December 2003 - cypherpunks-legacy

Re: GPL & commercial software, the critical distinction (fwd)
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

Matthew James Gering wrote: > > Jim Choate wrote: > > I'd say the obvious one, the Unix code tree is more stable > > than the MS tree. > > Sure, but does that mean the MS platform was less suitable than Unix, or > their MS platform programmers were inferior to their Unix counterparts. > I believe Netscape outsourced the Unix development, at least initially. > I would blame insufficient SQA at Netscape, and from what I've heard > that claim is justified. > > Matt My impression is that the instability described is due to fragmentation of the virtual memory space, which happens faster on NT than Unix because of the relative immaturity of NT memory management. The side comment about Mac's being even worse would support this hypothesis (as Mac memory management is a joke). The Netscape SQA theory doesn't explain why other products also become less reliable on NT (and worse again on 95).

1 0

RE: I thought of an initialy regulated industry!... (fwd)
by Blanc 17 Dec '03

17 Dec '03

>From Jim Choate: : The bottem line as to why free-market economies don't work is that it isn't : in the producers best interest to have a educated consumer. They might buy : somebody elses product or start their own company. Both of those are bad for : profits. : : Free-market mavens forget that producers are just as greedy and corrupt as : everyone else, there is no fair competition in an unregulated market given : the pshychological make up of human beings. ................................................................................ ........ Free market economices don't "work", simply because they are run by humans, who regularly suffer psychological breakdowns, envy, and mistakes of judgement, not to mention disreputable marketing departments. Regulated economies, however, are run by government drones, and are therefore perfect vehicles which, with unfailing success, make all of their captive customers happy. Everyone knows this, as we witness the apparent success of all those regulated economies overseas which outshine the U.S. by three (maybe four) orders of magnitude. No one over there envies the U.S. productivity and standard of living, and they never are moved to leave and come live over here, to give up the benefits which extreme regulation confers upon them, in place of the (admittedly mixed) free-market fiasco which operates over here, where all things are uncertain and frighteningly unpredictable. In fact, many people become so disgusted with the monopolies and disfunctional liberty which exists here, that they regularly expatriate to go live in places like Sweden, Germany, even Canada, where they have the peace of mind and assurance that State coercion will provide for their every need - in a most efficient, timely, prompt, and user-friendly manner. They never have to worry about who has more or less, who is better or worse, or who knows better than anyone what is best for everyone. It's all been pre-established and exists incontrovertibly in their national consumer database. .. Blanc

3 2

RE: Another question about free-markets..
by Blanc 17 Dec '03

17 Dec '03

>From Jim Choate: : Now in a free-market, by definition, there is no law. What then is the : responsibility of businesses other than the pure unadulterated pursuit of : profit? If this includes lying, denying consumers information, etc. what : harm is done, they have fulfilled their responsibility to their shareholders : (potentialy quite lucratively) and broken no law. Within this environment it : follows that a primary strategy for such executives is the elimination of : *all* competition. And since there is no law other than the measure of profit : all can be justified. ................................................................................ There might be no Law. But there would still be Reality - and for some people, this is *much* harder to deal with. If customers sit around like lumps on a log depending upon the kindness of strangers, well they're not doing themselves any favors. But such a person is not a customer. They are an invalid (or will be, eventually). In a free-market economy, everybody - not only corporations, not only customers - have to be rational about what they're doing. Everybody has to "be on their toes", alert to what truly is in their interest, and prevent themselves from accepting, from supporting, self-defeating offers from Trojans bearing spam. You learn or you die, just like in the movies. .. Blanc

1 0

Re: Another question about free-markets... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 5 Oct 1998 10:03:25 +0100 > From: Steve Mynott <stevem(a)tightrope.demon.co.uk> > Subject: Re: Another question about free-markets... > On Sun, Oct 04, 1998 at 11:53:28PM -0500, Jim Choate wrote: > > > Now in a free-market, by definition, there is no law. What then is the > > no in a free market there is no state > > there are laws based on natural rights Ok, who writes the laws? Who enforces the laws? Who decides what is natural? Remember, we have *NO* participants in a free market other than the producer and the consumer. Two, and *only* two, parties are involved. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

4 3

RE: GPL & commercial software, the critical distinction (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Matthew James Gering <mgering(a)ecosystems.net> > Subject: RE: GPL & commercial software, the critical distinction (fwd) > Date: Mon, 5 Oct 1998 00:29:33 -0700 > state (you have no govt), at least in the manner we have now, whereas a > Laissez Faire state could enforce it (you have limited govt). That says > nothing about whether IP should exist in current form or at all, simply > that it *could* exist under LF. [other stuff deleted] Ok, so you're talking out of both sides of your mouth then. On one hand you speak of a free-market (vis-a-vis Laissez Faire) and then in the same breath, with not even a blink of an eye, you speak of limited government. You can't have your cake and eat it too. Sorry. This is gibberish. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

RE: Another question about free-markets... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Matthew James Gering <mgering(a)ecosystems.net> > Subject: RE: Another question about free-markets... > Date: Sun, 4 Oct 1998 23:34:09 -0700 > > Now in a free-market, by definition, there is no law. > > A free market is not the absence of law (that is anarchy), a free market > is the absence of government intervention in trade and commerce. And how does government intervene and interfere? By making law. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Capitalism and Monopolies (was RE: GPL & commercial software, the (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Matthew James Gering <mgering(a)ecosystems.net> > To: "Cypherpunks (E-mail)" <cypherpunks(a)cyberpass.net> > Subject: Capitalism and Monopolies (was RE: GPL & commercial software, the > critical distinction) > Date: Sun, 4 Oct 1998 23:01:16 -0700 > Jim Choate wrote: > > Only after the early 1890's when the situation got so bad > > they had to do something. Prior to that there was no federal > > intervention in railroad operations per se > > Completely false. Not totaly. > Traffic to/from the West coast did not warrant the > capital investment in transcontinental railway, so the government make > *exclusive* lands grants to specific railroads to extend the railways to > the West coast (100M acres between 1863-7) . Those subsidies created the > monopolies, the source of coercive power over Western farmers. Protest > against this arbitrary power was blamed on the market instead of the > government subsidies, and resulted in the Interstate Commerce Act of > 1887, and the Sherman Act of 1890. Only *after* it was clear that these companies could not do it themselves because of a lack of sufficient traffic to support the business. I must congratulate you. You're the first person in a long while who actualy took the time to develop an argument based on *fact*. Well done. > I should have stated government "distortions" instead of "regulation." > That includes subsidies. Even better, a distinction between 'law' and a 'grant'!.... > The placement (ownership) of these rights, their value, restrictions and > enforcement are the result of a free market? No, government > intervention. Actualy no, try buying a piece of land and enforcing the title *without* registering it at the country seat or its likes. > Did anyone ever state monopolies result from federal regulations? > Government distortion/intervention, that can come at any level. Acts of > force or coercion can create a monopolistic situation, free trade > cannot. Absolutely it can because it actualy allows a freer hand in developing strategies to decrease the market potential of ones competition. There is *nothing* in free-market definitions or descriptions which will prevent gross abuse of the consumer by the manufacturer. Remember in a free-market there is the requirement for 'fair competition' which is contrary to the very theory of business operation, which is to maximize profit and reduce competition. Now if we lived on Vulcan and we were all logical Vulcans it might work, unfortunately we're not and human beings will specificaly go after their competition, which without some sort of regulation being impossed leads to obvious results; initialy a very fluid and dynamic market that settles down with the survival of the fitest getting bigger and bigger. As these companies get big enough they can no longer react as quickly as they once did (intertia of strategy among other things). At some point it becomes easier to cooperate than to continue to fight. That cooperation leads to a melding and promotes even more monopolization. > So what is the discriminating factor(s) distinguishing industries that > can and cannot be monopolized? Saturation of the consumer market, high start-up costs in either infrastructure or intellectual resources, and others. I posted a list of some characteristics to the list a while back. You can look for it. If I get time I'll post it to the list again. > Don't forget capital markets; Are you speaking of capital markets in the sense of fluid and available funding or of the existance of businesses that produce the capital assetts needed by other businesses (eg creating rail-cars for rail-roads)? a free fluid capital market can and will > support a smaller competitor if potential long term profits will support > it. You can't pay your employees today with tomorrow profit. This isn't a Popeye's hamburger vendor... There is another question I'd like to pose. In a free-market economy there are only two participants, the consumer and the producer, what if anything in the definition prevents one or the other from employing an agent in their stead to 'negotiate' with the other. Does this by definition introduce a third party or is it a permissible extension of the two-party system? ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

FW: I thought of an initialy regulated industry!... (fwd)
by Trei, Peter 17 Dec '03

