the name of the *person* who is apparently the "billing contact" for the listed entity and usually has nothing whatever to do with the listing itself! To quote from the official response I received from the AT&T media relations representative with whom I have been in contact about these concerns: "As a matter of policy, AT&T safeguards customer information from unauthorized access. It is also our policy to allow business customers to access their account-billing records to check the accuracy of their records and to request changes, as necessary, by using an automated system. Until now, questions such as yours have never come up, so we want to thank you very much for bringing your concerns to our attention. ... The system has been in use for several years and, in our search for ways to improve the accuracy, timeliness and cost- effectiveness of the services we offer customers, we had already begun evaluating a number of options. Your inquiry has hastened our considerations of new ways to offer capabilities that our business customers value while safeguarding private customer information from unauthorized access. So, again, we thank you for bringing this issue to our attention." What this really means in terms of actual changes is decidedly unclear. No date is specified for any alterations, nor have they explained in any manner what sorts of customer privacy changes (if any) will be made, nor how any new system might differ from the current one. In the meantime, I have been told that they do not intend to alter the operations of the current database in any manner. I have suggested suspending or limiting the current system as a clear move to help protect telephone subscribers' privacy. AT&T has chosen not to do so. They point out that the database is not "intended" for other than the lookup of unknown numbers on the bills, and that they consider any other use to be improper. However, such improper uses will continue to be completely possible under the current system. My overall impression is that AT&T feels people aren't concerned about number to name lookups, and that AT&T doesn't see what harm such information could do in any case. This sort of "What harm could it do?" attitude is one that PRIVACY Forum readers have seen repeatedly with commercial databases of various sorts. It of course is important that persons make their feelings about such issues known once they come to light. If people don't bother to complain, faulting the commercial database policies themselves becomes considerably more problematical. Others may agree, or perhaps disagree, with AT&T's apparent attitudes about this matter. It seems likely that more persons expressing their opinion, either positive or negative about the system, would be useful to AT&T in helping to gauge public feelings about such matters. AT&T has told me specifically that the appropriate venue for such opinions would be AT&T Executive Resolution, at (908) 221-4191 (8-5 PM Eastern--I'm told that collect calls are accepted during those business hours). All too often, we see that the implementation of potentially useful services is done in a manner that produces undesirable (and often unintended) negative privacy side-effects. A key issue is to what extent an entity responds to privacy concerns, even when they might not agree with them, after they've been made aware of the issues. So far, I'm afraid that AT&T's response to this situation has not been stellar. --Lauren-- Lauren Weinstein Moderator, PRIVACY Forum http://www.vortex.com ------------------------------ End of PRIVACY Forum Digest 07.02 ************************ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Joe Bress
by bill payne 17 Dec '03

