December 2003 - cypherpunks-legacy

John Perry Barlow - Euology for Cynthia Horner
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: Date: Sat, 23 Apr 1994 12:05:36 -0800 From: John Perry Barlow <barlow(a)eff.org> I know that news of her death is circulating the Net and I'm getting an incredible outpouring of shock and sympathy. For any good it might do, I hope you will post this to some of the places where news of her death has appeared. I mean it to stand as her gravestone in the virtual world. Cynthia Horner's Eulogy read by John Perry Barlow at her funeral April 22, 1994 in Nanaimo, Vancouver Island, BC.. I don't know most of you, and I envy the many among you who were graced with Cynthia all her life. I only knew her a little while. We spent the last glorious year of her life together. It was the best year of my life and, I firmly believe, it was the best year of her life too. Last Sunday morning, during the last hour we spent together, we were playing with a cat which strangely green eyes. She looked at me with her own beautiful green eyes and said, "You know, James Joyce said that green eyes were a sign of the supernatural." The way she said it seemed pointed and meaningful. And hope makes me want to believe it all the more meaningful now. I don't know that I believe in the supernatural, but I do believe in miracles, and our time together was filled with the events of magical unlikelihood. I also believe that sometimes angels live among us, hidden within our fellow human beings. I'm convinced that such an angel dwelled in Cynthia. I felt this presence often in Cynthia's lightness of being, in her decency, her tolerance, her incredible love. I never heard Cynthia speak ill of anyone nor did I ever hear anyone speak ill of her. She gave joy and solace to all who met her. I feel her angel still, dancing around the spiritual periphery, just beyond the sight of my eyes, narrowed as they are with the glare of ordinary light. Her graceful goodness continues to surround me, if less focused and tangible than before. With a care that was appropriately reverential, Cynthia and I built a love which was an inspiration to all who came into contact with it. We felt, quite consciously, that it was our gift to the world. We wanted to show the hesitant the miracle that comes when two people give their hearts unconditionally, honestly, fearlessly, and without reservation or judgement. We wanted to make our union into a message of hope, and I believe we did, even though we knew that hearts opened so freely can be shattered if something should go wrong. As my heart is shattered now. So among the waves of tragedy which have crashed on me with her death is a terror that our message of hope has been changed into a dreadful warning. But I am here to tell you that had I known at the beginning that I would be here today doing this terrible thing, I would still have loved her as unhesitatingly, because true love is worth any price one is asked to pay. The other message we wished to convey was one of faith in the essential goodness and purpose of life. I have always felt that no matter how inscrutable its ways and means, the universe is working perfectly and working according to a greater plan than we can know. In the last few days, I have had to battle with the fear that everything is actually just random, that the universe is a howling void of meaningless chaos, indifferent to everything that I value. All hope has at times seemed unjustified to me. But groundless hope, like unconditional love, is the only kind worth having. It's true name is faith. As it is a shallow faith which goes untested, so it is that if we can keep our faith through this terrible test, we will emerge with a conviction of incredible and enduring strength. And this faith will become Cynthia's greatest gift to us. If we can build with our lives a monument to her light and her love, she will not have died in vain, and her death will become as much a miracle as was her life. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Want to run a pgp key server?
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

The new pgp keyserver code which was being tested at wasabi.io.com for a few months seems to be fairly stable. If anyone else is interested in running a server like this, the sources are available from wasabi's ftp area: wasabi.io.com:~ftp/pub/pgpkeys/sources/pgpserver.tar.Z It's not particularly intelligently packaged for ease of installation, so anyone who wants to try it should be reasonably fluent with C and used to porting packages from system to system. At the moment it's only known to work for sure on BSDI unix. In the tar file you'll also find 'procmail', and some perl scripts for doing ftp mirroring. You'll need about 6Mb free in total while installing. Keeping your server running will involve about 3Mb of daily ftp updates, so you probably don't want to run this from a dial-up site :-) This server does *not* use pgp at all, so you ought to be safe from hassles from PKP. Just remember, you're *publishing* information... Mail me at this address if you try to install it, please. The Mgt.

