December 2003 - cypherpunks-legacy

Re: quetion about Multi-user systems
by Pierre Uszynski 17 Dec '03

17 Dec '03

> On Wed, 23 Feb 1994, Eric Johnson wrote: > > [...] So perhaps I could just download my > inbox, but then sending the mail messages may be > difficult, since their is no place I can just send them. > [...] > I figure yo could just upload a file with all of your > replies and new mail, and then have a script mail each of > those letters. That way my secret key stay on my home > system, very safe, and I can use emacs to answer read and > encrypt all my mail with ease. Using kermit & Co, and then a script to transfer files composed and signed at home for mailing from your internet account is too tedious. But I believe you mentioned you are using Linux on your PC. Sooo, here are two solutions that should work in any real (non-Microsoft) window system: 1) Compose and sign each message on the PC. Then, while on-line with the remote computer, cut and paste the already-signed message directly into the remote mail line editor. (Cutting and pasting in such a way sometimes gets you in trouble with various buffering bugs, but you'll quickly figure out how much text you can paste at a time. Once a piece of text is signed, make sure you don't introduce more spaces, blank lines and such !) Once you have cut-and-paste running, it should not matter on which system you read your mail, on which one you compose new messages, or on which one you sign. Cutting and pasting very long messages will still be a pain. 2) Use a mud client (or similar) instead of kermit to connect to the remote system. Sending mail is then done by using the usual commands to get the remote system into the mailer line editor and then using a client macro of some sort to sign, transfer and send a message prepared locally. This solution will require some programming (very little on Linux, maybe quite a bit on a MacIntosh). Pierre Uszynski pierre(a)shell.portal.com

1 0

Re: quetion about Multi-user systems
by Pierre Uszynski 17 Dec '03

17 Dec '03

> Only minutes ago, I wrote: > > 2) Use a mud client (or similar) instead of kermit to connect > to the remote system. Sending mail is then done by using the > usual commands to get the remote system into the mailer line > editor and then using a client macro of some sort to sign, > transfer and send a message prepared locally. This solution > will require some programming (very little on Linux, maybe quite > a bit on a MacIntosh). Heck, you can even program all that in kermit script programs. (I have version 5A(170) here.) It's just that these programs look (incredibly) ugly. Pierre Uszynski pierre(a)shell.portal.com

1 0

re: CERT funding
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

>From Mark Hittinger: > Don't get too worried about CERT and its budget. It is precisely when someone says "don't get worried about _____" when I begin to wonder exactly what they have to hide. > The staff seemed to be all comp-sci grad student types. The main guy was > your typical visionary professor type. Before I spoke with him he was > interrupted by a call from someone at DARPA about their funding. I am > certain that he was having trouble convincing his funders that the problems > were growing and that CERT's budget should expand. I got the impression > that continued funding of CERT was not a done deal and that even keeping > the current level of funding was uncertain. Every government bureaucrat I have met says exactly the same thing. The idea is to always give the impression of being "hungry" -- if you think your budget is adequate, obvious it is too much, and if you think your sources of funding are "secure", then you are taking them for granted. Believe me ... I played the game for many years. > My point - the funding was not substantial and it was not "reliable" > funding. Their hardware was fairly recent but I did see a lot of > "old soldier" type computer equipment still in service. There was > mostly SUN, some DEC R4000 stuff, and maybe a microvaxII. Most definetly > not NSA funded. It is funded by DARPA/USAF just like most old arpanet > activity was. You are very naive! Just because something is funded by an intelligence agency does NOT mean that it is going to be a brand-new, state of the art system. The 3-letter agencies have LOTS of old but serviceable Suns, DECs, Macs, PCs, etc. internally and their contractors have the same. Yes, if they were doing cryptanalysis they'd have beefier gear, but that is not what CERT does. The problem is that when one is funded by DARPA or directly by one of the armed services, the amount of your award is supposed to be public. Usually companies announce it via a press release -- it is prestigious. HOWEVER, it is usually a condition of doing business with the intelligence community that the existence and amount of your contract award is kept secret. THat's just the way they work. Don't be lulled by the "grad-student" types either. the intelligence agencies have funded a lot of university-affiliated research. Most of the grad students and first-real-job people aren't privy to the internal funding and resposbility and deliverables of the group. Were you asked about your ability to get a security clearance? According to one article, CERT people now are getting clearances. Interesting. > I was also surprised to find out that there were several organizations > other than CERT executing the same functions for each government agency. > I learned that there was one for the navy, the dod, the cia, and probably > even the coast guard! :-) I wondered aloud about how much information > these groups shared and I got the impression that the other groups might > not have trusted CERT too much with good information. In other words > there is probably a group that you guys should be worried about because > they are deeper in the black and they don't trust the CERT guys either! > :-) :-) Yes, other CERT-type teams exist. They are collected in an organization called FIRST, the Federation of Incident Response Teams. They do share (some) info. Blackworld teams have different issues and do not generally participate, since their risk exposure is different and their issues are usually different as well. But they exist too. Sign me... "one who knows"

1 0

Stealth PGP and Stegonagraphy (LONG)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