17 Dec '03

Thursday 1/15/98 6:54 AM Ray Sumser Arnold Intrater Jennifer Lipnick National Academy of Public Administration 955 L'Enfant Plaza, North SW Washington, DC 20074 202-651-8062 393-0993 FAX Former NAPA employee and lawyer Joe Bress' words, "Win or lose," to me spoke in your presence in ABQ caused some additional whistleblowing on Internet. A cypherpunk, I am guessing. I stayed off Internet for one year so as to be above suspicious. The attached letter to judge Edwards was mailed July 16, 1996. And received July 18, 1996. Moorer and other retired Navy brass, at a news conference, expressed grave suspicion over the FBI's recently concluded 18-month investigation of the disaster, in which the plane disintegrated July 17, 1996, en route to Paris and plunged into the Atlantic near Long Island, killing 230. They said a military missile explosion just outside the 747's forward cabin seems the likely cause. While the timing of my letter to Edwards was merely coincidence, I am concerned that whistleblowing may constitute a danger to public safety. Please help to get this matter settled. Thanks bill Title: Navy Brass Revive Missile Theory [Email Reply] Retired Navy Brass Revives Twa Missile Theory Officers Voice Suspicions Over Fbi's Findings By John Hanchette and Billy House Adm. Thomas H. Moorer, former chairman of the Joint Chiefs of Staff, on Jan. 8 called for new congressional hearings into last July's crash of TWA Flight 800. "It absolutely deserves more investigation -- a lot more," Moorer told Gannett News Service. "This time, I wouldn't let the FBI do it. I'd have the NTSB (National Transportation Safety Board) do it. I think Congress certainly should get more answers from the FBI." Moorer and other retired Navy brass, at a news conference, expressed grave suspicion over the FBI's recently concluded 18-month investigation of the disaster, in which the plane disintegrated July 17, 1996, en route to Paris and plunged into the Atlantic near Long Island, killing 230. They said a military missile explosion just outside the 747's forward cabin seems the likely cause. "All evidence would point to a missile," Moorer said. "All those witnesses who saw a streak that hit the airplane -- you have to assume it's a missile. In an investigation like this, you can't overlook anything." Moorer, an expert on missile weaponry, attended the news conference convened by a media critic group that scoffs at the official NTSB and FBI findings unveiled a month ago. Joseph Valiquette, FBI spokesman in New York, said the agency is "comfortable" with its conclusions that "there's no evidence a criminal act was responsible." 'A train wreck in the sky' The Navy officers -- who appeared with a veteran TWA pilot, two witnesses and members of Accuracy in Media, which coordinated the briefing -- said a new study of evidence from recovered Flight 800 data recorders rebuts the government's official story about fuel vapors exploding in a central tank of the jetliner after a spark from unknown causes. "This is either a train wreck in the sky, or an explosive device -- mid-air, outside the plane," said retired Navy Cmdr. William Donaldson, who flew 89 combat missions over Vietnam and for five years was a top Naval aviation accident investigator. Donaldson, who said he is not working for TWA or the passenger jet's manufacturer, Boeing, examined the mountain of material released in early December about the $100 million federal investigation. He particularly criticized one NTSB document reflecting flight-recorder data that was not discussed when the material was unveiled in Baltimore last month. Donaldson noted a line drawn through readings of the last five seconds of the doomed jet's flight, with a handwritten margin note reading "End of Flt. 800 DATA" -- except there are more revealing readings below it. He said he thinks this was an attempt to divert attention from the final readings on the flight recorder: "The only reason you put flight data recorders into an airplane at millions of dollars cost is to capture this last data line." He said NTSB officials later tried to convince the Navy dissidents it merely was transcript from an earlier flight -- a conclusion former TWA pilot Howard Mann said is "not possible -- it's erased -- there's just no way." The final readings show chaos in the sky -- with airspeed dropping instantly by almost 200 knots, the pitch angle jumping five degrees, altitude dropping 3,600 feet in about three seconds, the roll angle going from zero to 144 degrees (the plane almost inverted), and magnetic heading changing from 82 degrees to 163 degrees. The small vane that measures wind angle striking the nose -- situated on the left forward fuselage -- goes from 3 degrees to 106 degrees back to 30 degrees. Donaldson said all these indicate an extremely high-pressure wave coming from the lower left side of the plane's front. The measurements "indicate there was an explosion -- a big explosion -- outside the cockpit." Mann agreed with Donaldson's interpretations. Donaldson also said: * Divers found debris from the forward fuselage as much as 2,900 feet to the right of the extended flight path, suggesting it may have been propelled by an explosion from the plane's left. * Fuselage doors from near the front of the craft, later recovered, were bent and dented inward. * Subsequent tests Donaldson conducted showed fuel vapor in the empty center tank would not have been flammable enough to cause such an explosion, and there was nothing to ignite it. * More damage occurred to the left wing than the right. * The fuselage skin broke up in such a way as to suggest a pressure wave from the outside left front. "What you're looking at is the product of an explosion in the sky that totally destroyed the aircraft's ability to fly anywhere," he said. A digital animation computer rendering of the catastrophe -- prepared by the CIA for media use in early December -- sought to explain some of the physical forces on the flight data by showing the nose breaking off the huge aircraft and the body then climbing almost 3,000 feet before a huge petroleum explosion sends it fireballing into the sea. "There couldn't have been an aviator at CIA who had anything to do with that," said Donaldson. "They were laughed out of town by pilots." Eyewitness accounts Two witnesses from Long Island -- lawyer Frederick Meyer and furniture maker Richard Goss -- described what looked like a missile contrail rising upward in the sky before the TWA explosion. Goss said the FBI was interested and "very amazed," but later "there wasn't as much enthusiasm . . . I never heard from them again." Meyer, a helicopter pilot in Vietnam, was flying an Air National Guard helicopter on maneuvers when the disaster occurred in front of him: "I saw, what I swear to God, was military ordnance explode." Meyer said, "The aircraft I saw came out of the air like a stone. Nobody saw that aircraft climb a foot after it was hit. The CIA cartoon bears no similarity to what I saw." Meyer approached the FBI with his report, but said after two desultory interviews, agents never called back. He claims he knows several witnesses who called the FBI's 800 number with similar reports, but were not called back. The FBI, Donaldson said, "is holding the lid on 92 witnesses who allege they saw something go and climb to the sky. Most of those people are scared to death right now." Valiquette, the FBI spokesman, said, "We know there are always going to be people who will never accept our findings. And we're comfortable with that, too. . . . We went back and re-interviewed all those eyewitnesses. We plotted their positions, and there was a lot of analysis done. Today, we are comfortable with the results." The retired officers speculated a missile could have come from either a submarine or a buoy device developed by the Navy years ago to float attack missiles into position for launch from miles away. "One vital question we haven't attacked is the origin of that streak of light," Moorer said. "Where did it come from? Who fired it." For its part, the NTSB insisted after the briefing that "We have no physical evidence that a missile impacted TWA 800, or a fragment of a missile penetrated the aircraft." Navy Times, Jan. 19, 1998, Page 14 Posted here Jan. 15, 1998 Web Page: http://www.aci.net/kalliste/