1 0

Programming languages debate
by Phil G. Fraering 17 Dec '03

17 Dec '03

Phil Fraering writes: > Aren't there freely available versions of Smalltalk for Unix? > GNU Smalltalk apparently lacks the classical graphic interface, > but from what I've seen, so does Perl ;-) > > pgf Timothy C. May responds: \Yes, and you mostly get what you pay for: a "toy" environment that /nobody I know uses for anything. (The Gnu Smalltalk is analogous to \the toy implementations of Lisp and Scheme in C....a useful pegagogic /tool, but lacking the richness that the full "environments" are so \well-known for.) (Damn, Tim's written a lot I want to respond to, I don't have an indent script handy, and even if someone else did, my emacs version isn't current. At least it fits in 50 Meg ;-) \The serious work is done in ParcPlace's VisualWorks, DigiTalk's /Smalltalk/V, or the new SmalltalkAgents from QKS. I'd like phone numbers or other contact information for these companies, if anyone has some handy. \Besides, I don't _have_ a Unix machine and I have no interest in /getting one (nor in trying to install a Unix on my Macs). The above \programs are available for Windows, Macintosh, and Unix, in varying /degrees and combinations. (VisualWorks is mostly targetting Windows, \Smalltalk/V is a cheaper alternative, for both Windows and Macs, and /SmalltalkAgents has been released for the Mac, with versions for the \PowerPC (Q2 94), and Windows32/NT and SPARCstations to follow. Which implementation of UNIX for SPARCStations? Might it be runnable under Solarisx86, or ported to some other binary Unix standard? I need to find out before I spend... /I'm not grinding an axe for Smalltalk, understand. Just commenting on \some directions. Maybe TCL is the way to go, maybe mixtures of Perl /scripts and short C programs are The One True Way (the remailers work \this way, and they are our major public success to date, with new /things like MagicMoney following the same path, so....). \The proposed language "Joule" (which some of our list members are /doing) may or may not be ideal, but in any case it is probably at \least a few years off. /--Tim May (End of current message from Tim. I hope to do several in one message). Okay, I pretty much agree with what you wrote about GNU Smalltalk. I don't know it, I've only read (most of the) standard Smalltalk book, and by comparison to the original from PARC GNU Smalltalk is missing crucial bits. My point is not that GNU Smalltalk is good compared to uncrippled Smalltalk, but that it may be better than Perl/TCL/whatever else is being proposed. One of the main merits of Perl seems to be that it's a free scripting language that isn't dependent on what shell (bash, ksh, whatever) you are using and is apparently highly environmentally independent. Oh, I give up. What I'm trying to say is that it's a Schelling point. (You'll have to look up what that is if you don't understand. I'm sorry, but it's the best way for me to describe what I mean). It gains a "developer," programmer, and user base because it is a Schelling point, not because of any actual merits as a programming language itself. Please note that I am not saying that it does not have these merits. This is according to some the same reason C is used in preference to C++, C++ in preference to Objective C, and Objective C in preference to Nicklaus Wirth's current language of the month or the Lisp or Smalltalk-like language of your choice. Perhaps we should simply ignore what's a Schelling Point and simply pick a language that's going to be the best one to implement the algorithms in, and then worry about porting the program/making it run on other systems. On to the next message. Here's Tim: \In this message I talk about C code, agents, TeleScript, Smalltalk, /PGP tools, and the general and pressing need to somehow make all the \diverse fragments of code available and (even more importantly) /comprehensible and usable. (As I'm no expert in C++ and the like, take \my comments as "moderately informed speculations.") I probably should include similar disclaimers. (Quotes from Hal Finney and Peter Murphy deleted for space considerations. It's in Tim's original message.) \...options, routes, and miscellaneous points. But I'll just make a few /notes here. (The theme of the next Cypherpunks meeting, date not yet \finalized, is "Protocols," so issues like this are presumably /relevant. Depending on the date, I may be in L.A., and would welcome \meeting with other Southland Cpunks to discuss ideas.) I'm not going to be able to make it, whenever it is. I'm trying to contribute now: \I. What We Have /* PGP...the most basic of all crypto functions (RSA \encrypt/decrypt/sign/etc.), and it took over a decade to get a usable, /public domain (?!) version. (Yes, I know about RIPEM, RSAREF, etc.) Well, it doesn't seem to help much that RSA seemed to take a hostile view of anyone "infringing on their patent." I remember ftp'ing rpem one fine day and going back to the site the next and finding that it had been removed thanks to ominous warnings from RSA. But I get the basic point. I also wonder that the effort *might* have a bottleneck in the RSA encryption algorithm itself and its patented status. You're apparently stuck with RSA in the form RSA Corp. wants you to use it, even if they do release it. It is their right to do so (if one believes that software patents are valid, although off-hand I don't know anyone who does). It's still a bottleneck. \(I mention this because _use_ of this protocol, even with a nice /manual and whatnot from Phil, Hal, Derek, and others, still mysifies \many people, and still is not easily callable from most mail programs, /as you all know. This is *terribly important point*, to wit: if the \most basic of all crypto functions is so long in gestation and so /difficult to use interoperably, what hope do we have in integrating \the vast range of crypto protocols to be found in Schneier, the Crypto /Conference Proceedings, etc? This is the problem I'd like to see \solved, hence my interested in "Computer-Aided Crypto Algorithms," or /CACA.) \* we also have fragments of C code accumulated and laboriously /developed by Bruce Schneier. ... \* there's the ProductCypher (sp?) code which Hal mentioned. ... /* code in Perl obviously exists in various places, and both Hal Finney \and Henry Strickland have written about TCL. Whether these scripting /languages, with excellent facilities for accessing Unix utilities \directly (as opposed to from deeply within a C program, like PGP), /should or can form the basis of a Crypto Toolkit that others will \actually use is unclear, to me at least. \* other programming efforts presumably exist out there in Cypherpunk /land, and some folks not on the List (unless by pseudonym, which is \quite possible....after all, ProductCypher is obviously a talented /programmer and may be one of the main folks posting algorithms and \code fragments to sci.crypt) are clearly writing code for various /purposes. \...thus ends my informal summary of what's out there (it may be /incomplete, or inaccurate in places...corrections are welcome, as \always) /II. What's Neeeded \* Consider some things we like to talk about: /- alternatives to RSA (elliptic functions, etc.) Does anyone have any pointers to references to alternatives to RSA encryption, or to any possible claim RSA might have to any alternatives? \- secret-sharing protocols /- remailer-specific code (adding latency, mixing, padding, etc.) \- dining cryptographers nets (DC-Nets, a la Chaum, Bos, etc.) /- digital cash (a vast area of diverse protocols for clearing \transactions, for blinding, for detecting double-spending, etc.) /- random number generators (Schneier, for example, supplies code \fragments for the Blum-Blum-Shub generator...need I again say that /probably few of us know how to "call" this code easily?) \- code for message pools, for chaining remailers, etc.....a lot of /this exists as scraps of Perl in various places. \- and so on \My point? How can we achieve the Crypto Singularity (tm) when these /algorithms and _conceptual functions_ (my term, meaning that each of \these embodies almost an agent-like level of behavioral /complexity....hence my interest in implementing these protocols as \classes and methods in something like Smalltalk or even the new /TeleScript) are scattered around, are hard to grok (a technical term \invented by the neural programmer Heinlein), and are more or less /going unused today? I take it since we last discussed Telescript you've learned more about it. Anyway, I think I'd hate to be implementing stuff like the above in any language for which the main advantage seems to be "it's a lot better than awk!" Is Perl being used as a true algorithmic programming language in the above cases or just a fancy JCL, anyway? \III. Some Approaches to a Crypto Toolkit /* Large collection of C programs. The Schneier approach, except on \steroids. Regularize the calling conventions, add further /documentation, generate test sample, etc. A massive undertaking, \fraught with problems. /* C and Perl, and maybe TCL. As above, but use other Unix utilities as \needed. /* A class library for crypto, in C++. Encapusulate as much of the \capability into classes and make them available. For example (and here /I'm using Smalltalkish lingo), an "RSA object"... \I'm not sure how feasible this would be in C++, as I know very little /about C++ ... \From my Lisp background (Symbolics 3600, Zetalisp, Common Lisp) and /from my experiments with Digitalk's Smalltalk/V on my Mac, I think an \object-oriented environment could be ideal. /* TeleScript. Here I will go out on a limb and predict that the \forthcoming TeleScript, which is nicely described in the latest "Byte" /by our very own Peter Wayner, could be the basis for some exciting \progress. With multi-platform capability, object orientation, and an /explicit foucs on agents running around delivering mail, encrypting, \etc., it could be a winner. I'll have to check out the article. I think when we see Telescript running we'll be able to make a decision about what it can do. I still haven't heard anything from Motorola about their hardware. Has anyone seen the PC/Mac/Unix versions of Telescript running anywhere? \(Speculatively, my notion is to embed in Telescript agents many of the /things we've been talking about, and then count on the market to make \mailers and Mosaic drivers to talk to these agents. Lots to talk about /here.) Count on the market... hold on a sec, aren't we the market? \* Speaking of Mosaic, what about using WWW/Mosaic as the basis for /transparent use? I'm already impressed that on a non-Mosaic platform \(I don't have either a SLIP or PPP connection at this time) I can use /my cut-and-paste to easily do a "lynx http::blah blah blah" and get to \a home page with arrow-selectable hypertext points. I can see /WWW/Mosaic/Lynx/etc. as a common platform (set of utilities) for \handling even encrypted traffic. More specifically, you mean use http protocols as the basis for transparent use. So you'd have http interfacing to whatever the program on the bottom was. It's just an interface. It took a while, but one question I have is, are there run-time packages or "compilers" for the Smalltalk environments you spoke of above? If not, would it be possible to write one, or to extend one of the publically available Smalltalk environments to be able to run whatever you or others write using SmalltalkAgents? Is there interoperability between SmalltalkAgents and Smalltalk/V? I'm thinking seriously of spending some money on the Smalltalk, but I'm not sure it's going to do a great deal of good if it turns out everyone else has to fork over $ 200.00 or so just to run a couple-hundred-line program I wrote over a couple nights. ... \* Integrating existing tools (PGPToolKit, Perl scripts, Schneier's /code, RSAREF) into new apps is basically *not* happening, at least not \by the Great Masses here on our list (let alone the Unwashed Masses /off the list!). \* Interoperability with dozens of mailers, on several platforms, /remains a critical problem. \* Hence, *good luck* in getting all the whizzy new protocols we like /to speculate about implemented any time soon. \This is the challenge I see. To somehow deal with this set of /problems. \Thanks for reading...and I again apologize for just sitting down and /writing this in emacs instead of using my Mac-based outline processor. \Sometimes just writing is better than planning, reorganizing, and /never finishing. \--Tim May I'd like to apologize for what I deleted and what I didn't. On to Tim's next message: \The challenge I mentioned in my last message can be summarized as /follows: \- hide the complexity of implementation in the code, so that other /programmers, and especially end-users, don't have to worry about it. I'm not sure, but as a casual observer it seems the programming community is about ten to twenty years behind the academic community in terms of agreeing on the need of hiding complexity. People seem to be sticking to C the way "scientists" are supposed to stick to Fortran. Won't it be *easier* to write this stuff in Lisp, or Smalltalk, or Modula-8? \- to pick a simplest example, a random number generator needs to /generated a good random number without the user having to worry about \a zillion related issues I guess I'm guilty of some sins... I've been planning a hardware-dependant random number generator, and I don't know if there's ever going to be a standard for scintillators+a/d boards, never mind if they're ever going to be standard on PC's. Now where did I put that pitchblend? It's all I have since they took away the red mercury... \(this may get flames....I'm not saying users should be blissfully /ignorant of some of the assumptions that went into the RNG, only that \most users want an RNG that operates consistently, has been tested by /others, etc. This is the Mathematica function method: have experts \devise the best factoring or primality testing approach, implement it /efficiently (usually in C or even machine language), and then give it \to the user as "FactorInteger[3858783237285638838513] for him to /incorporate as a canned functon.) I think a *good* overview of the sort of things Tim is talking about can be found in a book called _Programming Language Concepts_. I think the author's last name starts with an M. The book is (I think) at home, so I can't say for sure. Anyway, to reiterate: is there a way, once something is written in SmalltalkAgents, to get it running in more widespread enviroments? +-----------------------+-------------------------------------+ |"Standard Disclaymore" |"...drag them, kicking and screaming,| |pgf(a)srl03.cacs.usl.edu |into the Century of the Fruitbat." | +-----------------------+-- Terry Pratchett, _Reaper Man_-----+