Making Stealth PGP (random noise) Files "Undetectable" INITIAL PROBLEM: The following ideas were developed in response to the concern over the future legal implications of possessing encrypted files. If non-Clipper encryption becomes illegal, even the mere possession of possible non-Clipper-encrypted files may be grounds for a search warrant, confiscation of equipment, and miscellaneous court sanctions. PRACTICAL OBJECTIVE: The possession of encrypted files must be made virtually undetectable, even to the most determined and best informed opponent. BASIC PREMISE: On many machines the file system allows users to "delete" files without actually erasing them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it is possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. CHALLENGES: I - Miscellaneous disk writes, such as those performed routinely by DOS, can overwrite the "deleted" files. II - Certain security measures on the part of the user may make recovery of the hidden file non-trivial. Ideally, the file will not have an "End Of File" marker, a file name, nor an entry in the File Allocation Table. III - Upon examination of the deleted segment of a disk, the aware opponent will notice the discrepancy between a large, highly-random noise-segment and the "structured garbage" that will make up most of the rest of the deleted portion of the disk. PROPOSED SOLUTIONS: I - To ensure the integrity of the hidden data, all disk writes must be directly controlled by the user, not DOS. A - Use of a floppy disk is recommended; as, controlling each individual disk-write operation on a harddrive becomes infeasible due to the large amount of said operations. B - The user should specify and keep track of the exact address and length of the encrypted file when writing it to disk. The file's location/length should be guarded as dearly as one's secret key and corresponding password, for similar reasons. II - Keeping track of the exact address and length of the hidden file will allow easy file recovery, without need for an EOF marker, a file name, nor a FAT entry. III - In order to make one's file deleted file virtually indistinguishable from the rest of the deleted portion of the disk, the implementation of one of the following measures is recommended. A - Split the noise file into small individual files and scatter them throughout the "structured garbage" that is already on the disk. It should blend in with the other little pieces of highly random noise that are naturally interspersed in the deleted portion of the disk. Recovery would, of course, require one to keep track of the addresses, lengths, and order of the component files. B - Use a stegonagraphy utility to hide one's file in a segment of "structured garbage". A Mimic function with a "structured garbage" grammar would be highly usefull for this. DISCUSSION: All of the above speculation relies on the use of Stealth PGP, or a similar program that encrypts plaintext into a format indistinguishable from random noise. Unless this stegonagraphic function is implemented detection of the encrypted file, even when hidden among megabytes of other "deleted" files, will be trivial; as, PGP has a distinct header. The success of the above method also relies on the use of non-standard locations for the hidden files. For, if this method becomes popular, _and_ everyone starts hiding their files in the last few sectors of the disk, for example, a significant portion of the method's effectiveness may be compromised. It should be noted that as long as the user is writing directly to and reading directly from the disk (bypassing DOS), "deletion" of the file is no longer necessary. It is necessary to keep the blocks one writes to marked as "FREE", "BAD" or "DELETED" (take your pick!). Some modification of the FAT or equivalent may be required here. SUMMARY: In order to hide a Stealth PGP (or equivalent) encrypted "noise" file effectively one may follow the steps outlined below: 1 Embed it in "structured garbage" such as is present normally on the deleted portions of the disk. This can be accomplished by using a stegonagraphy program or by splitting the file into small segments and scattering them among "structured garbage". 2 Write the resulting "structured garbage"/noise combination directly to disk. This can be accomplished by using a normal disk-sector editor utility. 3 Keep track of the exact location and size of the file if you want to retrieve it later. Keep this information secure. 4 Modify the FAT (or equivalent) to mark the sectors you've written to as "FREE", "BAD", or "DELETED" (if necessary). In order to retrieve and reconstruct one's file simply reverse steps 2 and 1. THANKS: I wish I could thanks everyone who has commented on this thread individually. Unfortunately, I am rather new to this. Next time, I'll know to keep track of each response/address/name instead of simply replying to your mail/posts. You know who you are. Thank you! Keep you comments flowing! All feedback welcome, Sergey

1 0

Stealth PGP and Stegonagraphy (Summary)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

In order to hide a Stealth PGP (or equivalent) encrypted "noise" file effectively one may follow the steps outlined below: 1 Embed it in "structured garbage" such as is present normally on the deleted portions of the disk. This can be accomplished by using a stegonagraphy program or by splitting the file into small segments and scattering them among "structured garbage". 2 Write the resulting "structured garbage"/noise combination directly to disk. This can be accomplished by using a normal disk-sector editor utility. 3 Keep track of the exact location and size of the file if you want to retrieve it later. Keep this information secure. 4 Modify the FAT (or equivalent) to mark the sectors you've written to as "FREE", "BAD", or "DELETED" (if necessary). In order to retrieve and reconstruct one's file simply reverse steps 2 and 1. For a more detailed discussion of the above method, see the associated message, entitled "Stealth PGP and Stegonagraphy (LONG)". Sergey

1 0

Re: STEALTH OCEANS (fwd)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

On Thu, 24 Feb 1994, Matt Thomlinson wrote: > > Sergey Goldgaber <sergey(a)delbruck.pharm.sunysb.edu> writes: > > >> might work, except for the fact that fragmentation _does_ go on, and when > >> you were to write files to the drive (heck, I do every time I start up > >> windows and write a huge temp swapfile) you're going to be playing > >> roulette with your data. > > >This problem is solved by simply using a utility that writes directly to the > >disk (exactly in the specified sectors, in the specified order), instead > >of letting DOS fragment your disk. > > > I've been talking to Sergey behind the scenes, and I think I understand > what our miscommunication was: he is proposing this type of technique > ONLY for removable-type media, e.g. floppies. I am proposing this as a practical solution that can be implemented effectively mainly on floppies. Hard-drives might have to be dedicated to stegonagraphy (As Matt points out below). > To store this type of data on your harddrive would be to dedicate your > harddrive to stego. This was my argument all along; what we failed to > connect on was the fact that only floppies are involved. With floppies, > every write *can* be controlled and the data would be relatively safe (and > obscure, for that matter). > So it seems. However, I am wary of the possibility that there are drawbacks to the scheme that I haven't even considered yet. I'm hoping that other astute readers such as yourself may be able to point them out; as, practical stegonagraphy may become a necessity in the near future. > > This correction is being posted to the list because his original post > said nothing about removable media. > My original post only outlined the basic premises. I had not, at that point, realized that floppy use would be a virtual necessity. > > mt > > Matt Thomlinson Say no to the Wiretap Chip! > University of Washington, Seattle, Washington. > Internet: phantom(a)u.washington.edu phone: (206) 548-9804 > PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu > > Thanks for your insights and neverfailing tenacity, Matt. Sergey