17 Dec '03

> -----Original Message----- > From: Blanc [SMTP:blancw@cnw.com] > Sent: Monday, October 05, 1998 12:10 AM > To: 'Cypherpunks Distributed Remailer' > Subject: RE: I thought of an initialy regulated industry!... (fwd) > [...] > > Free market economices don't "work", simply because they are run by > humans, who regularly suffer > psychological breakdowns, envy, and mistakes of judgement, not to mention > disreputable marketing > departments. Regulated economies, however, are run by government drones, > and are therefore perfect > vehicles which, with unfailing success, make all of their captive > customers happy. > [four paragraphs of well written irony removed] For those interested in a thoughtful (though slightly one sided) look at this issue, I strongly reccomend PJ O'Rourke's new book 'Eat the Rich'. He examines several locations (US, Sweden, Albania, Cuba, Russia, Hong Kong, Shanghai) in an attempt to figure out why (economically) "some places suck and others don't" His bottom line is that the rule of law (especially contract law) is critical, as well as democratic government. He's much more interested in on-the-ground economic experience than in government figures, and is the only economics writer who can make me laugh out loud. He does have his blind spots - I would have liked to see what he makes of Singapore. Peter Trei [Excuse the lousy formatting - I'm using a Microsoft product]

1 0

Re: importance of motivation
by Martinus Luther 17 Dec '03

17 Dec '03

>From Tim May: > Any trendy new diagnosis always gets some recruits...dyslexia, ADD >(*), the abuse excuse, etc. (* Like any trendy thing, it gets renamed > to keep its panache. ADD has been renamed to something with four > letters, which I now forget (must be ADD).) And it is worse than that, they're scum, Tim. They claim (in last months SciAm) that 5% of kids have ADHD (some sources have it at 15%). This isn't a disease, this is one end of the normal variation in behaviour. It is as if you diagnosed an adult male height of less than 5 foot 4 inches as "dwarf" and prescribed growth hormone. Or as if you operated on any woman over 5 foot 10 to shorten her legs. http://www.nimh.nih.gov/publicat/adhd.htm says 3 to 4 times as many boys as girls have it. So they are saying that ADHD affects 15 to 60 percent of all boys! This isn't one end of the normal range of behaviour, this is just plain normal. The psycho-babble establishment is proposing drugging 5 to 15 percent of the population to alter their behaviour. If this "diagnosis" had been around when I was a kid they would have drugged me. I found a 14 point checklist for ADHD on the web at: http://www.docnet.org.uk/autopage/messages/23.html In the last 48 hours my daughter has shown 11 of these. And I've shown 14. This is just normal life they are talking about. This is the misuse of psychiatric medicine for political control, as much as anything that went on in Stalin's Russia. (the personal is political - if one young man behaves in a way unacceptable to their elders that is personal - if 5 million do it is political). I object, strongly, to some guy in a white coat saying the problem with my life is my brain and he wants me to take this little pill and then it will be alright. Which is not to say that some people don't have real problems for which Ritalin is a workaround. But 15%, 10% or even 5% isn't psychiatry it is politics. Large parts of our daily life is tedious, boring, of no direct relevance to anything we are interested in. Most kids in school are made to sit through boring lessons. Bloody hell! They made us do sport. Is anything more shitlike? Most adults at work make themselves do things they have no interest in other than for the money they might get out of it (which is where we cam in with all that discussion about research that shows that people perform less well on tasks done primarily for reward - Marx was right about alienation, you know) A healthy person *ought* to have trouble paying attention to some of the things they are asked to do. Maybe we will have better lives if we drug ourselves (Ritalin, Prozak, E, daytime television) to get through the shit of the day but let it be a decision adults make for themselves, not one imposed on children by parents or the psychatric eastablishment. I could do with a cup of tea... > We've had some nutballs and losers (luser spelling: loosers) on this > list. People who claim the reason they can't make a coherent > argument or hold a steady job is because of something some > psychobabbler told them was their excuse. It's weird how people do that. If a doctor gives something a long name is suddenly becomes alright. Some parents are ashamed that their kids can't read well. Put it in Greek and call it "Dyslexia" and all of a sudden it isn't something you do, or are, or don't do or aren't capable of - it becomes something you *have*, not really part of you, baggage, a burden that could one day be dropped, something that has been done to you, imposed on you, soemthing that is not your fault. Reality hasn't changed, just the words used to describe it, yet it is now less threatening. The germ theory of disease is stretched to the limit. Pasteur showed that some diseases are caused by microorganisms. Simple cause and effect. One baterial disease is caused by pone organism, another by another. That is deeply embedded in our thoughts. So now all disease, all misfortune, has to be given a name, put in a box and traced back to a simple cause. I'm not fat, I have an eating disorder. I'm not stupid, I have a learning disability. I'm not sad, or worried, or bored, or scared - I have depression or an anxiety disorder or an attention deficit disorder. Some societies attribute all misfortune to witchcraft - if your cow dies then someone, somewhere must have cursed you. We now attribute all misfortune to something outside ourselves, not part of us. It wasn't me, it was my syndrome. And its all part of the pressure put on familys by business. Conform, consume, keep quiet. Don't rock the boat. Turn up on time, wear our clothes, work our hours. No alcohol on the premises. Or at lunchtime. Take this here drugs test - we don't want dope fiends and hippies in our office. Stressed out? Bored? Overworked? Tense, anxious, nervous soul-ache? Nothing acts faster than Ritalin. Especially when cut with Prozac to prolong that cool, mellow feeling. Time off to look after the children? Not if you want the job to be open when you come back. Just give them a bite of our magic apple and they will be alright. What's that you say about drugs? No, these are Good Drugs. The men in the white coats say so. And what's more they are patentable and we own shares in Ciba Geigy, Lilly, Fison's and Hoffman La Roche. Good Drugs keep you working until we want to let you go. Good Drugs keep you consuming until you have no more money to pay us with. Good drugs keep you working for our profit. Good Drugs keep you from complaining, striking, joining a union, praying, helping, loving, singing, fighting back in any way whatsoever. Good Drugs keep you from realising that half your work goes into our pockets. Good Drugs keep you scared, scared of poverty, scared of being different, scared of standing out, scared of using your head to think any thoughts we don't want thank. Good Drugs keep you addicted to your job, your country, your government, your boss. The Best Drug is the mortgage. John the Ranter/ ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Review of TriStrata Public Information
by Bruce Schneier 17 Dec '03