1 0

Microsoft Metaphors
by Declan McCullagh 17 Dec '03

17 Dec '03

What are the best metaphors to use when talking about a browser and an operating system? Is the combination like a car and an engine, or a car and a roofrack? A pair of gloves? Or is it even useful to talk about a browser/OS metaphor in the case of Microsoft, since IE has been glued into the operating system in the form of .DLLs? Might that be more like the wheels of a car? -Declan

5 4

Microsoft Metaphors (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 15 Jan 1998 10:09:09 -0500 > From: Declan McCullagh <declan(a)well.com> > Subject: Microsoft Metaphors > What are the best metaphors to use when talking about a browser and an > operating system? Is the combination like a car and an engine, or a car and > a roofrack? A pair of gloves? It seem to me to be like a car and a road map. It simply lets you address the multiplicity of resources (ie destinations) out there in a convenient model. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Re: how to release code if the programmer is a target for coercion (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Ryan, Thanks for the clarification. I've added a few issues that have occured to myself and Doug Floyd (operator of the dh-l mailing list) during several short discussions we've had over the last year. Forwarded message: > Subject: Re: how to release code if the programmer is a target for coercion (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 15 Jan 1998 05:19:25 -0500 > The problem reduces to one of distribution of public keys. Agreed. > In my model > (er, actually Lenny Foner's model, in this case), you distribute something > that has intrinsic verifiability -- the eternity source. If I understand this you mean to use the code itself as the key? So you require all the eternity servers to use the same source? Doesn't this imply at some point a single point of distribution and hence another point of attack? > So whether > or not rdl's eternity-dds signing key is compromised is irrelevant to > the users -- in fact, the assumption is that since I am a known target, > I've been killed or compromised. So, there's this potentially untrusted > code out there. I am unclear as to what you mean by 'known target', are you refering to a particular eternity server, the eternity server code itself, the document the user is looking for, or the provider of the document? I suspect the provider of the document. Doesn't the fact that you can't address issues of key validity become an issue? How does this model handle key aging or do you propose to leave the same keys out there for extended periods of time (ie decades after your death)? Doesn't this extended lifetime represent a threat to the validity of the keys since it provides mallet an exceptional period of time in which to mount the attack? Especialy since nobody is checking the keys? It further seems to me that the main motive of most law enforcement is going to be going after the user of the data the majority of the time since this is much more time critical than knowing who provided the data. After all simply knowing who did the original sourcing is not enough to remove the problem after the fact. Eternity servers are after intended to be long lived mechanism, this provides the authorities much time to follow the data and analyze the network traffic. Wouldn't it be important to provide some sort of delivery mechanism that provides a full encryption envelope around the data until it is delivered to alice? I recognize this exacerbates instead of alleviates the key server security issues. > People who have known public keys then inspect and sign the code. It is > assumed these people have distributed their public keys far and wide, signed > by lots of people, etc. As long as you can assume the "PGP web of trust", > the distributed software signing thing works. Ah, ok. So we again are assuming everyone is using the same particular piece of technology. In this model, would it not add security to the mechanism to have the eternity server deliver the encryption software (ie PGP)? How does this model handle the physical contact that is required in the PGP web of trust? In particular how does it verify that the actual physical contact occured? Can you address the key distribution mechanism and how it addresses the issue of a mallet producing their own key server with their own keys signed sureptitiously by their own multiplicity of 'nyms? Do you see a group of 'Johny Appleseeds' roaming the country in person dropping little dolops of signed keys off? Or, do you believe some sort of key verification service will need to be generated that compares keys for individual 'nyms on the various servers and publishes a list of keys that don't match (something that would to my thinking be prime data for a data haven server). Doesn't such a 'trusted' service have the same sort of 'user end' threats as the eternity servers themselves? Assume for a moment that mallet wants to monitor a particular alice. Alice makes her request which goes through mallets tap. Outbound traffic is uneffected so that the actual keys sent to the server are good. However, no the return stroke mallet intercept the traffic, provides their own bogus keys and signed document. How do you see alice finding a way to recognize this? The threat with this model is that alice might be turned and therefore condemn any co-participants in whatever activity alice is supposed to be involved in (eg ingesting lettuce or leading a freedom cell in Burma)? > I agree that the current state of PGP use is probably not enough for > the "PGP web of trust" -- I've *never* used a key and found it signed by > anyone I know. However, I think even the current system puts a pretty high > barrier to fraud, and if there started to be fraud, people would start > signing each other's keys. I agree with all the points but the last. When the cost becomes too high (ie inconvenient) they simply won't use it. I just can't seem to grasp why people would spend even more money (which would provide a flag via monitoring of funds) to physicaly meet a group of others who they probably don't know and therefore probably shouldn't trust at such a fundamental level. > A keyserver serving keys like "rdl's eternity-dds release signing key" might > be subject to traffic analysis, true. However, as you suggest, you could > put the keyserver inside Eternity. Then, the problem just gets shifted -- now > you need (a) pgp signing key(s) which has/have signed all of those keys. I believe it is a fundamental mistake to have the key server inside the eternity server, just as I object to anonymous remailers that provide such service. The key servers should be on different machines to provide physical independance & legal indipendance - these are long lived keys after all and there is no reason architecturaly to put the keys at threat if the data haven is at threat, and finaly technological indipendance - it should not require a upgrade of the eternity software (and visa versa) to upgrade the key server software. Another issue that was raised previously, neither I nor anyone else addressed it at the time, is this acceptance of latency of distribution. Since we are talking about providing potentialy damaging documents (to who is intentionaly left vague) doesn't this latency provide opportunities for attack? Unlike a remailer network where it defeats traffic analysis in the data haven model it seems like a perfect means to get the processing window to actualy mount a trace. Anyway, since I am still about 3-6 months from actualy implimenting any of my own Plan 9 based (network level anonymity) model this is all conjecture. Hope it provides at least a seed for something useful. Ta ta. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FW: IRS/Co$ Secret Agreement web page (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-----Original Message----- Subject: IRS/Co$ Secret Agreement web page http://www.primenet.com/~cultxpt/irs-cos.htm The IRS gave the Church of Scientology a sweetheart deal on October 1 1993, granting it privileges that no other tax exempt organization gets. The above web page includes the Secret Agreement, IRS tax code portions at issue, US Supreme Court ruling that the Secret Agreement violates, and other important information. I update it almost daily.