1 0

Re: CERT funding
by smb＠research.att.com 17 Dec '03

17 Dec '03

Thanks, Mark, for an interesting posting about CERT. Let me add just one or two comments about the place. That CERT should be interested in software engineering is a very good sign. What do you think causes most security holes? It *isn't* lack of cryptography, for the most part, though this last big incident is an obvious exception. The answer, of course, is bugs in the code -- and to that, software engineering is the only answer from computer science as a whole. (Bob Morris Sr's keynote address at the last UNIX Security Conference was entitled ``if your software is full of bugs, what does that say about its security?'') As for the database stuff -- from what the folks at CERT have told me (and yes, I know some of them quite well), they're having a problem managing the tremendous volume of bug reports, incident reports, etc. They need to do their own tool-building. Finally, there are some folks at CERT who are *extremely* sharp. I don't know who you talked to, but there are people there I'd hire in an instant if they were available.

1 0

Re: BIX musings on Zimmermann
by walter kehowski 17 Dec '03

17 Dec '03

################################# peace(a)BIX.com muses on Zimmerman: I think about that, it was Isaac Asimov in his story about an invention which allowed people to see back into time. Suppressed by the Government, it was independently re-invented by a professor who only got curious about the topic when he realised it was classified. The catch; when does time begin? one second ago?, one nano-second ago?. With the invention, privacy became a thing of the past; you could go anywhere, see anything. Its kind of a neat twist on this issue. The government would have us believe encryption is a *bad thing* because bad guys will use it to hide their activities. ################################# You've joggled my memory. The Isaac Asimov story referred to in "BIX musings on Zimmermann" is "The Dead Past". Another twist on this issue is that the government was cast as the good guys actually protecting the rest of the world from the wide spread use of the "neutrino-gravitic" time-viewing technology whereas the scientists were acting out of "misguided" notions of freedom of access to the information and technology. When the scientists are finally apprehended they gloat over the fact that the technology is now freely available. The gov't failed to stop them. (The time-viewing apparatus is easy to build.) When the official makes clear what the consequences are (the past is now dead - anybody with a TV set can now monitor anybody anywhere anywhen), the scientists are ashamed of themselves. However, it's important to note that the government was not above using the technology to suppress the spread of the technology. What such a monitoring agency would become in twenty years or so is clear. Just how paranoid could it get? ("Crisis and Leviathan" - When the crisis has passed, the institutions set up to deal with it remain.) It is interesting to speculate on the analogy between Zimmerman's PGP and Clipper and the "neutrino-gravitic" time-viewing technology which the government is not above using for ostensibly noble ends. Walter A. Kehowski <wak(a)next0.math.pitt.edu>

1 0

Re: Give me your privacy and I will protect you.
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Michael Johnson <mpj(a)csn.org> > > Just say "NO!" to harmful drugs, promiscuous sex, the ITAR's restrictions on ^^^^^^^^^^^^^^^ Please, tell me this is a joke. > strong cryptography, and Key Escrow! Write YOUR Congressional Representative > NOW and express support for Maria Cantwell's bill to ease restrictions on > privacy software! --Dave.

1 0

Rising dishonesty level
by Brad Dolan 17 Dec '03

17 Dec '03

jimn8(a)netcom.com remarks about the rising level of dishonesty in (presumably) media/political circles: *It's bad* I once had a faint hope that a change in administrations would reverse the tide. I'm over that now. People from eastern Europe recognize a lot of what they see developing here, as a recent poster noted. jimn8 further wonders if anybody knows a better country to live in: I know of several that are less intrusive in your private affairs. Unfortunately, it's hard for an American to find work in most of them. I've made up a list of decision rules about when it's time to flee to the first place I can find "three hots and a cot" (Places like Belize, for instance). Try compiling your own list, it's an interesting exercise. My rules: It's time to leave when... ... I can't say what I want. ... I can't own a gun. ... I can't use good crypto. ... I can't leave and enter the U.S. freely. Brad bdolan(a)well.sf.ca.us Somewhat related: Does anybody find it interesting that no one noted for over a decade that Ames had (1) a lavish lifestyle and (2) a foreign-born (Colombian!) wife. Normally, spooks aren't allowed either. A cynic might say that the lavish lifestyle was overlooked because it was attributed to the Colombian connection, and not to the other extracurricular activities. -bd

4 3

Net restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

I don't know if this is correct, but from what I have read it seems that the Net needs and will be restructured somtime in the future. I think our biggest concern when it happens will be that Clipper like encryption and monitoring will be implmented as a standard. Who knows maybe the net will be run by the government. Reuben Halper -anger is a gift- rage aginst the machine/Freedom

1 0

STEALTH OCEAN
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt Thomlinson asks: >I can see how a stealth-PGP would allow you to hide messages on >your disk in "wiped" filespace -- it'd look like garbage (maybe -- >see Aside), if anyone took a look. What does this buy you, though, >if you've got a telltale TSR hanging around? Why not "Parasitize" your program on to Command.com like many viruses do? The "Stealth" viruses also employ code that will not reveal the change in size to either MEM or CHKDSK, such code can also restore the timestamp. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWzS19CcBnAsu2t1AQFyQgP9GpJQcB4TNSxzcBdKh+MWOWl6uHcEEM5I QEU7NpmegvNBAoTLuH4at8CMGqqIjol0LwIFjpKO9pkWsXUldNLHx1nl2m/Ur1iA BbPYH6ajDjuV+i/OHvNVt+ZaS1R+zZKkrW+FzA1mzM1iGn2JE5HWIdGS9r2mShRC diQXI87CWmg= =+0ln -----END PGP SIGNATURE-----