17 Dec '03

Review of TriStrata Public Information 1 Introduction Over the past several months, a new company called TriStrata has been getting substantial press for a new "one-time pad" cryptography system. Most of these press reports took at face value the company's claims about their technology and product, and did not try to analyze whether or not they were true. Counterpane Systems believes it is important to dig under the hype and figure out what the real story is behind their technology. We reviewed the publicly available documentation on TriStrata, and found a system whose architecture is that of an early-1970s pre-public-key cryptography security system. Central servers, upon which the security of every message rests, must be kept absolutely secure; yet they run on Windows NT. These servers are all powerful, in that they can forge messages, rewrite audit logs, fake authentication, and lie about anything else in the system. Users cannot access their files unless they are connected to this server. TriStrata does not use a one-time pad at all, and none of the security proofs about a one-time pad apply to their system. Their reliance on this encryption technology forces them to use security protocols long abandoned by the rest of the security industry. Even their performance enhancements bely the fact that encryption is rarely the bottleneck in any communications system. Note: For a less-technical summary of this review, please see sections 4.0, 4.1, and 5.0. 2.0 The TriStrata System 2.1 Structure The TriStrata system uses a centralized server, called the TESS (TriStrata Enterprise Security Server). The documentation is not very clear, but document reference 3 suggests that each company would have its own TESS. Every encryption or decryption operation requires a "permit" from the TESS. To encrypt a file or message: 1. The user contacts the TESS over the network. This can be any type of network, such as the Internet or a local area network. 2. The user and the TESS authenticate each other using a proprietary protocol called Private Access Line (PAL). 3. The TESS sends a permit to the user machine, which is used to encrypt the file or message. The TESS also sends a "seal" to the user. This seal is only readable by the TESS. 4. The user simply stores the seal with the file (if it is encrypted locally), or sends the seal along with the encrypted message (if it is to be transmitted to another user). To decrypt a file or message: 1. The user retrieves the seal and sends the seal to the TESS (along with the authentication data from the PAL protocol). 2. The TESS opens the seal, and determines whether the user is allowed to decrypt the data. 3. If the user is allowed to decrypt the data, the TESS sends a decryption permit to the user. 4. The user's local machine uses this permit to decrypt the file or message. The TESS keeps full audit logs of all operations, and includes procedures that allow designated recovery agents within the company to recover the keys to any file. The system is claimed to provide identification (who is using the system), authentication (who sent a message), access control (restriction of access to authorized users), integrity (assurance message is unaltered), and non-repudiation (sender cannot deny having sent it). They have received an export license for their system. 2.2 Authentication The authentication method used to authenticate the user to the TESS and vice versa is a crucial part of the security architecture. The TriStrata documentation contains no further information than that this is handled by the Private Access Line protocol. 2.3 Encryption Algorithm The Random KeyStream (RKS) encryption algorithm used by TriStrata is hailed as "a new fundamental technology." It is claimed to be very fast, but the documentation only contains raw speeds, without documenting which platform these speeds were achieved on. The encryption technology is also claimed to be unconditionally secure. To quote the web site: "No matter how much mathematical analysis or computing power is applied to the cryptanalysis of RKS, there is simply no algorithm and no underlying pattern to break. As Herbert Yardley foresaw in 1931, cryptography as a profession is dead." 3.0 Our Comments 3.1 The Central Server Structure Cryptographic systems that use a central access control server are nothing new. The Kerberos protocol uses a central server for similar tasks. Using such a central server as the TESS has several advantages and disadvantages. The main advantages are: - There is a central place that administrates all the access rights. This makes various administrative tasks easier. - Revocation of access is automatically supported by the system. No separate revocation mechanism is necessary. - The central server can keep comprehensive auditing logs of security-related operations. The main disadvantages are: - The central server contains confidential information, namely the master keys that can decrypt any file. It is thus a very tempting target for attack. The central server must be very well protected. At the same time, the server must be reachable from across the network, and must be reliable, as nothing can work without a functioning server. The end result is a server that is expensive (due to all the requirements) and that still is an obvious point of attack. - The central server is a single point of failure. TriStrata uses a redundant server structure with fail-over, so that a second server takes over when the first fails. A fail-over structure protects against technical errors, but does not necessarily protect against denial-of-service attacks. The TESS is based on a "security hardened" version of Windows NT, an operating system that is not known for its resistance to malicious attacks. - The system is effectively a closed system. Only users who are registered at the server can partake in the system. It is not clear how two users that belong to different servers would communicate. The TriStrata documentation mentions electronic commerce extensively, but it does not discuss how two users at two different companies can use the TriStrata system to communicate with each other. - Since the server contains crucial confidential information, every company must run its own server. A failure of the server, such as a leak of the master keys from the server, can reveal all of the company's information. This is the kind of task that should not be outsourced. In contrast, the key server of a public-key-based system is much easier to outsource as it can be designed so as not to be critical for security. - The TriStrata solution does not allow a user that is off-line to access any encrypted files. A salesman that keeps his data encrypted on his portable computer cannot access the data without contacting the TESS. If he cannot get network access for some reason (e.g., on an airplane, mismatched phone plug, etc.), he cannot access his own files. The TriStrata solution is a return to a very old style of centralized key management. For some applications this is a good solution, but there are many situations in which a centralized server is not appropriate. For example, one function that a central server cannot do well is non-repudiation between adversarial parties (one of the critical functions in electronic commerce). The TESS system seems to provide non-repudiation through inspection of the logs of the TESS. But if a message is sent between two companies, which TESS do they use? The company that owns the TESS that is used can manipulate the logs in their own favor. The end result is that there is no watertight proof that the message was sent or received. In effect, this solution takes us back to the days before public-key cryptography. Since its invention in the late 1970s, the ideas of certificates, public key infrastructure, decentralized key management, separation of encryption and digital signature functions, etc., have all been implemented in response to insecurities in centralized systems. For example, public-key infrastructures use trusted third parties like the TESS, but in a public-key system, compromise of the trusted third party only allows an attacker to issue false certificates, not to decrypt and read messages. 3.2 Authentication We have no further information on the PAL protocol. The documentation does state that the communication with the TESS consists of a single message from the user to the TESS, and a single reply back. Elsewhere it says that the TESS is stateless, which makes it easy to do a fail-over should one TESS fail. It is not clear to the reviewers how the PAL protocol works, if we assume it consists of two messages and is stateless for the TESS. These two properties together would suggest that an attacker can replay requests to the TESS. If nothing else, this introduces fake entries in the audit log. Some of these attacks can be hindered by the use of local clocks, but every solution along these lines we have ever seen is always troubled by clock synchronization problems. We note that the PAL protocol is critical for the security of the overall system. If an attacker can impersonate another user, then he can request the proper permit from the TESS to decrypt a file, and will get access regardless of the security of the actual encryption algorithm. The PAL protocol deserves careful scrutiny before the TriStrata system is put to use. The most straightforward attack against the TriStrata system is to introduce some hostile code into the client's PC (for example, a virus or Trojan horse). This hostile code can then steal the necessary authentication information and send it back to the attacker. This type of attack is a generic attack against any security system, not just the TriStrata system, but it shows that the "provable security" is at best limited to a small part of the system and does not extend to the whole system. 3.3 Encryption To put it bluntly: the TriStrata system does not use the one-time pad system (Vernam cipher) for encryption. A true one-time pad uses a random key that is distributed through a separate secure channel. While a one-time pad is, in fact, theoretically unbreakable when used properly, the details of using it properly make it entirely unusable in any modern commercial or military setting. A true one-time pad gains its unbreakable security from the fact that the key is as long as the message. Since all keys are equally likely, and a particular ciphertext could represent any message, given a particular key, the ciphertext reveals nothing about the plaintext message without the correct key. These random keys must be entirely random; this usually requires generating them from some external random source (such as thermal noise or radioactive decay). And both the sender and the receiver must have this secret key, which must be exchanged in some fashion which the attacker cannot penetrate. The requirement that the keys be as long as the data to be exchanged and that the key needs to be transported via some secure mechanism makes the one-time pad system entirely impractical. In order to send a 1 MB message, the sender and receiver must exchange a 1 MB-long key. Then the sender could send the message and the receiver could use the key to decrypt it. The key would then have to be thrown away and never used again. If the sender wanted to exchange messages with a hundred people, he would have to pre-agree on different keys between each recipient. For a company with a thousand employees, this means that there are 499,500 different key sets, which need to be replenished any time they are exhausted by message exchange. Because the key has to be as long as the message, there is no way to use an established system to exchange more keys, since in order to securely send as 1 MB key a user needs 1 MB of additional pre-agreed key. (And if users can exchange these keys, why can't they just exchange the messages?) This means that all keys have to be exchanged via some other mechanism (such as a courier). This kind of system was used for the U.S.-Soviet teletype "hot line" and it is occasionally used for paper ciphers and spies, but that's it. There is no way in which a true one-time pad can be implemented over a computer network. From the information provided by TriStrata, we believe that the encryption method used is a keystream method where an algorithm generates a key stream which is then XORed with the plaintext to generate the ciphertext. This is known as a pseudo one-time pad, and is also called an OFB stream cipher. One of the modes of DES works in this manner, as does the RC4 encryption algorithm. This is not new technology. A pseudo one-time pad encryption algorithm can be secure, but claiming that it is secure because it is based on the one-time pad is ridiculous. The strength of the cipher algorithm depends on the method used to generate the key stream. The speed given for the encryption method is fairly fast, but without knowing what platform was used to achieve these speeds, no sensible comparison can be made. To give some comparison material: the leading candidates for the AES block cipher encryption standard can encrypt data in about 18 clock-cycles per byte on a Pentium II. A standard 350 MHz desktop machine thus achieves nearly 20 Mbytes per second. This compares to the TriStrata claimed speed of 36 Mbytes per second for a standard desktop machine. The TriStrata figures are faster, but only by a factor of two. This would be a nice speedup, but it does not present a fundamental breakthrough in speed. Reference 4 is a magazine article report that contains more information about the encryption algorithm. As with any magazine article, the accuracy of the information is hard to judge. Nevertheless, the information it provides fits well with the information we have from TriStrata. The TESS generates a single 1 Mbyte block of random data using a hardware random number generator. This block is distributed to all clients. (A second block is used for authentication, but we have no further information on the algorithm.) The encryption algorithm keeps several pointers into this random block and derives the random key stream from the data the pointers point to. This is a known technique, first used by Maurer in his randomized cipher [Reference 5]. The TriStrata documentation talks about a virtual keystream of over 10^30 bytes, which would correspond to 5 pointers into a 1 Mbyte block. This suggests an effective key size of at most 100 bits. On the other hand, the website also claims that it would take 3.5 x 10^33 years to defeat one TriStrata-encrypted message, which would suggest either a larger key space or a fundamental misunderstanding of the mathematical properties of Maurer's system. The random block is the same for all the clients. It has to be, as the client that does the decryption needs the same random block as the client that does the encryption (and sending 1 Mbyte blocks around in the permit is too slow). Therefore, we cannot view this random block as a secret. After all, a secret shared amongst thousands of users is not a secret any more. If we want a more conventional representation of the encryption algorithm, we can represent the random block as a randomly generated 20 by 8-bit S-box. We have no knowledge about the details of this encryption algorithm, but the most straightforward variants of this type are susceptible to a meet-in-the-middle attack on the pointer space. This could reduce the effective key size to as little as 60 bits. The journalist did a speed test of TriStrata's file encryption utility. On a 200 MHz Pentium Pro, 128 MB RAM and PCI Ultra-SCSI disk subsystem it encrypted a 58 MB file in 18 seconds. This corresponds to a speed of 3.2 Mbytes per second. Presumably this speed is limited by the speed of the disk I/O. On this platform a traditional encryption algorithm such as Blowfish can encrypt at 10 Mbytes per second; the super-fast RKS encryption is presumably faster than this. Although this test does not give us any real speed data, it does show that encryption speed is not the bottleneck in most situations. In this situation, the disk I/O is much slower than the cryptography, making the encryption speed irrelevant. 3.5 Proprietary Encryption Algorithms The nature of cryptography is such that there is no way to prove that a cipher is secure, since this amounts to proving a negative assertion: that there is no way to break it easily. Anyone, from the most unsophisticated amateur to the best cryptographer, can create an algorithm that he himself can't break. What is hard is creating an algorithm that no one else can break, even after years of analysis. And the only way to prove that is to subject an algorithm to years of analysis by the best cryptographers around. Because of this situation, the only recognized criterion for secure cryptographic systems is peer review: having other cryptographers examine a cipher and attack it. Even cryptographic organizations which operate in secret, such as the NSA, have an extensive internal peer review system. >From past experience we know that systems that are kept secret and presented as "provably secure," "unbreakable," "a new fundamental technology," or "one-time pad" are usually not very good at all. Those who say these things generally do not understand the current state-of-the-art of mathematical cryptography, and make fundamental mistakes in their system design. Encryption algorithms that are unpublished have a dismal record. The literature is littered with the corpses of encryption algorithms that were broken once they were published. Until TriStrata publishes its algorithm and it is open to peer review there is no professional reason to presume it is secure. 4.0 The Real Problem in Security Systems It is interesting to note that TriStrata gives a lot of attention to the encryption algorithm. From all the problems that security systems face at the moment, the encryption algorithm is probably the least important one. There are many good encryption algorithms available in the published literature that can be used for free. TriStrata chose to develop their own algorithm. Although this can be a lot of fun, it is a decision that is hard to justify, as new algorithms can only be considered secure after an ample time of peer review. Cryptographic systems are broken constantly, but the attacks are almost never against the algorithms. The really difficult problems in security systems are key distribution, management, reliability, robustness, etc. TriStrata uses the solution of having a central server, as necessitated by its choice of encryption technology. This solution is suitable in some situations, but there are many problems that cannot be handled by this approach. In fact, the problems associated with central servers and centralized key distribution have been driving the development of public-key--based systems for the last two decades. TriStrata, by implementing a Maurer-style randomized stream cipher and the centralized key management it requires, has taken the one piece of the cryptographic puzzle that we can solve--symmetric encryption--and made what they perceive to be security improvements. However, they did this at the expense of the really hard problems in cryptography...ones that their system does not seem to adequately solve. 4.1 Trust and Security Systems Whenever someone buys a commercial product, he is trusting that the manufacturer did a good job designing and building the product. This is especially important with security products. If someone buys a word processor and it does not perform as advertised (e.g., the print function does not work), he will eventually notice (he won't be able to print his documents). If someone buys an encryption product, it can function normally (encrypting and decrypting documents successfully), but that is no indication that it is secure. Security is completely separate from functionality, and no amount of beta testing can ever uncover a security flaw. In the commercial world, we rely on the public review process to evalute the security of systems. Internet security infrastructures, such as IPSec, PKIX, and SSL, have been discussed and debated for years. Versions have been proposed, security flaws have been found, fixes have been implemented, and so on. Cryptographic algorithms in these protocols are ones that have been around for years, and have had extensive cryptographic review by the best in the field. Even this is no guarantee of security--implementation flaws are found (and fixed) in the code that implements these protocols, but it establishes a certain degree of confidence. TriStrata has chosen to ignore all public standards in favor of their own proprietary technology, while at the same time refusing to make technical details of their technology public. In order to use their system, the purchaser must trust that their cryptographers are better than the collective wisdom of the world's academic cryptographers, that their protocol designers are better than everyone who has worked on the open Internet protocols over the last few years, that their implementers are better than everyone who has made and evaluated the public implementations of those protocols. The purchaser must trust that TriStrata's misuse of the academic terminology does not reflect a misunderstanding of that technology, and that their technology is so much better than what everyone else has agreed upon that it makes sense to make that leap of faith. In the end, a star-studded board of directors and upper management does not obviate the need for good science, open systems, and peer review. It's simply foolish to trust a system that has not been evaluated. 5.0 Conclusions A system like TriStrata's can be made to work within its limitations. It is certainly not the universal solution to the world's security problems. However, there is a huge amount of hype and very little substance to the documentation. Many of the statements made are incomplete, vague, or suggest facts which cannot be true. The cryptographic claims are wild and unsubstantiated. Parts are clearly written by someone who does not understand modern cryptography, and who is not well versed in the cryptographic literature. Certain areas of the documentation give the impression that they were written with the intent to deceive the reader, but ignorance is probably a better explanation. Based on past experience with systems that made similar unsupported security claims, we are very skeptical about the security of the TriStrata system. We reviewed the system as we have reconstructed it from various hints in the text, as well as conversations with people who have been involved with the system. Until TriStrata releases technical information about its product, it is not possible to give a complete evaluation of their technology. References: [1] TriStrata web site, http://www.tristrata.com, on Sept. 22nd, 1998. [2] Walter Hamscher, Alastair MacWillson, and Paul Turner, "Electronic Business Without Fear: The TriStrata Security Architecture," Price Waterhouse. [3] "Building a Secure Future with CTR Business Systems and TriStrata Security," leaflet. [4] Dan Backman, "TriStrata: A Giant Step In Enterprise Security," Network Computing Magazine, 15 September 1998. Online, http://www.nwc.com/915/915sp1.html [5] Ueli M. Maurer, "A Provably-Secure Strongly-Randomized Cipher," Advances in Cryptology -- Eurocrypt '90 Proceedings, Springer-Verlag, 1990, pp. 361--373. ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