1 0

FBI to search school shooters computer [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > SUSPECTED HIGH SCHOOL GUNMAN TO MAKE COURT APPEARANCE > > FBI will search his computer for evidence of motive > > January 15, 1998 > Web posted at: 9:36 a.m. EST (1436 GMT) > > PADUCAH, Kentucky (CNN) -- The teen-age suspect in last month's > Kentucky school shooting was scheduled to make his first public > court appearance Thursday morning, as the FBI announced plans to > search the contents of his personal computer. > > Michael Carneal, 14, is accused of opening fire on an informal > prayer group in the lobby of Heath High School, where he was a > freshman. Three students were killed and five wounded in the > December 1 attack. > > Carneal was indicted as an adult on three counts of murder, five > counts of attempted murder, and one count of burglary. The > commonwealth's prosecutor has said he'll pursue the maximum penalty > of life in prison, which would mean Carneal, if convicted, would > have to serve 25 years before he could be considered for parole. > > In a search for a possible motive into the deadly shootings, the FBI > has agreed to search the contents of Carneal's personal computer. > Lobby Heath High School lobby where the shooting occurred ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

re: Microsoft Metaphors
by Thomas Porter 17 Dec '03

17 Dec '03

On Thu, Jan 15, 1998 at 10:09:09AM -0500, Declan McCullagh thoughtfully expounded: > What are the best metaphors to use when talking about a browser and an > operating system? Is the combination like a car and an engine, or a car and > a roofrack? A pair of gloves? > > Or is it even useful to talk about a browser/OS metaphor in the case of > Microsoft, since IE has been glued into the operating system in the form of > .DLLs? Might that be more like the wheels of a car? I might look at it like air conditioning in a car: If present, it requires significant alterations to the basic vehicle, and might be difficult to remove cleanly, _but_ air conditioning in no way affects the basic operation of the car, and cars can be bought without air conditioning. Hmmmmm, actually A/C does affect the car's operation: uses more gas and degrades performance! A better metaphor than I thought. -- Tom Porter txporter(a)mindspring.com ------------------------------------------------------------------------ "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Music Boulevard Storewide Sale
by http://www.musicblvd.com/ 17 Dec '03