2 1

New mailing list?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

I am interested in starting a mailing list (digest, moderated) on encryption uses/abuses and possibilities in the real world. It would be like RISKS, but would concentrate on cases where encryption is currently being used and cases where it should but isn't. No discussions of this-asshole-actually-asked-for-my-SSN or the like. The idea is to expose to the public where crypto is useful and hopefully get more people to understand what will be lost if the gov't succeeds in keeping crypto tech under its thumb. However, a list is only as good as the material submitted to it. So, I ask the members of this list whether you would be interested in: (a) reading such a list and (b) contributing to it. --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 an53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1

Re: RATINGS: Subject tags
by doug＠netcom.com 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes) said: >One of the goals of this arrangement I've proposed is that it can be >used to rate _any_ existing mailing list. This kind of thing was discussed quite exhaustively in news.future last year, and one of the spinoffs was an actual software implementation which is currently available via ftp. I haven't kept up on it so I don't know whether it can be used for mailing lists at the moment, or just for "virtual" newsgroups, but in any case I include three items of info below. The first is a finger message from last summer that gives an overview, the second is an equally old alpha-test message from the primary author that gives more info, and the third is a recent ftp site announcement from him. Between the three you should get some notion of what strn is all about and whether it's worthwhile following up on. If it does not currently support email lists, perhaps the authors could be persuaded to add such support. There's also a mention of public key cryptography below which is somewhat interesting. Since his address changed over the last 6 months, I took the liberty of changing references from his old to his new address in the older two items, to avoid confusion. Doug -- Doug Merritt doug(a)netcom.com Professional Wild-eyed Visionary Member, Crusaders for a Better Tomorrow Unicode Novis Cypherpunks Gutenberg Wavelets Conlang Logli Alife HC_III Computational linguistics Fundamental physics Cogsci SF GA VR CASE TLAs ---------------------------- item one ------------------------ Login name: caadams In real life: Clifford A Adams Directory: /nfs/pavo/u3/caadams Shell: /bin/csh Last login Mon Jul 5 16:59 on ttyp2 from b153_csasm_03.un Plan: STRN/USENET Interface Project. The strn (Scan/Scoring Threaded ReadNews) program will be the first software release of the USENET Interface Project. Strn consists of two major (and some minor) additions to the trn program (version 3.0) by Wayne Davison/Stan Barber/Larry Wall. The additions are over 10000 lines of C code which implement newsgroup selection menus by user-defined "topics", an interactive article selection mode, and fast methods of scoring articles with prioritized display and commands similar to KILLfiles. An interactive multi-level documentation browser is also being developed. USENET Interface Project: ------------------------- The purpose of the USENET Interface Project is to identify and implement methods of dealing with "human bandwidth" problems of USENET. Its goal is to allow users to be presented with the articles they wish to read in the order they wish to read them, without restricting the posters of articles. There are currently three stages planned: 1. Filtering/Prioritizing Given the articles which currently exist, delete the articles which the user is unlikely to read and present the remaining articles in the order of their priority (score). This builds on and enhances the currently existing mechanisms such as separate hierarchical newsgroups and KILLfiles. 2. Suggestion/Addition Adds more information to make the filtering/prioritizing process more accurate (accuracy is measured by how well the presented order matches the user's wishes). Rating services may replace moderated newsgroups, where individuals decide which rating services to follow and what level of quality is acceptable. Summarizing and keywording services can also be made available to allow better selection and prioritizing. This stage will introduce problems in distributing the additional information and security (especially since the reputation of moderators may become much more important). 3. Alteration/Change The basic idea of this stage is that what the contents of the original posting are only a suggestion of what the reader will eventually view. While the original text would be propagated unaltered, various people would propagate their suggested editorial changes (such as hypertext links, spelling or factual corrections, moderator's notes, or summaries). What a reader finally views would be the combination of the original text with the changes of trusted editors. Another possibility at this stage would be the "virtual newsgroup" which is simply a collection of articles chosen by moderator(s). Send me email for more information on any of these projects. --Cliff -- Clifford A. Adams ----------------------- | USENET Interface Project: 457 Ash St. NE Albuquerque, NM 87106 | Tools for advanced newsreading STRN (Scan TRN) now in testing: trn 3.0 plus flexible newsgroup menus, fast article scoring with score ordered display, and merged/virtual newsgroups. ---------------------------- item two ------------------------ >From netcomsv!decwrl!concert!news-feed-1.peachnet.edu!umn.edu!lynx.unm.edu!carina.unm.edu!caadams Mon Jul 5 