RE: GPL & commercial software, the critical distinction (fwd)
by Brown, R Ken 17 Dec '03

17 Dec '03

> James A. Donald wrote > > [oddly irrelevant stuff about Satan skipped] > > > A big company has no monetary advantage over a small company. > > > Suppose Firm A controls 90% of the market and firm B > > controls 10% of the market. Artificially low prices cost the > > big firm nine times as much as the small firm. Under > > capitalism, the small company can duke it out on equal > > terms with the big firm, and with great regularity, > > that is exactly what they do. > > Sometimes. And sometimes they don't. Sometimes half-a-dozen big boys just > gang up on the smallest. > > Anyway, your example ignores cross-subsidy whcih is the usal way to do > this. > > And bigger companies precisely *do* have a financial advantage over small > - they can borrow money at lower rates and they have more ways of hedging. > When they operate in more than one part of the world a certain amount of > hedging is built in. In general economies of scale aren't, but finance is > one area where they do work. > > There are more forms of competition than a price war Also if it comes to a > *legal* slugging match the total amount > > > >> Garbage (what we call rubbish over here) collection is > >> different again. It's not at all a nutural monopoly and > >> there is nothing stopping anyone offering to do it as a > >> business. But it is a natural for social ownership, > > > You mistake the political adventures of your local elite for > > universal laws. > > Just like you Americans do when you drivel on about guns in ways that most > other people either don't care about or find repulsive? > Anyway, I wasn't talking abou the elite but the majority. > > > In some parts of the world rubbish collection is private. > > Yes, I know that. In some parts of this coutnry also. Anywere genuinly > rural for a start. What's that got to do with what I said? > > > There is no "natural monopoly" that is not somewhere > > a private industry, and often it is a private industry in a > > place that is otherwise quite socialist. Public and private > > ownership reflect the accidents of politics and history more > > than they reflect the natural characteristics of the industry > > in dispute. > > I agree with this completely, but I don't think it invalidates anything we > said. You are confusing 3 quite different questions: > > - social ownership versus private ownership > - competition versus monopoly > - free trade versus protection > > Ken Brown > >

1 0

the camel
by Richard.Bragg＠ssa.co.uk 17 Dec '03

17 Dec '03

Camels eat first and carry afterwards so stuff a thousand bananas down its neck and get it to carry 1000 across. The remaining 1000 are to be left to ferment to make a delicious drink for the camel handler who has just persuaded a camel to eat 1000 bananas. ___________________________________________________ The information contained in this electronic mail message is confidential. It is intended solely for the use of the individual or entity to whom it is addressed and others authorised to receive it. If the reader of this message is not the intended recipient, you are hereby notified that any use, copying, dissemination or disclosure of this information is strictly prohibited. ___________________________________________________

1 0

Monitoring traffic
by Brown, R Ken 17 Dec '03

17 Dec '03

This week's New Scientist magazine (p. 6) has a short column about Xacct t5hat looks as if the journalists swallowed a press release whole and have puked it up almost undigested: "Using the Internet could become more expensive if service providers adopt new software that allows separate billing for emails, downloading graphics and streaming audio or video". It desceibes an unlikley scenario in which ISPs charge more per minute for high-quality video and less for low-quality or email. I'm not sure the journalist knows the difference between an ISP and a content provider. Yet another business that would be made obsolete by widespread use of strong encryption. Unless of course they mean to head that off at the pass by making ISPs charge more to transfer encrypted packets? When you look at their website http://www.xacct.com/usage.html you find a description of what seems like a pretty normal system monitoring application (although I'm sure it is wonderfully written) surrounded by what, when we were young and foolish, we used to call Marketdroid Waffle: "XACCTusage Family XACCTusage is a multi-source, multi-layer network usage metering and mediation solution that gives Network Service Providers (NSPs), including enterprise network (Intranet) operators, the intelligence to right-price IP services." Enough to make your teeth curl. The names of the people interviewed tickled my spoof detectors as well. "Anil Uberoi" and "Charles Arsenault" sound distinctly dodgy on this side of the Atlantic. Ken Brown

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

At 04:19 PM 10/5/98 +0100, Richard.Bragg(a)ssa.co.uk wrote: >Camels eat first and carry afterwards so stuff a thousand bananas down its >neck and get it to carry 1000 across. The remaining 1000 are to be left to >ferment to make a delicious drink for the camel handler who has just >persuaded a camel to eat 1000 bananas. You print 1000 certificates for bananas, and require the camel to accept them. Then you make him carry all 3000 across the desert. Then you print three million certificates, and declaring his certificates devalued, hand him three bananas, one of which you keep as income tax. You also keep half a banana in banana-transfer-taxes.