1 0

Clipper hearings rescheduled - May 3 1994!
by Stanton McCandlish 17 Dec '03

17 Dec '03

Both the Senate and House Clipper/Digital Telephony hearings will be held almost back-to-back on the same date. See ftp.eff.org /pub/Alerts/clip-dt.alert for more info. Forwarded message: Date: Mon, 25 Apr 1994 18:31:44 -0400 From: farber(a)central.cis.upenn.edu (David Farber) Subject: Clipper Day on the Hill Due to the Memorial Day in honor of Ex President Nixon, the Senate Hearing has been resheduled. Sen Leahy's hearing which had been scheduled for this Wed has been moved to May 3 at 0930 in room 216 at the Hart Senate office building. and Represenative Valentines House hearing will be May 3 in Room 2318 in the Rayburn Building at 1:00 pm. Non stop Clipper, Digital Telephony. A cast of millions (well maybe 15). Dave -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

2 2

Schneier's source code
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim May said: > * we also have fragments of C code accumulated and laboriously > developed by Bruce Schneier. How many of us have bought the C code book > and used the code? ^^^^^^^^^^^^^^^ As far as I know, there's the book, Applied Crypto, and the source code on disk. Are you referring to the C code within the same book, the disk, or a book of source code with the stuff in the disk (which contains more than the main book)? It matters to me, because though I have the fat book, I have yet to find the energy to OCR the source code. As I'm in India, I can't get the disk. If the contents of the disk are printed in a separate book, I could get *that*. The disk contains code described, but not presented in the book, including DSA, Diffie-Hellman, etc. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