17:18:39 PDT 1993 From: caadams(a)access.digex.net (Clifford A Adams) Newsgroups: news.future Subject: Virtual newsgroups, ratings, indexes--coming soon? Date: 23 Jun 1993 03:35:57 GMT Organization: University of New Mexico, Albuquerque Message-ID: <208j2tINN342(a)lynx.unm.edu> The recent discussions on news.future have been very interesting. I'd just like to add that I'm working on several ideas similar to some recent posts, and I hope to have some useful results in the near future. For instance, strn is very close to supporting "virtual newsgroups" consisting of arbitrary articles from arbitrary newsgroups. These could be things like "top 20 thread" lists, indexes similar to alt.sources.index, or moderated subsets of existing groups. In the next release strn (Scan TRN) will have merged newsgroups consisting of all the articles from a set of newsgroups presented together. (The code works well, but it needs documenting before release.) Virtual newsgroups are a fairly easy addition to this which I hope to add next week. Distributing virtual newsgroup lists is going to be the hard part. For now I'm looking at a mailing-list approach. (Ick--I hate mail filters.) (Distributing the information using an alt.group with public key authentication would be easy. Unfortunately, that doesn't seem possible in the current political environment. Anyone who knows differently is *welcomed* to correct me. Even weak authentication would be welcome if unpatented and exportable.) In short, some of these schemes might be implemented a few months from now. I hope to release strn 0.9.0 (beta) in a "few" weeks--right now the alpha testing list is semi-closed. (You *might* be able to convince me if you try really hard.) I'd like to talk to people about new ideas, but I believe that the implementations are more important--USENET isn't about to run out of new ideas anytime soon. ;) --Cliff P.S. For more information on strn and the USENET Interface Project, finger my account: caadams(a)access.digex.net. I'll email more information on request. -- Clifford A. Adams caadams(a)access.digex.net | USENET Interface Project: 457 Ash St. NE Albuquerque, NM 87106 | Tools for advanced newsreading Scan/Scoring trn (strn) now in alpha testing: a trn 3.0-based reader with flexible newsgroup menus and fast article scoring with prioritized display. ---------------------------- item three ------------------------ >From netcomsv!amd!decwrl!decwrl!nic.hookup.net!swrinde!cs.utexas.edu!uunet!digex.net!digex.net!not-for-mail Thu Feb 24 09:39:16 PST 1994 From: caadams(a)access.digex.net (Clifford A. Adams) Newsgroups: news.software.readers,news.future Subject: Strn version 0.9.2 is now available. Date: 21 Jan 1994 15:45:57 -0500 Organization: Express Access Online Communications, Greenbelt, MD USA Keywords: strn, newsreader, filtering, prioritizing [I thought some of the news.future crowd might be interested in some of the new developments, especially Internet-sharable virtual newsgroups.] Strn (Scan TRN) version 0.9.2 is now available. See below for FTP sites. [Some of the uunet mirrors might take a day or two to get a copy.] Strn is based on trn (version 3.4.1 by Wayne Davison), and contains all of the trn commands and features. It adds many new capabilities to trn, such as a newsgroup browser, virtual newsgroups, scoring/rating of articles, and easy configuration menus. Strn has been developed and tested over the past year with the help of more than 50 alpha testers. The beta release is intended to make the current version more widely available, test out some of the new concepts (such as index-moderation using virtual newsgroups), and gather suggestions for improvement. Strn is still under development, although most of its planned features are implemented. Future versions of strn will mainly improve the documentation, scoring ease-of-use, and configurability of the program. Version 1.0 release is expected in a finite amount of time. Outline of major strn features: * The "scan mode" interface o A consistent full-screen interface for the four scan modes. . Implements many common commands such as movement, shell escapes, and searching. . Common code allows quick development of new scan modes. o Uses arrow keys for movement (trn-style 'n' and 'p' are also allowed). o X windows mouse selection (when strn is run under "xterm"). * Group scan mode o Full-screen interface for newsgroup selection. o Can replace the trn newsgroup selector for most purposes. o Easy subscription/unsubscription to newsgroups. o User-definable and sharable topic hierarchies. . Example: one could have an "IBM PC" topic containing the groups in comp.sys.ibm.pc.*, comp.os.msdos.*, comp.os.os2, and comp.os.ms-windows.* o Topic hierarchies can be easily shared: . Locally, by adding a link to another user's topics. . Remotely, by sending the topic files to other users. . Via Internet using Uniform Resource Locators (URLs). * Virtual scan mode o Supports "virtual groups" consisting of articles from any newsgroup. o Supports an easy-to-use "hotlist" of selected articles. o Merged groups, such as rec.arts.sf.