1 0

Java-based Crypto Decoder Ring gets NIST FIPS 140-1 certification
by Robert Hettinga 17 Dec '03

17 Dec '03

As breathlessly reported in DIGSIG :-). Cheers, Bob Hettinga --- begin forwarded text MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Date: Sat, 3 Oct 1998 09:45:19 -0500 Reply-To: Digital Signature discussion <DIGSIG(a)LISTSERV.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)LISTSERV.TEMPLE.EDU> From: Richard Hornbeck <rhornbec(a)COUNSEL.COM> Subject: Java-based Crypto Decoder Ring gets NIST FIPS 140-1 certification To: DIGSIG(a)LISTSERV.TEMPLE.EDU Java-based Crypto Decoder Ring gets NIST FIPS 140-1 certification INSTEAD OF STORING YOUR PRIVATE KEY IN SOFTWARE ON YOUR PC, KEEP IT IN HARDWARE, ON YOUR CLASS RING, KEY FOB, MONEY CLIP, WATCH OR ANYTHING ELSE THAT CAN STORE A 16mm, stainless steel case. According to its Web site (www.ibutton.com) "the iButtion provides for secure end-to-end Internet transactions-including granting conditional access to Web pages, signing documents, encrypting sensitive files, securing email and conducting financial transactions safely - even if the client computer, software and communication links are not trustworthy. When PC software and hardware are hacked, information remains safe in the physically secure iButton chip." Unlike storing your private key in software on your PC where it can remain in cache after use, and be retrieved by a hacker, the crypto iButton private key never enters your PC, so it cannot be intercepted. In July, the Crypto iButton from Dallas Semiconductor received the NIST FIPS 140-1 "Security Requirements For Cryptographic Modules" certification. The Crypto iButton provides hardware cryptographic services such as long-term safe storage of private keys, a high-speed math accelerator for 1024-bit public key cryptography, and secure message digest (hashing). To date, only 15 hardware products have been validated by the U.S. and Canadian governments. According to their press release at: http://www.dalsemi.com/News_Center/Press_Releases/1998/pr_fips.html, the Crypto iButton ensures both parties involved in a secure information exchange are truly authorized to communicate by rendering messages into unbreakable digital codes using its high-speed math accelerator. The Crypto iButton addresses both components of secure communication, authentication and safe transmission, making it ideal for Internet commerce and/or banking transactions. The Crypto iButton consists of a physically secure, million-transistor microchip packaged in a 16mm stainless steel can. Not only does the steel protect the silicon chip inside from the hard knocks of everyday use; it also shows clear evidence of tampering by leaving scratch and dent marks of the intruder. This steel case satisfies FIPS 140-1 Level 2 Tamper Evidence requirements for physical security. Note: Within the overall 140-1 certification are various sub-levels that identify how well the product rates in different categories such as Physical Security, Environmental Failure Protection, and Tamper Resistance. The sum of the ratings in the individual categories determines whether it merits certification. The iButtion also allows the owner to set an automatic expiration date, to limit the potential for unauthorized use. Once the built-in clock reaches a pre-set time, the chip self-expires and requires re-activation by the service provider before service can be renewed. The service provider can verify that an individual has possession prior to initial activation or renewal (re-activation). In this way, a lost or stolen iButton unconditionally limits the potential for unauthorized use to the remaining activation time, which can be made arbitrarily short by the iButton holder or service provider. According to its Web site, Blue Dot receptors using either the Java operating system (OS), or a proprietary OS, can be purchased online for $15 each. The receptor plugs directly into the parallel port on a PC, and includes software for configuring its features. The software also programs the decoder ring with the private key the first time, and performs any other administrative functions. Just press the Blue Dot with the iButton (ring, fob, key ring, etc.) to establish the connection path. If you know your ring size, you can order Josten's 'Java-powered ring,' or the 'Digital Decoder Ring,' online. Also available are the 'Fossil Watch, key ring, or money clip. http://www.iButton.com/DigStore/access.html#jring. Costs for a single unit range from $45 to $89. "Unlike a loose plastic card, the iButton stays attached to a carefully guarded accessory, such as a badge, ring, key fob, watch band, or wallet, making misplacement less likely. The steel button is rugged enough to withstand harsh outdoor environments and durable enough for a person to wear every day. An individual maintains control over their Crypto iButton in yet another way-a secret Personal Identification Number. If so programmed, the iButton will not perform computations until its PIN is entered, like a bank ATM. " A list of developers and their off-the-shelf applications is at: http://www.iButton.com/Connections/Catalogs/index.html. Custom, networked, server-based applications are available, in addition to individual, standalone PC products. The crypto iButtion is currently being tested by the USPS for electronic distribution of postage stamps. The company marketed its iButton products for other non-crypto uses starting in 1991. A list of current implemented and pilot projects using the product to simply store and process data around the world is at: http://www.iButton.com/showcase.html. This includes the mass-transit system in Turkey, bus passes in China, vending machines in Canada, parking meters in Brazil and Argentina, and buying gas in Mexico and Moscow. Richard Hornbeck www.primenet.com/~hornbeck --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: GPL & commercial software, the critical distinction (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 01 Oct 1998 22:28:49 -0700 > From: "James A. Donald" <jamesd(a)echeque.com> > Subject: RE: GPL & commercial software, the critical distinction (fwd) > Bullshit. No monopoly has ever happened except by regulation That is truly Bullshit. Microsoft got to where it is because of a lack of regulation, the abuses of the aircraft industry in the 1940-50's that led to regulation at the end of the 50's and 60's. The steel industry in the north east in the early 1900's. The food packing and garment industries of the north east and pacific coast in the 20's through the 50's. The railroad industry in the mid-1800's. Every one of these created a monopolistic market because of a *lack* of regulation. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