7 6

clipper not end of world
by Mikolaj Habryn 17 Dec '03

17 Dec '03

I'm reposting this 'cause i don't think it got through the first time... I seem to remember someone once writing that with the proposed clipper laws, you are allowed to encrypt messages before piping them through the clip chip, but the output must be left unaltered. The problem to this is that then whoever does the audits knows who's being sneaky. (Or something like that - i don't remember precisely.) Seems to me, if one is talking about videophone type devices, they are transmitting quite a great deal of info, and stegging in a message is quite feasible, is it not? You don't even have to do much of a hardware modification. Do something like having an HF carrier tone in the background, that anyone listening to it can't detect without the knowing what they're listenong for. Or insert a microburst transmission - it'll look like static. This is not to say, that the clip chip isn't worth fighting against, just that, as always, someone's going to come with a way around it. It's human nature, really. * * Mikolaj J. Habryn dichro(a)tartarus.uwa.edu.au * "Life begins at '040." PGP Public key available by finger * "Spaghetti code means job security!"

1 0

hideseek
by shaggy＠phantom.com 17 Dec '03

17 Dec '03

i've written a steganography program for the pc. its called hide-and-seek and a copy is at ftp.netcom.com as either hideseek.zip or possibly hdsk40.zip, in /pub/qwerty eff suggested i tell you folks and have you look at it (source is included) if you like it, they want a copy. i'm not subscribed to the cypherpunks list so you'll have to mail me to talk to me. thanx shAg Coming, i don't enter by the gate shaggy(a)phantom.com Leaving i don't exit by the door shag(a)oregon.uoregon.edu This very body is the land of tranquil light

1 0

Re: Clipper hearings rescheduled - May 3 1994!
by jmdaluz＠kquest.com 17 Dec '03

17 Dec '03

>> Both the Senate and House Clipper/Digital Telephony hearings will be held >> almost back-to-back on the same date. See ftp.eff.org >> /pub/Alerts/clip-dt.alert for more info. > >I can't ftp without some pain right now; is the C-Span e-mail address >in the info packet? It'd be nice to send them some mail and express >our urgent desire to see these. According to the C-Span gopher: cspanviewr(a)aol.com (they check this more often) or viewer(a)c-span.org My message is going out to them tonight. Cheers ____ Jose M. daLuz | Voice: (508) 996-6101 KnowledgeQuest Online Research | Fax: (508) 996-6215 Internet: jmdaluz(a)kquest.com | MCI Mail: 639-1229

1 0

Re: Programming languages debate
by Hal 17 Dec '03

17 Dec '03

One thing not being emphasized in this discussion about languages, crypto scripts, and such, is that a big reason why we don't have more crypto tools is because they are a lot of work to write. I can speak from personal experience on PGP. Just going from PGP 1 to PGP 2 took over a year, almost a year and a half. That involved a lot of little cleanups: better handling of key rings, going to IDEA in place of Bass-O-Matic (the cipher used in PGP 1); adding some new packet types, etc. But PGP 1 had most of the same basic cryptographic functionality (RSA+conventional) as PGP 2. And it was amazing, really, that as much got done as it did in that time frame. Most of that is due to Phil Zimmermann's managerial abilities. People know Phil as a privacy advocate, a crypto enthusiast, a talented programmer. What they may not realize is that his greatest skills are (IMO) in personal relations. Phil is able to make things happen, to shepherd a network of easily distracted programmers from point A to point B. This means being willing to push, to call someone up and say, "do you have that done yet," and "can you have it for me tomorrow." Phil was not afraid to keep the pressure on in order to make sure progress was made. He had to constantly keep this up for over a year to get PGP 2 out. Granted, Phil was working under somewhat unusual constraints due to the unique legal situation involving the RSA patents. But most of the kinds of things we are interested in playing with can't help but infringe on some- body's "intellectual property" given the massive barbed-wire-fencing of the cryptographic concept space that's been going on (see my posting last week on Chaum's multitudinous patents). Plus, now we know that any success- ful public-domain cryptographic product is likely to leak overseas and ex- pose the author to the threat of a prison term. These are hurdles which cannot be taken lightly. I don't know whether the introduction of easier-to-use crypto tools will really change things. Pr0duct Cypher's PGPTOOLS was explicitly intended to address this problem, but the only thing I've seen so far is his own Magic Money (although I heard in email about another application being worked on). I think what we really need is some motivated programmers who are willing to learn crypto and work on projects. I think that would be a better use for this list than the kinds of discussions we have been having lately. Hal