* (all articles in those groups) o Virtual group files can be mailed to other users, and (with some setup) automatically added to a user's virtual group files. o Posted virtual group files can be used directly, allowing easy "index-moderated" newsgroups. o Virtual newsgroups can be shared via Internet and URLs. * Article scan mode o Subject-based "threading" available. . All articles with the same subject can be displayed as one line. o Summaries and keywords can be displayed. o Articles can be marked and read as a group. o Displays articles in either arrival or score order. (See below for more information on scoring.) * Scoring o Articles are assigned a score by scoring rules consisting of: . Header matching: either exact text or regular expressions. . (optional) NewsClip programs. o Scoring allows high scoring (interesting) articles to be presented before non-scored (ordinary) or negative-scoring (uninteresting) ones. For instance, in sci.space, one could give higher scores to postings from NASA or JPL, and easily read only those articles. o Articles are graded on a continuous scale, rather than a binary keep/junk distinction. (Articles scoring below a threshold value can be junked automatically.) o Scoring is *fast*, typically limited by I/O times to fetch article headers. o Scoring rules can be entered with an easy-to-use menu. o Scoring can be done from a shell script run by cron/at. o Scores are saved to a file so they don't need to be recalculated. * Online help (help scan mode) o Typing 'H' at almost any prompt enters help scan mode. o Help scan mode presents menus of documentation, containing: . The complete trn manual, broken into sections. . Full strn documentation. . Introductory USENET documents (such as "What is USENET?"). o Help files can be easily edited by the local administrator. * Online configuration o Easy menu-based configuration of almost all strn options. o Accessible from the newsgroup selector or group scan mode. o Configuration changes are automatically saved for the next strn run. o Site-wide configuration Strn version 0.9.2 is available from the following FTP sites: (North America, Eastern US) ftp.uu.net /news/trn/strn ftp.digex.net /pub/news (North America, Southwest US) perseus.unm.edu /pub/strn (United Kingdom) src.doc.ic.ac.uk:computing/news/software/readers/trn/strn (Europe, Netherlands) ftp.twi.tudelft.nl /pub/news (South Africa) ftp.ee.und.ac.za /pub/news/strn Sample displays [edited to reduce number of lines]: Article scan mode: [authors not shown in this sample to protect the guilty :-]: ---------- cut ---------- sci.physics | 790 unread Fold +.... [ 18] ( 9) > Some physics questions +....> [ 14] ( 10) > The size of electrons, and Fanciful misc SAGA +.... [ 11] ( 4) > Massive Photons Tomorrow (was Scientists Plan...) +.... [ 8] ( 47) > NASA Coverup Keys: Moon Neutral Point calculation +...x [ 7] ( 8) > Gravitation & massless particles (was Re: Some physics qu +..+. [ 3] ( 5) > Question on Hawking radiation Summary: Why don't extremal black holes radiate? +.... [ 3] ( 10) > Background Radiation and Olber's Paradox +.... [ 1] ( 1) Covariant vs. Lie Derivative in Gen. Rel.? -TOP-(score (old>new) order, 100% scored) ---------- cut ---------- Group scan mode: [Here is the "top" level:] ---------- cut ---------- Top Level | Unread Newsgroups | Top Level file> Favorites virt Hotlist file Americast (USA Today) file USENET file Networks file Computers file Amiga! file Social file Games file Recreational file Science file Misc file Hierarchies list All groups in .newsrc -ALL- ---------- cut ---------- [After selecting the "USENET" entry the screen displays:] ---------- cut ---------- Level 2 | Unread Newsgroups | USENET +.... 31> news.software.readers +M... 4 news.announce.newgroups +.... 7 news.misc +.... 33 news.software.nn +.... 27 news.future +.... 139 alt.config +.... 201 alt.fan.warlord +.... 2259 control list foreign news -ALL- ---------- cut ---------- Virtual scan mode: ---------- cut ---------- Virtual 1 | unread+read | Hotlist -.... [ 33] >Newsreader authors: Would article replacement break your reader < -.... [ 18] FAQ use of replaces: <news.software.readers> -.... [ 6] >Using NNRP for something like "nngrab" <news.software.readers> -.... [ 6] rn KILL file FAQ <news.software.readers> -.... [ -1] Future USENET projections, statistical <news.future> -.... [ -1] Need more best-of-usenet groups/subj scan <news.misc> -.... [ -1] More group-related intelligence for Pnews wanted. <news.software.r -ALL-(score order) ---------- cut ---------- Help scan mode: ---------- cut ---------- Top Level | (type 'h' for help) help> Help on help scan mode topic Introductory USENET documents topic Trn manual information help Strn Quickstart topic Introductory strn documentation topic Group scan mode topic Article scan mode topic Virtual scan mode (merged/virtual newsgroups) topic Scoring topic Digital signatures, cryptography, and USENET topic Misc (coding style, troubleshooting, quotes) topic Configuration (user and site-wide) topic Installation topic Version-related information help Credits -ALL- ---------- cut ---------- Configuration menus: ---------- cut ---------- Strn configuration menu: 0) Exit. 1) Group scan mode. 2) Article scan mode. 3) Virtual scan mode. 4) Scoring. 5) Miscellaneous. Enter your choice: 2 Article scan configuration menu: 0) Exit. 1) Change the displayed fields. (Author, threadcount, summary, etc...) 2) Change ordering and misc. flags. (score ordering, fold, follow, etc...) Enter your choice: 1 Article scan display: 0) Exit. 1) Article number (OFF) 2) Score (ON) 3) Number of articles with same subject (ON) 4) Author (ON) 5) Summary (OFF) 6) Keywords (OFF) An article will look like this: +.... [ 26] (17) John Q. Public Subject of the article Enter your choice: ---------- cut ---------- Authors: (See the strn credits for more information) STRN Clifford A. Adams <caadams(a)access.digex.net> TRN Wayne Davison <davison(a)borland.com> RN Stan Barber (current maintainer) RN Larry Wall (original author of rn) --Cliff -- Clifford A. Adams caadams(a)access.digex.net | Author of "strn" (scan trn): 457 Ash St. NE Albuquerque, NM 87106 | Trn 3.4.1 + virtual newsgroups, scoring (articles sorted by score), newsgroup menus, online help, and more. See ftp.uu.net:/news/trn/strn/strn-0.9.2.tar.gz