Canadian RCMP's & government workers lose vacation over Y2K
by Sunder 17 Dec '03

17 Dec '03

http://www.ottawacitizen.com/national/981003/1910271.html

1 0

[Fwd: [Spooks] Letter from a CIA officer with a gripe]
by Sunder 17 Dec '03

17 Dec '03

To: Spooks <spooks(a)qth.net> Subject: [Spooks] Letter from a CIA officer with a gripe From: Bob Margolis <rttyman(a)wwa.com> Date: Sat, 03 Oct 1998 22:30:07 -0500 Reply-To: Bob Margolis <rttyman(a)wwa.com> Sender: owner-spooks(a)qth.net February 26, 1998 Senator Lauch Faircloth 317 Hard Senate Office Building United States Senate Washington, DC 20510 Senator Faircloth: I am very concerned with recently published reports, which conclude that the Central Intelligence Agency was not involved in drug activity in connection with their activities in Latin America. As a former Central Intelligence Agency officer I had direct knowledge of matters which may be relevant in this matter. During the period of January 1986 until July 1990 I was assigned as the lead Computer Systems Analyst Programmer to a facility which was initially called Project Koral during the building phase in 1985, but upon activation was known as BYJURY within the Office of Communications (DA/OC) although this designation was later changed to OC/MIAMI. Our callsign was KKN39 and our routing indicators was RUEG and RUEGMI. Because it operated under the guise of being a U.S. Army facility it was also known as the United States Army Regional Communication Agency/National Communications System and telegraphically as RRF MIAMI. However, at no time did the facility ever support any DOD efforts. The primary mission of this facility was to support the activities of the Continuity of Government project which was identified by project cryptonyms as CHALLIS, FESTIVE, FENCER, FEDDER, PEGASUS and ZEUS and in this role the name of the facility was Atlantic Relay Facility I (ARF- 1). The overall umbrella organization for this effort was initially known as NEISS, later as NEISO and finally as SIO and at one point had space located in the basement of the Tysons Corner mall in Vienna, Virginia. The facility itself was located on U.S. Government property, which was known locally as the Richmond Naval Air Station. This same property was also the location of a University of Miami Primate Research Center, a Marine Corps Reserve unit, the Central Intelligence Facility and another NEISO activity which was identified as a unit of the U.S. Army 7th Signal Corps but which was known with NEISO as CPIC-East. The OC/MIAMI facility was staffed with approximately 15 people. A facility manager, a senior watch officer, a station engineer, a programmer analyst, three electronic technicians, an administrative assistant and 7 communications officers. Because the activities in support of the NEISO operations was minimal in peacetime, the facility was used by the Office of Communications as a major relay to provide linkages between several CIA facilities in Southern Florida (LA/MIAMI, FR/MIAMI, Miatech, FBIS Key West) and several other sites in the Caribbean and South America. In addition we also periodically provided telecommunications service to other CIA facilities whose primary relay was the Office of Communications relay facility near Culpepper, Virginia which was known for years as YOGURT but was later known as BYJAMS and still later as OC/BRANDY with a callsign of KKN50 and a routing indicator of RUES. By now I hope you realize that I did have access to the information which I am about to convey. The information given above can be verified by the CIA, although they will be extremely reluctant to do so since the extent of the NEISO project was withheld from Congress About a 18 months after my arrival at the facility we were informed that we would be the primary relay facility for a small station which was established on Swan Island in support of a variety of operations which were being conducted as part of our support for the CIA's efforts in Nicaragua. This facility was centered on an airstrip, which was used as a base of operations for pilots who were dropping supplies to the rebels, which the CIA was supporting. The communications setup for this facility was something that we called a flyaway package. Basically it consisted of a HF transmitter/receiver a PC-based communications terminal and a KG-84 encryption device. The KG-84 was considered to be one of the most secure cryptographic devices in use at that time. It came into universal use by the CIA after it became known that the Walker's had compromised the KW-7 in 1985. When the encrypted signal was received at BYJURY, it was decrypted through one of our KG-84 devices and from there the signal was passed to the SPARS message switch in unencrypted form. However, much of the traffic, which was transmitted on this circuit, was super- enciphered with One-Time-Tape (OTT). This was extremely unusual under the circumstances since electronic encryption was considered quite adequate for secure CIA communications. I know from personal experience as a communications officer prior to becoming a computer programmer that except for annual exercises to maintain proficiency in one-time- tape techniques, there was essentially no usage of one-time-tape for circuits which had secure communications circuitry. The fact that this particular station was using one-time-tape over a secure circuit was noted by all of the communicators at BYJURY and while we did not have any means whereby to decipher the messages further, it was broadly speculated that there was something happening on Swan Island which was so sensitive that it could not be entrusted to normal electronic encryption. When you consider that most Talent Keyhole and Rapport data was only afforded normal encryption, the volume of one-time-tape usage by this station can only be viewed as extremely noteworthy. If Congress decides to investigate this matter further, I also need to add that the CIA will probably state that the messages, which were transmitted to and receive from this station are no longer held. This is totally inaccurate. All message traffic into and out of CIA Headquarters is held in local storage for several weeks and after that time is no longer routinely available. However, for many years now there have been backup copies of the traffic which are transmitted on a daily basis to an off-site storage facility at Station A of the Warrenton Training Center where it is transferred to magnetic tape for permanent archives. It is highly likely that the CIA will deny that this archiving takes place because even the head of the Office of Communications probably does not realize that this is occurring since this is considered a low-level routine administrative task and quite often CIA managers above the GS-14 level simply do not have any understanding or knowledge of the actual working of the communications network. If the CIA does deny that the archiving occurs you may wish to use the power of congress to pursue the matter until they admit that the records do exist. While the actual magnetic tapes may have been replaced by more permanent storage such as CDROMS, I can pretty much assure you that the storage does exist. I am providing this information because after the extremely harsh and discriminatory treatment, which I experienced during the period of 1989-1992, I no longer feel any sense of loyalty to the CIA nor do I feel that I have any obligations to them. They were wrong in treating me the way that they did and demonstrated that they preferred to take the word of a senior manager who habitually drank alcohol while performing in his position and they preferred to protect those who were engaged in sexual improprieties. On top of that they also manipulated the federal court system to ensure that they received decisions which favored their point of view. There are apparently several federal judges and U.S. Attorney's who have profited enormously by making decisions, which prevented my case from ever being adequately heard in court. If congress is interested I could also provide information which would tend to indicate that senior officials within the Office of Communications engaged in misuse of government funds and in which official books were manipulated to make it look as if money was being spent for official purposes when, in fact, it was being spent for the benefit of senior managers in a fraudulent and wasteful manner. After all of these years I still remain angry over the treatment I received. When I became a government employee I fully intended to serve an entire career in government service, but when I was faced with treatment which was so harsh, punitive and discriminatory and when all recourse was denied to me by the so-called statutory Inspector-General of the CIA and his minions, I was placed in a position in which I had to leave government service for my own protection since I could no longer predict the capricious actions by those who held the power to make the live of an employee miserable. They were wrong in what they did and there is simply no excuse for permitting managers to have such power to destroy a human being. I can never forgive their actions and at this point the only way that I can deal with my anger is to communicate exact details of matters which I experienced as an employee in hopes that I can bring shame to the Agency. As a human being I deserved a certain level of dignity and I received none. Government agencies should be held to a standard whereby no employee is discriminated against for any reason. Please contact me if any additional information is needed on this subject. All information in this letter is in the public domain and may be disseminated freely. Kenneth C Stahl --- Submissions should be sent to spooks(a)qth.net To unsubscribe, send "unsubscribe spooks" to majordomo(a)qth.net

1 0

odd comment
by Ian Briggs 17 Dec '03

17 Dec '03

A friend of mine works in an IT department for a major tech company. Three of the people in his department were just transfered to their new contract. They are rewiring some of the network for a highway system in California that monitors for explosives. Now, he doesn't know anything more than that. In California there are several highway stretches that have large metal telephone poles stretching accross the two right lanes of a major three lane highway. On top of the poles are two metal boxes about the size large bread boxes. Now any idea what those boxes are? and if anyone has heard of this monitoring system and if so what agency is responsible for this? Also does anyone know who is responsible for all the cameras that now monitor the highways? Almost every overpass in Sacramento has one that views each stretch of the highway. -Ian Welcome to 1984 as with all goverment projects, its a bit late and slightly overbudget -IB.

1 0

one-time pad
by bill payne 17 Dec '03

17 Dec '03

Orlin http://www.aci.net/kalliste/ and, of course,http://www.aci.net/kalliste/bw1.htm I got a big kick reading http://www.jya.com/tristrata.htm Especially, While a one-time pad is, in fact, theoretically unbreakable when used properly, the details of using it properly make it entirely unusable in any modern commercial or military setting. And This kind of system was used for the U.S.-Soviet teletype "hot line" and it is occasionally used for paper ciphers and spies, but that's it. Codes and Cryptography by Dominic Welsh references on page 126 Sandia's Gus Simmons as the source of the above. (And if users can exchange these keys, why can't they just exchange the messages?) I think the reason is that the users want to exchange keys for messages to be sent at a later time, perhaps electronically. But we have to stick to the position. Does the algorithm pass the Black and White test or not? No buts. Let's all hope for settlement of this UNFORTUNATE matter before it gets WORSE. bill Title: Black and White Test of Cryptographic Algorithms Jump to Forum Click Image to Jump to Next Article Go to Text Only Print Version Black and White Test of Cryptographic Algorithms by William H. Payne This article requires special formatting. Please Click Here to Read Send This Article to a Friend: Your Name: Email Address of your Friend: Your Email address: Back to Home Page Quick Menu Visit the Button Shop Interactive Forum Black and White Test of Cryptographic Algorithms E-mail the Editor