17 Dec '03

Dear Music Boulevard Customer, Happy New Year from Music Boulevard! Ring in 1998 on the right note, with new music! Through January 26th we've lowered prices on every CD, cassette, video and T-shirt in our catalog of over 200,000 items -- our entire store is on sale! Search for your most-wanted recordings or refer to our comprehensive Buyer's Guide (created by Music Boulevard's staff of music experts) to find essential albums in every musical genre and style, from Surf and Garage Rock to New Orleans Jazz to Reggae to 20th Century Classical music. Follow the link below to go to our Buyer's Guide... http://www.musicblvd.com/cgi-bin/tw/1462_0_/mb2/live/mrkt/specials.txt $1 U.S. SHIPPING! Extra, Extra! Due to enthusiastic customer response, we've extended our shipping sale! Through the end of January, the shipping charge for U.S. orders is just $1 for unlimited items. With our unbeatable prices and shipping rates, expanding your music collection in '98 is one New Year's resolution you just can't break! EARN FREE CDS! How many CDs did you buy in '97? Our Frequent Buyer's Club members earn store credit for a free CD after each tenth item purchased on Music Boulevard. If you haven't already joined the club, don't delay - starting earning points towards your first free CD today! THE VOTES ARE IN... And the winner is...Music Boulevard! We've been named the official online store for the 40TH ANNUAL GRAMMY AWARDS! For the best recordings and performances of 1997, look no further than our comprehensive "Guide to the Grammy Nominees", including nominees in over 90 categories, audio clips, cover art, and much more. All nominated albums -- from outstanding artists Paula Cole, Babyface, Hanson, and many other top artists -- will be sale-priced through the Grammy Awards Ceremony on February 25th. After the 25th, revisit the Guide for a complete list of the winners and special savings on the best of the best! Just follow the URL below... http://www.musicblvd.com/cgi-bin/tw/1462_0_/mb2/live/mrkt/grammyguide/genera l.txt NEW AND NOTEWORTHY Music Boulevard keeps you informed of the latest and greatest new music! The stellar soundtrack to 'Great Expectations' is highlighted by brand new songs from Tori Amos, Chris Cornell of Soundgarden, and Scott Weiland. Just released -- Ben Folds Five's 'Naked Baby Photos,' a collection of 17 of the quirky pop group's best rare, live, and unreleased songs. And at the top of the music charts, the soundtrack to the epic romance 'Titanic' features the music of legendary film soundtrack composer James Horner as well as the Celine Dion's beautiful performance of the love theme "My Heart Will Go On." GET THEM BEFORE THEY'RE HOT! Visit Music Boulevard today to pre-order tomorrow's biggest hits! On January 27th, keyboard virtuoso John Tesh unveils his latest full-length album of lush, soothing New Age compositions. Also on the 27th, the master of English Jungle techno, Goldie, returns with his long-awaited second album, the double-CD 'Saturnzreturn.' On February 3rd, Seattle supergroup Pearl Jam makes a comeback with their fifth and finest studio album yet, 'Yield,' featuring the hit single "Given To Fly." Advance order these much-awaited new albums today and have them delivered to your doorstep on release date! Thanks for shopping Music Boulevard! The Music Boulevard Staff TO UNSUBSCRIBE To unsubscribe from this mailing list, send an Email to: remove-musicblvd(a)sparklist.com and you will be automatically removed from this list.

1 0

Re: Microsoft Metaphors (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Dan, Forwarded message: > Date: Thu, 15 Jan 1998 11:26:03 -0500 > From: Dan Ritter <dritter(a)bbnplanet.com> > Subject: Re: Microsoft Metaphors (fwd) > The computer is a building. A building once built doesn't change and it's a pain in the ass to change the rooms and such. A general purpose stored program computer is intentionaly designed to get around these limitations. Computers before the stored program paradigm most certainly fit the building model however. > The OS makes it a supermarket. The OS provides a multiplicity of resources for me to use (purchase) at my leisure? I don't think so, unless you want to model the user as the company that loads the shelves. In a computer, unlike a store, each time I want to use a jar of tomato paste (program) to build lasagna (job) I don't have to go out and buy a new jar of tomato paste. > The browser is the map of the store showing what foods are in what aisles. That one I'll buy (figuratively). ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: (eternity) God's Own Backup Medium
by Ryan Lackey 17 Dec '03