1 0

the soda cypherpunks ftp site
by Erich von Hollander 17 Dec '03

17 Dec '03

the soda cypherpunks site, with source for pgp, the remailers, and much other useful information, is moving. the new name for the site is ftp.csua.berkeley.edu. this will actually poing to soda until the summer, at which point it will move to its own machine. please start refering to the site as ftp.csua.berkeley.edu to make the transition as smooth as possible. e

4 5

STEGO (SHORT) FAQ
by Romana Machado 17 Dec '03

17 Dec '03

Hello from Cypherella! Thanks for your interest in Stego. I have prepared this note to answer most of the questions I've been asked about Stego. 1. Where is Stego? Stego was moved from the /Recent directory to the compression utilities directory '/cmp' in the info-mac directory at sumex-aim(a)stanford.edu. You can download the Mac version from there. 2. Is a PC,DOS,MSDOS version coming? I have not been developing one, for lack of suitable hardware. Fortunately, bart.simpson(a)glib.org, has developed a PC version that operates on TIF files, and Colin James Maroney informed me that he's made a PC verson that operates on GIF files. He is shag(a)oregon.uoregon.edu. I haven't tried either of these; I hope they're useful. 3. How can I get a copy of Stego by mail? Send a check or postal money order for US$15 and your address to: Romana Machado c/o Paradigm Shift Research 19672 Stevens Creek Blvd Suite 127 Cupertino, CA 95014 You will recieve the latest version of Stego and news about updates and future products. Thanks again for your interest, Romana Machado romana(a)apple.com Note: Many of you recieved this a blind cc, as a privacy protecting measure.

1 0

Rights are on the CP agenda
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

"Jim Sewell - KD4CKQ" <jims(a)Central.KeyWest.MPGN.COM> > Sorry for helping to promote an indepth discussion of a topic only marginally > inline with c'punks. Yo! Everyone! Carry this thread on in private, please. > It is a very valid discussion, but not one for all c'punks. While public housing projects may not be on the CP agenda, the confict between a mob-like majority willing, in order 'to reduce crime,' to impinge on the rights of minorities with different opinions is *definitely* something to discuss here. If enough criminals start using PGP, there may well be similar pressure in favour of Clipper. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

2 1

PGP Shell for Windows
by bart＠netcom.com 17 Dec '03

17 Dec '03

Newsgroups: comp.archives.msdos.announce Subject: jwps16.zip Windows PGP Shell v 1.6, J.Snyder Date: Mon, 25 Apr 1994 13:43:21 GMT Thank you for your contribution. This upload is now available as 304822 Apr 22 01:59 garbo.uwasa.fi:/windows/util/jwps16.zip : Date: Fri, 22 Apr 1994 09:01:24 GMT : From: jsnyder(a)ccwf.cc.utexas.edu (J Snyder) : To: win-up(a)uwasa.fi : Subject: JWPS16.ZIP - J's Windows PGP Shell v 1.6 : : : File name: JWPS16.ZIP : One line description: Windows PGP Shell v 1.6 : Replaces: JWPS15.ZIP : Suggested Garbo directory: : Uploader name & email: J Snyder <jsnyder(a)ccwf.cc.utexas.edu> : Author or company: J Snyder : Email address: jsnyder(a)ccwf.cc.utexas.edu : Surface address:7008 Fence Line Dr, Austin, Tx 78749 : Special requirements: Windows 3.1 or greater : Shareware payment required from private users: No : Shareware payment required from corporates: Negotiable : Distribution limitations: None : Demo: No : Nagware: No : Self-documenting: Yes (context-sensitive help file) : External documentation included: No : Source included: No : Size: 304566 bytes compressed/ 479149 bytes uncompressed : 10 lines description: : This Windows shell for PGP provides use of drag and drop, : encryption/decryption from the clipboard, and auto-detection : of already-encrypted files, as well as a consistent interface : for key management. : This is only a shell. PGP, which *must* be installed first, : handles all the en/de-cryption and signing. Specifically, : the PGPPATH, TZ, and TEMP environment variables must already : be set appropriately before installing JWPS. : Uploaded by the author. : : Comments, questions, bugs, or anything else to: : : jsnyder(a)ccwf.cc.utexas.edu ................................................................ Ari Hovila, ajh(a)uwasa.fi Moderating at garbo.uwasa.fi anonymous FTP archives 128.214.87.1 Computer Centre, University of Vaasa, Box 700, FIN-65101 Finland