1 0

keep up-wind - you think we are KIDDING?
by bill payne 17 Dec '03

17 Dec '03

Subject: Effects of Nukes Date: Mon, 05 Oct 1998 09:47:43 -0600 From: bill payne <billp(a)nmol.com> To: gap(a)igc.apc.org, tom carpenter - halcyon <tomcgap(a)halcyon.com>, jeff debonis <76554.133(a)compuserve.com>, lawya(a)lucs-01.novell.leeds.ac.uk, senatorlott(a)lott.senate.gov, senator_leahy(a)leahy.senate.gov, conrad_burns(a)burns.senate.gov, larry_craig(a)craig.senate.gov, senator(a)wyden.senate.gov, dpcintrn(a)osd.pentagon.mil, conrad_burns(a)burns.senate.gov, senator_gorton(a)gorton.senate.gov, senatorlott(a)lott.senate.gov, john_ashcroft(a)ashcroft.senate.gov, michigan(a)abraham.senate.gov, sam.brownback@.senate.gov, senator(a)dorgan.senate.gov, senator_stevens(a)stevens.senate.gov, senator(a)hutchison.senate.gov, olympia(a)snowe.senate.gov, senator(a)hollings.senate.gov, senator(a)inouye.senate.gov, wendell_ford(a)ford.senate.gov, senator(a)rockefeller.senate.gov, john_kerry(a)kerry.senate.gov, senator(a)breaux.senate.gov, senator(a)bryan.senate.gov, HERBERT.RICHARDSON(a)hq.doe.gov, BILL.RICHARDSON(a)HQ.DOE.GOV, pcassel(a)rt66.com, gregh(a)scene.com CC: senator(a)wellstone.senate.gov, jy(a)jya.com, senator_mccain(a)mccain.senate.gov, grassley <chuck_grassley(a)grassley.senate.gov>, cynthia mckinney <CYMCK(a)mail.house.gov>, c paul robinson <cprobin(a)sandia.gov>, art morales <armoral(a)sandia.gov>, cypherpunks(a)toad.com, ukcrypto(a)maillist.ox.ac.uk Monday 10/5/98 7:01 AM Tom Carpenter http://www.whistleblower.org/ I hope your week-end conference went well. I think I will in Pullman in a few weeks. And, therefore, almost a DOWNWINDER. When I was a prof at Washington State University 1966-79 we traveled to Spokane. I always wondered why I saw so many sick kids in Spokane. I think we all now know a possible reason. Albuquerque Journal Sunday 10/4/98 Heath Effects of Nuke Sites Targeted DOE's Richardson to Review Reports The Associated Press DENVER - U.S. Energy Secr- ary Bill Richardson says he will investigate reports of health prob- lems among people living near or working at federal nuclear weapons. plants and research facilities in 11 states. A total of 410 people told a news- per, The Tennessean, they are suffering from unexplained illness- including tremors, memory toss, fatigue and a variety of breathing, muscular and reproductive prob- lems. Their doctors cannot explain why they are sick. No direct link has been estab- lished between the illnesses and the "I want to be absolutety sure we're erring on the side of making sure there are no problems." U.S. ENERGY SECRETARY BILL RICHARDSON Department of Energy sites. But doctors, scientists and lawmakers say it's large enough to warrant a comprehensive study to try to find the cause. "My views we ought to get to the bottom of this," Richardson told the newspaper after meeting Friday with residents near the Rocky Flats nuclear site in Denver. "I want to be absolutely sure we're erring on the side of making sure there are no problems." Scientists have been concerned for decades about radiation from nuclear production and its link to cancer But no one has ever looked into noncancerous illnesses. During a 22-month investigation, the newspaper found ill people at 13 DOE sites in Tennessee, Colorado, South Carolina, New Mexico, Idaho, New York, California, Ohio, Ken- tucky, Texas and Washington. The Energy Department had ear- lier said it does not plan to take a comprehensive look at the issue. http://www.tennessean.com/special/oakridge/part3/index.shtml Here is some other relevant information about the U.S. goverment, Department of Energy, and nukes from Wierd History 101 by John Richard Stephens http://www.thegrid.net/fern.canyon/weird/contents.htm [A]nd then there are the legitimate concerns of terrorists using nuclear weapons. This risk is emphasized by the many incidents where the smugglers of nuclear components have been caught. But let's not get into that. Ever since the bombs were dropped on Hiroshima and Nagasaki, people have worried about having one of these horrors dropped on them. Since the demise of the Soviet Union, this threat has become more nebulous, making it a bit more difficult for people to focus their fears.16 As a result, their fears have diminished somewhat even though the threat has probably increased because of the increase in countries that have the 16 As of 1997, Russia and the United States still had about seven thousand strategic (or long rang) warheads each. Roughly half of these could be launched with a few minutes notice. bomb and the advances in technology that enable a bomb to be made from fissionable material the size of a beer can, while a bomb that can level a city can now be made to fit into a knapsack. But during the Cold War, the threat seemed much more immediate. Partly in response to these fears, the govern- ment implemented programs to teach people how they could protect themselves in the event of a nuclear attack. Early efforts downplayed the risks. One amazing example of this is the pamphlet Survival Under Atomic Attack. Published by the U.S. government in 1950, this official booklet proclaims, "You can SURVIVE. You can live through an atom bomb raid and you won't have to have a Geiger counter, protective clothing, or spe- cial training in order to do it." And then it goes on to give such advice as, 'After an air burst, wait a few minutes then go help to fight fires. After other kinds of bursts wait at least 1 hour to give lingering radiation some chance to die down." Discussing the role of the IRS in a nuclear attack, the Internal Revenue Service Handbook (1976) says, "During a state of national emergency resulting from enemy attack, the essential functions of the Service will be as follows: (1) assessing, collecting, and recording taxes. . . Where is the Best Place to Go? If you live in a State where there is danger from sudden storms like cyclones or hurricanes, you may have a "cyclone cellar" or something similar. If so, you have a shelter that will give excellent protection against atomic bombs. [People soon realized this wasn't quite true, and they began building bomb shelters.] "All you have to do to protect yourself from radiation is go down to the bottom of your swimming pool and hold your breath." -David Miller Department of Energy spokesperson [S]o there you have it. You're now prepared to survive nuclear warfare. Think you can handle it? Actually, it's very hard to believe that, after five years of intensively studying the effects of atomic bombs and radiation at Hiroshima, Nagasaki, and various tests involving military personnel as human guinea pigs, the government didn't have a better idea of the dangers. My fellow Americans. I am pleased to tell you I just signed legislation which outlaws Russia forever. The bombing begins in five minutes." -President Ronald Reagan during a sound check for a live radio show, 1984 [I]n one of the tests in 1953, U.S. soldiers were placed near the explosion to test how well they could function after a blast. Sergeant Reason Warehime was one of fifty soldiers who were in a trench two miles from ground zero. They wore no protective gear. The first thing I saw" he later reported, was a real bright light like a flashbulb going off in my face, but it stayed on. It was so bright that even with sunglasses on, my hands over my eyes, and my eyes closed, I could actually see the bones in my hands. I felt as if someone was hugging me really tight, and my whole body was being compressed. All of a sudden, I heard an awful noise and felt an intensely hot wind blowing and the ground rocking like an earthquake. The dust was so thick I could not see the man right next to me. The air was so hot that it was difficult to breathe. . . . Since the fireball was directly over our heads, there is no doubt in my mind that we were in the 'stem' of the mushroom cloud." A voice over a loudspeaker ordered them to advance toward ground zero. The sandbags along the top of their trench were on fire. On reaching a bunker that was just over a mile from ground zero, they found eight men. "Those guys were sick as dogs and heaving their guts out," he said. Soon they began finding spots where the sand had melted into glass. After reaching the crater, they turned back and eventually were picked up by two radiation specialists in full protective gear. On the way back, Warehime and some of his companions started throwing up. A few months later; all of his hair fell out, his teeth began to rot, and he was diagnosed as sterile. Eventually, he developed cataracts, lung cancer; his bones became brittle, and he had to use crutches to get around. Even though radiation is known to cause these things, in the 1980s, the Veterans Administration insisted his problems weren't caused by this bomb and denied disability to him and many others like him. An estimated 250,000 military personnel were exposed to radiation in experiments between 1946 and the 1970s. Many additional civilians were also used as guinea pigs in radiation tests. Very few have ever received any compensation for or assistance with the perma- nent damage caused to them. Warehime was exposed to a forty-three- kiloton (not megaton) bomb. It turned out to be almost twice as powerful as the physicists had calculated it would be and was about twice as powerful as those used on Hiroshima and Nagasaki. Its radiation cloud spread across the nation from Nevada, fogging undeveloped film as far away as New Jersey. Morales and I are in the planning stage to put up a web site. John Young has been encouraging us to do this. Reason is that we are going after the judges and clerks in the Tenth circuit who awarded our court wins to Sandia we, in fact, we won. Now that John Young got the docket for us. Also I will be doing a Privacy Act violation defamation lawsuit against Sandia, DOE, EEOC, Lockheed Martin, AT&T, and named defendants. We will have several FORUMS. 1 Pro se litigation against the U.S. Federal government 2 Microsoft Assembler mixed-language programming 3 80C32 hardware, Forth high-level and assembler programming. at least. John Young started 3. http://jya.com/f86/whpf86.htm 1 and 2 may be compatible. Microsoft distributes buggy software while Gates, Paul Allen, and Balmer become some of the richest men in the world. Perhaps, with some legal encouragement, the above three should spend some of their money getting the bugs out of their software. To kick-off 1 and 2 I am thinking of posting a complaint against Microsoft for having scammed me by not included a 32 bit linker with MASM 6.11 I just bought. If we dont settle, of course. I will check e-mail in a few minutes to see how progress to get the 32 bit linker is coming. Microsoft appears to want me to buy a C compiler or Windows NT SDK [software development kit] to get the 32 bit linker. With all this scary stuff of effects of nukes, lets hope Rep. McKinney and Senator Grassley are making progress to help get NSA to post the requested documents. http://jya.com/whpfiles.htm And, too, lets ALL hope for settlement so that we can move on to other constructive projects. Before things GET WORSE. Later bill Subject: one-time pad Date: Mon, 05 Oct 1998 17:06:53 -0600 From: bill payne <billp(a)nmol.com> To: j orlin grabbe <kalliste(a)aci.net>, conrad_burns(a)burns.senate.gov, senator_gorton(a)gorton.senate.gov, senatorlott(a)lott.senate.gov, john_ashcroft(a)ashcroft.senate.gov, michigan(a)abraham.senate.gov, sam.brownback@.senate.gov, senator(a)dorgan.senate.gov, senator(a)wyden.senate.gov, senator_stevens(a)stevens.senate.gov, senator(a)hutchison.senate.gov, olympia(a)snowe.senate.gov, senator(a)hollings.senate.gov, senator(a)inouye.senate.gov, wendell_ford(a)ford.senate.gov, senator(a)rockefeller.senate.gov, john_kerry(a)kerry.senate.gov, senator(a)breaux.senate.gov, senator(a)bryan.senate.gov, nmir(a)usa.net, Info(a)IranOnline.com, info(a)jebhe.org, Mehrdad(a)Mehrdad.org, cypherpunks(a)toad.com, ukcrypto(a)maillist.ox.ac.uk, wpi(a)wpiran.org, abd(a)CDT.ORG, merata(a)pearl.sums.ac.ir, dpcintrn(a)osd.pentagon.mil, abumujahid(a)taliban.com, schneier(a)counterpane.com CC: jy(a)jya.com, john gilmore <gnu(a)toad.com>, Emile Zola <ezola(a)lfcity.com>, lennon(a)email.nist.gov, itl-bulletin(a)nist.gov Orlin http://www.aci.net/kalliste/ and, of course,http://www.aci.net/kalliste/bw1.htm I got a big kick reading http://www.jya.com/tristrata.htm Especially, While a one-time pad is, in fact, theoretically unbreakable when used properly, the details of using it properly make it entirely unusable in any modern commercial or military setting. And This kind of system was used for the U.S.-Soviet teletype "hot line" and it is occasionally used for paper ciphers and spies, but that's it. Codes and Cryptography by Dominic Welsh references on page 126 Sandia's Gus Simmons as the source of the above. (And if users can exchange these keys, why can't they just exchange the messages?) I think the reason is that the users want to exchange keys for messages to be sent at a later time, perhaps electronically. But we have to stick to the position. Does the algorithm pass the Black and White test or not? No buts. Let's all hope for settlement of this UNFORTUNATE matter before it gets WORSE. bill --- laszlo http://www.qainfo.se/~lb/crypto_ag.htm Sayonara 1 crypto ag 2 wiegand wires There are some good business opportunities. If we live that long. WE believe that the OTHER SIDE is NOT happy about what happened. NSA Hoe Cryptogate /JI October 5, 1998 http://www.jya.com/crypto.htm --- False Security William H. Payne Abstract "Why 130 million Wiegand cards are in use throughout the world . The most secure of all access card technologies. HID Wiegand cards are virtually impossible to counterfeit... any attempt to alter them destroys them! ... Since no direct contact with the card is required, they are totally enclosed, making them absolutely immune to the elements and a frustration of vandals. ... The secrets to the security of an HID Wiegand card are those little enclosed wire strips. Once corrupted, they won't work." Access Control & SECURITY SYSTEMS INTEGRATION, September 1998 www.prox.com http/www.securitysolutions.com http://www.securitysolutions.com/ *** Bullshit.*** False! - in the EDITED edition, of course Fumble, Bumble and Inept Funds Electronic Lock Breaking at Sandia National Laboratories. Zola http://zolatimes.com/ Would this be worth some bucks? Want another FUN article? http://www.zolatimes.com/v2.29/bw1.html http://www.aci.net/kalliste/bw1 I would need a BRILLIANT EDITOR to help polish the ms. http://www.aci.net/kalliste/ Counterfeiting Wiegand Wire Access Credentials Bill Payne October 16,1996 Abstract Wiegand wire access credentials are easy and inexpensive to counterfeit. Access Control & Security Systems Integration magazine, October 1996 [http://www/securitysolutions.com] published the article, Wiegand technology stands the test of time by PAUL J. BODELL, page 12 Many card and reader manufacturers offer Wiegand (pronounced wee-gand) output. However, only three companies in the world make Wiegand readers. Sensor Engineering of Hamden Conn., holds the patent for Wiegand, and Sensor has licensed Cardkey of Simi Valley, Calif., and Doduco of Pforzheim, Germany, to manufacture Wiegand cards and readers. ... A Wiegand output reader is not the same thing as a Wiegand reader, and it is important to understand the differences. In brief, Wiegand reader use the Wiegand effect to translate card information around the patented Wiegand effect in which a segment of a specially treated wire generates an electronic pulse when subjected to a specific magnetic field. If the pulse is generated when the wire is near a pick-up coil, the pulse can be detected by a circuit. Lining up several rows of wires and passing them by a cold would generate a series of pulses. Lining up two rows of wires - calling on row "zero bits" and the other "one bits" - and passing them by two different coils would generate two series of pulses, or data bits. These data bits can then be interpreted as binary data and used to control other devices. If you seal the coils in a rugged housing with properly placed magnets, and LED and some simple circuitry, you have a Wiegand reader. Carefully laminate the special wires in vinyl, and artwork, and hot-stamp a number on the vinyl, and you have a Wiegand card. IN THE BEGINNING Wiegand was first to introduce to the access control market in the late 1970s. It was immediately successful because it filled the need for durable, secure card and reader technology. Embedded in the cards, Wiegand wires cannot be altered or duplicated. ... Bodell's Last statement is incorrect. Tasks for EASILY counterfeiting Wiegand wire cards are 1 Locate the wires inside the card to read the 0s and 1s. 2 Build an ACCEPTABLE copy of the card. Bodell's clear explanation of the working of a Wiegand card can be visualized zero row | | | one row | | binary 0 1 0 0 1 representation Solutions to Task 1 A X-ray the card B MAGNI VIEW FILM, Mylar film reads magnetic fields ... Edmunds Scientific Company, catalog 16N1, page 205, C33,447 $11.75 is placed over the top of the Wiegand card. COW MAGNET, Cow magnetics allow farmers to trap metal in the stomachs of their cows. Edmunds, page 204, C31,101 $10.75 is placed under the card. Location of the wires is easily seen on the green film. Mark the position of the wires with a pen. Next chop the card vertically using a shear into about 80/1000s paper-match-sized strips. Don't worry about cutting a wire or two. Note that a 0 has the pen mark to the top. A 1 has the pen mark at the bottom. Take a business card and layout the "paper match"-like strips to counterfeit the card number desired. Don't worry about spacing. Wiegand output is self-clocking! Tape the "paper-match - like" strips to the business card. Only the FUNCTION of the card needs to be reproduced! History Breaking electronic locks was done as "work for others" at Sandia National Laboratories beginning in 1992 funded by the Federal Bureau of Investigation/Engineering Research Facility, Quantico, VA. The FBI opined that this work was SECRET/NATIONAL SECURITY INFORMATION. Details of the consequences of this work are covered in Fired Worker File Lawsuit Against Sandia Specialist Says He Balked When Lab Sought Electronic Picklock Software, Albuquer Journal, Sunday April 25, 1993 State-sanctioned paranoia, EE Times, January 22, 1996 One man's battle, EE Times, March 22, 1994 Damn the torpedoes, EE Times, June 6, 1994 Protecting properly classified info, EE Times, April 11, 1994 DOE to scrutinize fairness in old whistle-blower cases, Albuquerque Tribune, Nov 7 1995 DOE boss accelerates whistle-blower protection, Albuquerque Tribune, March 27, 1996 DOE doesn't plan to compensate 'old' whistle-blowers with money, Albuquerque Tribune September 27, 199