17 Dec '03

Dan Fabulich: > I must be insane, because this seems simple to me. Don't listen. It's simple conceptually, just some of the technical details are multi-axis tradeoffs which need to be made explicit. > > Presume that the goal is a secure anonymous storage/retrieval system, paid > for with e$. Armed with a persistent naming system for each document, we > set up e$ protocols to pay for storage of a (possibly encrypted) document > OR to pay for retrieval of a particular named document. I broadcast that I > want up to ten people to store my XMB document and that I'm prepared to pay > $Y/mo. to each participant. My document is then secure for as long as I'm > prepared to pay for it. It is anonymous to the extent that information can > be transferred anonymously between me and the other willing participants; > it is therefore a remailer problem, not an Eternity problem. It's an Eternity problem if you want your eternity system to have better performance than the remailers have. What you really need is a multi-level security infrastructure, where someone (the owner of the data, the individual intermediate server operators, etc.) can choose the level of security they will provide to meet certain Quality of Service levels. Yes, for a lot of the data you're handling, remailers are a good model. However, steganographically-protected streams hidden inside other streams work better for certain things. Perhaps quantum channels work better for other things. Perhaps hand-carried optical tapes are best for others. The system should have a way of handling these formats in a suitably abstract way. > Alternately, if a document is in high demand, someone might offer money to > anyone who can provide a particular document given by name. Any willing > sellers could then exchange information/e$ via e-mail. (One might even > imagine data-traders who would seek out valuable information at a bargain > and sell them to others at market value.) Again, the mechanism is only > anonymous to the extent that e-mail is secure. Which helps both security and performance. A very good mechanism. > > Note that the system is profitable to all of its participants no matter > WHAT the broadcast mechanism is. The more automation, the more profitable. > The more participants, the more profitable. The more information online, > the more profitable. Yes. That's why I'm including market-based techniques in Eternity DDS -- I think market-based arguments are as powerful as statistical ones -- perhaps not as powerful as mathematical/cryptographic proof, but close. > The missing link here, of course, is anonymous e$. Despite the success of > the remailers, I've never been convinced that they're not vulnerable to > traffic analysis. (Possibly this is why no one has ever bothered to shut > them down?) > And even if we COULD set up automated daemons to monitor the broadcasts and > negotiate trades, there's still no good way to distribute money over the net. I know with high confidence there will be a deployed quality anonymous e$ system in 1998. > > At any rate, keeping the system independent of its broadcast medium (which > can be done pretty easily by just making sure that the program communicates > in [encrypted] plaintext,) should make the system autocatalytic... At that > point, just let it run, get as many people running it as possible and let > the market take over. Yes. Both Eternity-USENET and Eternity DDS are only secure once they grow to a certain size. Market pressure is (I think) the best way of getting a system to scale to that size. (Eternity-USENET is vulnerable to technical Denial of Service attacks with the current small number of indexing servers, even if it is protected from legal issues. I think illegal or extralegal attacks are as dangerous as the legal ones) -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

7 7

Re: Crypto Kong penetration.
by James A. Donald 17 Dec '03

17 Dec '03

-- At 05:31 PM 1/15/98 +0000, Steve Mynott wrote: > Ummm why reinvent the PGP wheel Well I am not "reinventing the wheel". Crypto Kong implements a different identity model. It does not suppose that there are "true names". This leads to substantially easier identity management (largely by abolishing identity management) As a necessary consequence of this, if you happen to be communicating with two different Bob Jones, Crypto Kong does not attempt to discover which one is the one true Bob Jones and which is the evil man in the middle Bob Jones. It merely keeps them distinct by applying different labels to them. Secondly, PGP simply is not being adopted by the masses. Of course right now, two weeks after release, Crypto Kong is not being adopted by the masses either, but with very little identity management, it is far easier for the masses to use. If you try and shove that identity stuff onto people they will not do it. Too much like hard work. They will happily let the government licensed authorities do it for them. The PGP model clearly has not flown yet, and it is not going to fly. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG mMObRqZXvGz3OkHZyNWBCEGt5ZpZtUG5Y19i3tsX 4SfFX2/pUCYwhAm6n1u5xBLG/xL9LYsSZcznxXI8S --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

5 5

BUG Bounty...
by Peter Wayner 17 Dec '03

17 Dec '03

My publisher is reprinting _Digital Copyright Protection_, a book that describes how to use encryption and steganography to control digital data. I get to fix any problems that are out there. To encourage people who may have spotted errors, I'm offering a bounty of $20 to the first person who reports an error subject to the following limitations: * The errors must be technical. I appreciate anyone who wants to correct my grammar, but I think that these types of errors are too hard to pin down. We could spend more time arguing than solving them. * I reserve the right to aggregate errors and determine the right way to split them up. This isn't a loophole, it's just a way to prevent someone from noting a pattern and asking to be paid for each separate occurance. For instance, imagine that someone notes that I forgot to put a page number on a blank page at the front of the book. Is every page number after that wrong? I promise I won't use this as a loophole. * I reserve the right to make arbitrary judgements about the "first" person to submit a claim. This is to prevent a club of people from finding an error and reporting it in synchrony. I may choose to pay each person the $20 reward, choose one I feel is most deserving, or even split the reward n ways. It's up to me. I'll probably choose the first one unless there are extenuating circumstances. Thanks to everyone who takes part in this project. Let me know if you have any questions. In the past, I've found that few people reported the errors and I'm hoping that $20 will be enough of an inducement. Perhaps there are no errors there? This is the best way to prove a negative. Thanks again, Peter Wayner