1 0

Internet Relay Chat
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I've noticed some discussions of IRC (Internet Relay Chat), both as a possible model for CP interactions, as well as a location for implementations of BlackNet (in #wares, etc.) Note that IRC, unlike MUDS, has been designed to ensure 'true-names'. While you do use nicknames, anyone can find out the machine name and user ID you are logged in from, with a /whois. Anytime you join or leave a channel, your full machine name and user ID is displayed to everyone, along with your nick. This is different from any (possibly pseudonymous) e-mail address you register for incoming mail. In #wares, people typically trade names of unauthorised FSP sites (such as the one in the LaMacchia case), which normally remain active for less than a few weeks. Though entry to IRC channels can be by invitation only, everyone knows everyone else's real (in the sense of machine and ID) identity. Not CP-friendly at all. It would be nice to have a #Cypherpunks channel, though... many of us don't mind revealing our identities to each other, and it could increase the frequency of interactive sessions greatly. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

5 4

Programming languages
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

This thread on programming languages seems waaaay off the CP agenda. But then, so was the rather interesting thread on futures and derivatives... Tim May says: > My conjecture: 70% of all programmers now coding in C and planning to > learn C++ would be "better off" (more productive, more maintainable > code, fewer reinventings of the low-level wheels, etc.) with > higher-level languages. "Rapid prototyping" is another buzz phrase, > but an accurate one. Well, just as I wouldn't recommend using CASE tools without a working knowledge of C, in case 'ducking down' to a lower level is necessary, I feel that C++ is useful to know as a language with all the OO of, for instance, Smalltalk, and low level capabilities too. I've programmed in many languages and taught C++, and find that what is important for productivity is not higher-level *languages* so much as *environments* -- Smalltalk wouldn't be much fun without one. > In cases where one's reach exceeds one's grasp, as appears to be the > case with all of these crypto ideas, bridging the semantic gap and > actually getting something out is, I think, much more important than > having it run faster (but not be built at all....). Visual programming environments do greatly help in bridging this semantic gap. I don't think the argument against them (slow programs) is really valid, or will remain so for a long time. For most applications, including crypto, environments provide optimized libraries for a number of functions. Most environments, such as Visual C++, provide for links to lower levels, allowing optimization for *really* critical routines. How many people still program in assembly? I do sometimes, but more out of enjoyment than necessity ;-) ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

1 0

Decentralized BBSes
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Mike Ingle <MIKEINGLE(a)delphi.com>: > There are occasional waves of actions against BBSes. The most recent ones > are for porn. Before that it was pirate software and phone codes. The next > one will probably be for "G-files" such as bomb plans - I remember seeing > a message about this. BBSes and online services are inherently vulnerable > because there is a responsible person to persecute. > What we need is a totally decentralized BBS. It would be something like > running Usenet over UUCP. Why not do just that? Many areas of the net transfer mail, and even newsfeeds through UUCP. ERNet, which I'm connected to in India, had to use UUCP for newsfeeds when their connectivity was at 9600 bps, 5 years ago. UUCP doesn't need phone lines or direct connections; private sites could easily hitch a ride on the Internet. Fidonet users have been distributing their message bases worldwide for years. Oh - there *is* a newsgroup, alt.binaries.pictures.erotica.children, which would have been shut down if it were a BBS, and presumably cannot be traced to individuals. I don't know if anything is ever posted to it, though. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

1 0

RE: Milgram & Authority
by Duncan Frissell 17 Dec '03

17 Dec '03

B >Q: In this book, does it say whether the test subjects were asked B >about their thoughts on this? Did they provide an explanation, from B > B >their own point of view, for their obedience or what they understood B >about the objective of the experiment - before & after? B > B >Blanc The subjects were very upset during and after the experiment. Some broke down while administering "lethal" shocks. They often cried and begged the "researcher" to let them stop zapping the victim. In those cases where a white coated researcher with a clipboard was standing behind them, the subject was much more likely to impose greater shocks than if there was no "researcher" present. The main reason they did it is because they were being told to. Primates have a hard time disobeying authority figures or standing out from the crowd. DCF "Help the Homeless -- Teach them how to sell their identities." See. And you all thought I was a heartless right wing nut. --- WinQwk 2.0b#1165