1 0

Best online casino odds
by Gambler＠msn.com 17 Dec '03

17 Dec '03

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> The best odds and easy cashier options at any online casino is at: <P> <A HREF="http://www.starluck.com/cgi-win/ad/merchants.exe/vendor-a30 4">Virtual Casino</A> <BR>Great games, graphics, and sound too.</HTML>

1 0

US Rights Violations
by John Young 17 Dec '03

17 Dec '03

We offer Amnesty International's devastating critique of US human rights violations, due to be released in hardcopy tomorrow: http://jya.com/usa-rfa.htm (365K) It recounts in voluminous, documented, gruesome detail what American justice is truly like in prisons, jails, precinct houses, on the highways and in the streets. After this it's going to difficult for the US to preach human rights violations to other countries.

2 1

Best online casino odds
by Gambler＠msn.com 17 Dec '03

17 Dec '03

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> The best odds and easy cashier options at any online casino is at: <P> <A HREF="http://www.starluck.com/cgi-win/ad/merchants.exe/vendor-a30 4">Virtual Casino</A> <BR>Great games, graphics, and sound too.</HTML>

1 0

Re: Camel
by Neels Kriek 17 Dec '03

17 Dec '03

OK, here is my solution ;) Load 1000 bananas on the camel. Make him walk 990 miles. 10 banana left. Get 10 unemployed people. Make them carry 200 bananas each. Since no-one can eat more than 1 banana per 10 miles(at a sustained rate anyways) make them walk 990 miles. 1010 bananas left. Load 990 on the camel. Each guy has 1 banana left for the last 10 miles. Camel eats 10 bananas on last 10 miles. QED 990 bananas on the other side. or Make camel walk a mile. Make him stop. Walk back and carry all 2000 bananas left to current spot. Put one banana on camel to get 1000 again. Make him walk 1 mile again and repeat. At other side unload 999(or 1000 if you were clever enough to carry the extra one that the camel eats on the last mile in your pocket) bananas. Leave one on the camel for the mile back. Walk camel back a mile . load 1000 bananas. Unload 999 bananas. You should now have 1998 bananas. or Buy a damned 4X4. We all know camels don't like bananas and would rather bite you than carry 1000 of them. Regards ;)

1 0