3 2

[CODE] Pay-per-use WWW & Mosaic?
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I want to make a crossbreed between NCSA's httpd 1.1- which already supports passing PGP signed/encrypted messages between client and server- and Magic Money. The result: a pay-to-view information service. It is uncertain about when I'll get around to it, since my free time is already being spent working on the Mac version of Nautilus. If anyone's interested, or if any of our protocolmeisters (yes, that's you, Eric & Hal!) have ideas, bring 'em on. - -Paul - -- Paul Robichaux, KD4JZG | "Let he who is without sin cast the first perobich(a)ingr.com | pointer." - Owen Harnett Intergraph Federal Systems | Be a cryptography user- ask me how. Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWzp7yA78To+806NAQHj/QP9HttikpI7rwtk//J/azu4P+KB1BM9Fa/2 JrIAsUt7yY3fpuJSeuHHq9919zx8kBdApYDfmcs8rr1Q5BQM2ABWZprQktBDUKop LcMIPh/+Tv2vav15Nbb2I2OoCwmJLb8Qc9YG+HRvzNfX7Xn92ihjleh0h/TJZXaE GACHMCMHCLE= =iWcr -----END PGP SIGNATURE-----

1 0

Viacrypt at NCSC ?
by an69654＠anon.penet.fi 17 Dec '03

17 Dec '03

Why does at least one person from Viacrypt have an e-mail address at dockmaster.ncsc.mil ? Is there an association between Viacrypt and the NCSC, or does the NCSC give out accounts to those in the business ? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

from the mouth of <the FBI>...
by Ophir Ronen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello all, This seminar might be of interest. I am going and will post any pertinent info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Open to Microsoft employees, vendors, contractors, temps - until we reach room capacity. WHAT: BROWNBAG SEMINAR Sponsored by ITG WW Network Security WHEN: Thursday, 24 FEBRUARY 1994, 12:00 NOON-1:00PM SPEAKER: Kevin Brock from the FBI will be our guest. FORMAT: Short briefing open to questions. SUBJ: -FBI concerns about security of intellectual property. -Economic espionage vs Industrial espionage. -If Microsoft is a target: Who is collecting information? Where is it being collected? How is it being collected? -Responsible self-defense *********************************************************************** Ophir Ronen <a-ophirr(a)microsoft.com> KeyID 1024/54FF05 1994/02/16 Key fingerprint = EA BF 5C 85 F6 C3 A7 8E AA 48 2A AC B9 BC 4B D2 "did gyre and gimbel yet did not inhale"

1 0

Re: Infomercial, Clipper
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

>Tom Holroyd says: >> Most people couldn't care less. They don't encrypt data, and will >> never use a clipperphone. The FBI can *already* listen to all their >> phone calls and see all their medical records. Why should people >> do anything to protect something they don't have anyway? Perry says: >I disagree that secure phones don't have an extensive market. If they were >cheap enough, people would want the feature just for the hell of it. I'd >say that most people would pick up a cryptophone if it only costs a couple >bucks more and is transparent to use. And if the FBI could listen in, it would be *no different* from what they have today. The point is, Clipper does not take anything away from most people. They might get a Clipperphone if they thought the building superintendant was hiding in the phone closet listening in (thus getting some real value from the thing), but they aren't hiding from the FBI today, and they won't care if the FBI might listen in tomorrow, too. Note that I'm not saying that Clipper isn't the tip of an iceberg giving the spooks bigbrother-like powers. All I'm saying is, you won't be able to convince Joe Public that he's losing anything. If they start arresting people for using PGP, that's another problem, and Joe Public won't care about that, either.

1 0

Re: Digitally Signing Physical Objects
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

>> 3. The shop or customer wishing to authenticate the part takes the >> number stamped on the part, runs it through the *public* key of the >> manufacturer (widely available, not kept secret, of course) and gets >> back the feature vector, which he can then compare to what he actually >> sees on the object. .... >This seems to have a tricky dependence on the tolerance. The forger can >get a valid plaintext and signed feature vector. So, if the tolerance >for error is too low, you get false positives, but if it's too high, a >forger could create something starting from the feature vector. An >interesting CAD/CAM problem. To keep black market forgery part off the market, a 30% tolerance is way more than enough. There should be no false negatives (making a real part look fake), but if 1/3 of the forgeries slip through (i.e. 2/3 don't), this has the affect of driving the forgery price up by a factor of 3, effectively pricing them out of the market. (Unless the real goods are overpriced a factor of 3...:-) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Net restructure
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

> . . . I think > our biggest concern when it happens will be that Clipper like encryption > and monitoring will be implmented as a standard. Who knows maybe the net > will be run by the government. > Reuben Halper > -anger is a gift- rage aginst the machine/Freedom This doesn't stop ordinary [or extraordinary] people from running their own net. This net, with in and out ports to other nets, would follow none of the rules enforced upon our current net. If they try to cut us out we simply change our logical location. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: Net Restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

> This doesn't dtop ordinary [or extraordinary] people from running their > own net. This net, with in and out ports to other nets, would follow none of the rules enforced upon our current net. If they try to cut us out we simply change out location. I don't think that is logical or feasible, and my point is that the net is becoming something for the masses now. The masses won't be as crafty as you . I feel that if or when it is restructured the people logging on won't be aware of the lack of security or they will have false security. Reuben Halper

2 1

MacPGP help
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Would anyone with fair knowledge of MacPGP help me out. I mean I REALLY need help. Thanks, Reuben Halper

1 0

New Security/Encryption Corporation - INFORMATION INSIDE (long)
by Matthew J Miszewski 17 Dec '03