1 0

(eternity) Mailing List Archives
by Ryan Lackey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've put the archives of the Eternity Mailing List (eternity(a)internexus.net) up on http://sof.mit.edu/eternity/mail-archive/ The mailing list is host to discussion of the theoretical issues behind Eternity service, Blacknet, Adam Back's Eternity USENET implementation, and my forthcoming Eternity DDS implementation. (7 articles got lost from the archive while I was setting it up. I sent them to itself as "missing articles 86-92". I'll restore their original headers at some point.) - -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNL5mBqwefxtEUY69AQFZrAgAhJA1xWUTf4nPKvT17U9tBnrPt2EwP9Hv dx3QruMmZqodAES7ot6h0YQN6Wi/Chw8RosjCqRXZq+zkayUBVX376gTF4i0+Vpf MocwfB8plXTmjfBahcfjb+WxeEuGEefw3BGCGKpYM/y5uZ925GJsq/+R6MeA2FjQ t+RWcqeMbSRAz4T3s8ThPQtr9dIi3dJgh4gEq9aAD+0cH4lOZFAsc3NA8YMWHptR M++ZvHYCLvwm5mb01bNJ9w8BGzU7dVFzxmJfxhZqb+0DJvK++8uQeflSUmILP9uf yXc+O+pYjuW2ho9ozzSlcbbSEPWdyAO03Qaty8bLdxy0DeaFmTWyoQ== =US5o -----END PGP SIGNATURE-----

2 1

Re: Crypto Kong penetration.
by James A. Donald 17 Dec '03

17 Dec '03

-- On Thu, 15 Jan 1998, James A. Donald wrote: >> If you try and shove that identity stuff onto people they >> will not do it. Too much like hard work. They will >> happily let the government licensed authorities do it for >> them. The PGP model clearly has not flown yet, and it is >> not going to fly. At 02:16 PM 1/15/98 -0500, Ray Arachelian wrote: > IMHO, this is pure grade A bullshit. If you included PGP > in MsMail, and Eudora and pine and elm from the get go, > everyone would use it. Proven false by experiment: Observe what happened with Verisign and MIME. The cost is not signing your stuff. The cost is setting up a key and publishing it, and getting other peoples keys and verifying them. Integration with Eudora makes it trivial to sign and to decrypt, *after* you have created and uploaded a key, and downloaded and verified other peoples keys, which is not trivial. People would rather the kindly benevolent government did that hard stuff for them. Verisign/MIME is *already* integrated into everyone's mailers, and they are not using it because Verisign key management is too hard, and Verisign key management is arguably more user friendly than PGP key management, though clearly less user friendly than Crypto Kong's (lack of) key management. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG s/7IS+OXDf+elZBg6ff+1Sq4aO4aoy9DRhH58rhP 4HFsRTnHTjnMnwGwjenI4jPJsM/0cy02LwoJAtbQ8 --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

1 0

Eureka! Fri Jan 16 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Friday's issue of Eureka! PLAYGAL This is truly a breathtaking site. Well-designed and easy to use with excellent content. The tour alone has hotter porn than many other 'free' sites - go see it now. It's explicit, comprehensive and top quality. There are 2,000 video feeds online, free live fucking with sound, 10,000 erotic stories, 1,000s of top quality pix, adult and arcade games, real ama- teur competitions and much more. Click now and be astounded! Playgal .... http://www.playgal.com/playgal/banner_abc1.html PLEASE VISIT THIS FINE EUREKA! PARTNER SITE Persian Kitty's Adult Links http://www.persiankitty.com/pk.html The #1 most visted adult links site on the Web. Persian Kitty's is now in it's 3rd year! Updated twice each day. Plus the Purrfect Pose and the Desktop Image of the Week! PLUMPERLAND Fat chicks with big hooters and pretty faces. Interesting mix here. Some dressed like police and bent over showing us their goods. There are also some links here to other big girl websites if you are so inclined. Big girls need loving too! ...................... http://www.ioservices.net/plump/ BIGKNOCKERS It's a tit zone and a half! It's udder maddness! The boobs are big and the babes look good. This is a great site with hardly no distracting graphics. Just a real easy thumbnail area with lots of free pix. This is a must surf for anyone who love breasts. I gotta go I'm getting thirsty for milk! Bigknockers ....... http://www.bigknockers.com/free/free.htm TITS OF THE WEEK OK, this is a paysite, but at the door they have three great sets of hooters free for you to enjoy viewing. These alone are worth the modem hop. If you have seen one you have not seen them all. Take a look at her nipples! Cruise by and see! ............................... http://www.towview.com/ OLDER BROADS WITH HORNY BODS Hey, you will be older someday. Here is a chance to get a peek at the future. These ladies have guts to stand up and be seen! Some are not too bad. A few will scare you out of your computer chair and leave you running in the street! Older Broads ........ http://lisanne.com/obroads/ladies1.htm FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here ... http://www.netscape.com/download/ The hardcore channels .. http://www.EroticPleasures.net/xxx/ CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat .................. http://137.39.63.229/chat/ General/Fun Chat ........ http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!....1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline.........1-800-644-8779 FREE: Live 1-on-1 (international call only)....011-678-77416 AMATEUR SITE OF THE DAY TAYLOR: Hugz & Hooters is her calling card. Not only does she have huge tits, but is one of the sweetest girls around. Her site is chalk full of pictures, including girl/girl and three girl lesbian pictures. She also posts true life erotic stories! ............................ http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY XXXStories.com: The largest free erotic story site on the net. Over 400 hot sex stories on such topics as wife sluts, virgins, group sex and more...... http://www.xxxstories.com/ DAILY CARTOON ........... http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! .... http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ........... http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ....... http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ....... http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ..... http://eureka.abc-web.com/eureka/francais.htm ITALIANO ..... http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE . http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 ........................... http://137.39.63.229/?160 Pic 2 ........................... http://137.39.63.229/?161 Pic 3 ........................... http://137.39.63.229/?162 Pic 4 ........................... http://137.39.63.229/?163 Pic 5 ........................... http://137.39.63.229/?164 Pic 6 ........................... http://137.39.63.229/?165 Pic 7 ........................... http://137.39.63.229/?166 Pic 8 ........................... http://137.39.63.229/?167 Pic 9 ........................... http://137.39.63.229/?168 Pic 10 ........................... http://137.39.63.229/?169 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Talk Is Cheap.....AND Fun!
by freecalls4u＠28399.com 17 Dec '03

17 Dec '03

NO 900 #.....NO Credit Cards Just Pick Up The Phone & CALL! Talk to our SEXY & HOT, young girls! They will talk about ANYTHING! 24 Hours A Day! NO Charge For The Girl's Services! You pay for the long distance charges (as little as .30 cents a minute) Economy Plan: Call us as a group and split the charges! SHY....... Then call and just listen. You'll be amazed at some of the wild fantasies! Why pay for expensive 900 numbers, when you can talk to our hot and sexy babes for as little as .30 cents per minute. This is a LIMITED TIME OFFER to introduce our girls and our GREAT new service. Don't delay, call today! 011-592-1773 (24 hrs.) You MUST be 21 years old to participate.

1 0

E (the java extension, not MDMA)
by Ryan Lackey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After someone mentioned "E", Electric Communities (http://www.communities.com/) enhancement to the Java security model/language/etc., I checked it out It looks useful for a distributed agents based system (which is what I'm shooting for...the long-awaited goals mailing will either get sent today or tomorrow, depending on if I fall asleep immediately after sending this). I don't think anyone will argue that it's inherently bad. However, I'm interested in knowing what people think about using a vaguely proprietary product (albeit from a company with lots of cool people) in a piece of software like a reference Eternity implementation. I personally would prefer to stick to something as standard as possible, but E has a lot of features I'd want to use, and would end up re-implementing on my own. (I think if you had a JVM interface to eternity such that an object, its currency, where it should send its results, etc. in a standard form (the standard eternity agent encapsulation) were encapsulated, you could build a lot of Eternity out of interacting agents inside another Eternity implemention, inside ... up to inside a traditional network. (more on this idea later)) So, this is very rambling -- I mostly wonder how people feel about using a fairly non-standard language extension in something like Eternity. Ryan [ObDentistry: Wisdom teeth *really* suck. I want drugs.] - -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNL6JcKwefxtEUY69AQGs0Qf/TubvdreDInDvT89R8UGHd1TohudBCwYE KWq66zhULQh0YAdn2ZoL4rT9lhxWJ/QE0el8sLxmp9CgjwnMi8l7uA8eKB3RSi0s l6zgx96PJYLvAtI+S7gYcLAKf9RvHH5TzyWpT/WoiePb4Wd8YI0Z3DthdEdd4xMs gKqmyOO6JpX+SPXF89shN33j1LXfFmvq10XWlCW15XLyyA72WwoWbKQHu40uliAd rsM+CRacNN7K3Gc9OV4IWORnmIciZbJ1EZbO8kyZU3YlYvOB+QyZpnaYvFuzyLtS Iyud5WaVVRM7mGn9FS9WwSaxqxMrRRv25FutM9muHmAIufaxnMVeQA== =GQr/ -----END PGP SIGNATURE-----

1 0