17 Dec '03

THIS IS NOT AN ADVERTISEMENT BUT INFORMATION OF GENERAL INTEREST TO CYPHERPUNKS. IF YOU HAVE NO INTEREST IN DATA SECURITY THROUGH APPLIED CRYPTOGRAPHY PLEASE DELETE THIS MESSAGE NOW. SORRY FOR ANY CROSS POSTING. -------------------------------------------------------------------------------- Information Defense Strategies (IDS) Information Security Services Developed for the World And Applied to Your Office Hello All, You might be wondering, "Who is this Information Defense Strategies"? And, "Why is this in my mailbox"? And I would say, "Well, that's a good question". About three months ago I announced that a new data security corporation would be started soon. Its emphasis would be in the application of cryptographic protocols already in existence and the possible development of new ones. Well, that idea has been born into IDS. Why have you received this note? The reasons are varied. Either you contacted me with interest in getting involved, or I have been exposed to your interests in data security through public exposition of such, or a member of the security community referred you to me as an entity interested in what we are doing. Regardless, you have received this note because you are qualified in one or many ways to get involved. Many of you are already related to some sort of computer profession right now. This note is to let you know we are out there, and are interested in building bridges to your organization. Please read through the information provided below and provide feedback if you can. Many people have been anxious to see this get started, as of course I have been also. Finally, a description has been put together. Through the next round of feedback, we will be ready to begin. It is exciting to be starting out and applying ideas that have floated around for some time. This might be one of the first virtual corporations to have been born as such. I would like that sort of cutting edge to remain our vanguard at IDS. And I would like all of you to be a part of it. Matthew J. Miszewski Information Defense Strategies (IDS) -----------------------8<-------------------------8<------------- Please Distribute To Qualified Parties of Interest Direct all electronic correspondence to: mjmiski(a)macc.wisc.edu Snail Mail to: Matthew J. Miszewski 509 N. Lake Street, Suite 504 Madison, WI 53703 608-255-9871 Applied Cryptography No not the book (although I highly recommend it). IDS will base most of its robust security strategies upon encryption. Being well aware of ITAR we will be careful and yet aggressive in our application. I have targeted two areas for immediate concentration, Smart Card technology and encrypted challenge/response access systems. I am, of course, interested in much research and future development in other areas. These two are merely the most immediate opportunity. To remain on the cutting edge, IDS will need to be very active in Research and Development. Many people are moving towards applied cryptography. It is personally important to me that IDS be there at the same time if not before others. Security Services We will basically provide four security services. Consultation, evaluation, Tiger Teams, and IDS Custom Installs. We will consult for firms with a general interest in security as well as those that are well established in the field. This consultation will be general in nature and very affordable. IDS will also evaluate a firm's current security status. This service will offer our clients the opportunity to have a third party objectively review their security. A report of weaknesses will be generated from our evaluation. IDS may offer clients a Tiger Team ongoing contract. This will consist of teams actively attempting to covertly breach security in order to actively discover and immediately close undiscovered security holes. The insurance provisions of this area are tentative and pending and therefore this aspect of IDS is still tentative. Finally, we will offer IDS Custom Installs. These will vary from unique IDS developed Strategies to already developed strategies. Our custom security front ends will be constantly updated and evaluated. Third party product partnerships will increase our viability as well as increase the availability of robust security products. Platforms The data related operating system platforms we will deal with will attempt to be comprehensive if not exhaustive. In order to tap our targeted market we must be diverse. While I personally would love a concentration in Unix work, the reality is that many of our clients will be LAN based machines of the personal variety. We will therefore need specialists in lower level systems (PC, MAC, etc). Telephony Toll fraud can be devastating to smaller businesses. The days of "blue boxing" exploration appears to be over in this country. Unfortunately, the replacement, at least to a certain extent, is PBX and VMS abuse. In fact most people in business have been told that it is not a matter of if your PBX will be hit, but rather when. In addition Voice Mail Systems (VMS) are being utilized across the country without authorization. While some unauthorized users might mean no harm, there is no way to assure that malicious abuse does not occur. Valuable information may be left to the conscience of the underground community. Applying cryptography to this problem will be part of our charge. From front ends to challenge/response, there are many opportunities in this market. Making this security affordable will be our answer to this dilemma. IDS Basic Philosophy Data Security is VERY important. It is no longer just important to huge corporations, but to everyone. Affordable security consulting and products will help make small business information more secure. While CERT attempts much, it is slow to respond and many questions are still unanswered about its funding and allegiances. It is time to not only make security available but accessible. That is why IDS will exist. An incredibly large market is being overlooked by the elite of security professionals. IDS will address this void in the market. All people deserve good data protection. We can offer it. The plan is that IDS will actively pursue the myriads of offices around the nation with data to protect. From every small law firm with a voice mail system to an accounting firm with several LANs to a sales force that needs easy access but is still concerned with protecting its data, we can offer tailor made security strategies. Our profit (future) will be based on horizontal integration, in other words we will not profit by selling high price tickets to the few that can afford it but rather massive application of moderate priced strategies to everyone we can contact. There are a number of other points I will make in future communications. I plan on having a virtual office that may offer digital cash sales in the future. We may develop a low level net for our own communications. Partnerships will need to be developed as well as some manufacturing research. But I wanted to give those interested an introduction. If you are still interested I will send you the next update. Please respond either way so I know whom to keep on the list. More details to come.... Matthew J. Miszewski IDS ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

No Subject
by Ophir Ronen 17 Dec '03

17 Dec '03

hmmmmm, The meeting was not too interesting, we did not get into Clipper or the FBI wiretap proposal. That will be discussed in a few weeks. -Ophir

1 0

Re: Digitally Signing Physical Objects
by fnerd＠smds.com 17 Dec '03

17 Dec '03

i wrote- > >[Physical signature] > > seems to have a tricky dependence on the tolerance. The forger can > >get a valid plaintext and signed feature vector. So, if the tolerance > >for error is too low, you get false positives, but if it's too high, a > >forger could create something starting from the feature vector. An > >interesting CAD/CAM problem. Allen J. Baum replied- > To keep black market forgery part off the market, a 30% tolerance is way > more than enough. There should be no false negatives (making a real part > look fake), but if 1/3 of the forgeries slip through (i.e. 2/3 don't), this > has the affect of driving the forgery price up by a factor of 3, > effectively pricing them out of the market. I don't see how you factor out the variables of the resolution, what physical property is scanned, etc. For some combinations, it would be easy to forge 100% matches. For others, it would be hard to get a 30% match on the original object... Maybe the whole scheme could be improved by a trap-door function that has built-in error-tolerance. (By the way, if anybody knows about fuzzy hash functions, please write me; I'm curious for other reasons.) > (Unless the real goods are overpriced a factor of 3...:-) Isn't Great Art overpriced by thousands of times, in terms of reproduction cost? Anyway, a 2/3 rejection rate would be tough. -fnerd quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0