4 4

Democracies and rights
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

dwomack(a)runner.jpl.utsa.edu (David L Womack): > Adam appears to be of the opinion that we are a democracy...technically, > we are a representative republic. A minor quibble, perhaps, but it leads > to larger issues. > The entire purpose of the structure of our government (seperation of powers, > varied election schedules, powers reserved to the states, the bill of rights > and so forth) is to prevent the suppression of the rights of a minority by > the majority. At least, that is the ideal! Political discussions tend to become elitist, or purely intellectual. Lenin, who read Marx, discussed the problems of equality among the peasants, who couldn't read their shopping lists. > If the majority of people decide that ownership of firearms is counter to the > interests of society, will we take away this option? ... if the same majority > decides that decent people don't need privacy ... > Why not, the *_majority_* is all for it! When 'the *_majority_* is all for' something, and you ignore that on the basis of minority rights, to enforce your policy you graduate from a representative republic towards benevelant authoritarianism. Of course, the basis of democracy, rights, and 'civilized society' is an educated, moderate populace, where the majority does not let issues overwhelm their respect for those rights. But then, what happened during the McCarthy era? ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

1 0

Re: Rights are on the CP agenda
by tim werner 17 Dec '03

17 Dec '03

>Date: Tue, 26 Apr 1994 08:19:59 -0400 >From: "Perry E. Metzger" <perry(a)snark.imsi.com> > >rishab(a)dxm.ernet.in says: >> While public housing projects may not be on the CP agenda, the >> confict between a mob-like majority willing, in order 'to reduce >> crime,' to impinge on the rights of minorities with different >> opinions is *definitely* something to discuss here. If enough >> criminals start using PGP, there may well be similar pressure in >> favour of Clipper. > >I would suggest that this topic is not appropriate here. I'm sure its >appropriate -- in other places -- but if we do not focus on >cryptography, many people will be forced to leave this mailing list >and the quality will degrade. > >Perry Perry, I would suggest that you leave the list if you don't like it. Your only contributions have been snide little flames, anyway. tw

2 1

Re: Internet Relay Chat
by Hal 17 Dec '03

17 Dec '03

If you did hack your own IRC server, would it be possible to eavesdrop on channels like #warez, without anyone knowing, and without fear of being kicked off? It seems to me that this would be the true hacker's approach if it were possible. Hal

4 4

Re: Milgram & Authority
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Duncan Frissell <frissell(a)panix.com> > > Milgram, Stanley > -------------------------------- > [...] Milgram took the results as > proof that ordinary people will inflict pain on innocent people when > commanded by an authoritative figure. I would agree, but I'd add an important qualifier: "in this country" (or "in this world," or whatever). I think it's important to keep in mind exactly how obedience to authority is inculcated in people from birth. _I_ don't think it's inborn. The goal should be breaking this pattern and, if it's too late for adults, at least try to raise kids to think for themselves and not follow orders so unquestioningly. --Dave.

1 0

Re: Internet Relay Chat
by joshua geller 17 Dec '03

17 Dec '03

> On Mon, 25 Apr 1994 rishab(a)dxm.ernet.in wrote: > > I've noticed some discussions of IRC (Internet Relay Chat), both as a possible > > model for CP interactions, as well as a location for implementations of > > BlackNet (in #wares, etc.) > > > > Note that IRC, unlike MUDS, has been designed to ensure 'true-names'. While > > you do use nicknames, anyone can find out the machine name and user ID you are > > logged in from, with a /whois. Anytime you join or leave a channel, your full > > machine name and user ID is displayed to everyone, along with your nick. This > > is different from any (possibly pseudonymous) e-mail address you register for > > incoming mail. > > Fraid not....it's a trivial matter to fake the username, and if yer a > smart cookie, faking the hostname is just as easy. as far as I know, you have to hack the server to fake hostname. historically this practice has been frowned upon by the majority of IRC administrators. but yes, faking username is trivial. josh

1 0

Re: CU Crypto Session Sat
by freeman＠netcom.com 17 Dec '03

17 Dec '03

Phil Karn comments on spy-satellite resolution: > [Technical argument with which I agree, leading to approximate one-foot > resolution limit, deleted.] Phil's argument was for a 2-meter aperture at typical slant ranges in the visible-light band. I once did the calculation, also for a 2-meter aperture, with other circumstances being as optimal as I could make them; namely, looking straight down from a rather low perigee (I picked 200 Km), working in the near UV (where it still penetrates the atmosphere reasonably well -- I picked 3000 Angstroms as a round number), and with perfect seeing (which depends on luck, weather and exposure times, and perhaps on telescope and/or image-processing technology). For a circular aperture, the nominal resolving power (in radians) -- that is, the Airy disc radius to the first minimum -- is 1.22 * wavelength / aperture diameter, which for this case works out to 0.183 microradian. Multiplying by 200 Km gives 3.66 cm resolution on the ground. If one shapes the aperture to match the pattern under study, one can drive that factor of 1.22 down to as little as 0.5, but such shaping would likely be useful only for specific patterns not likely in the actual observation. I am told that careful image processing can sometimes resolve things a little below the Airy-disc limit, but not far -- the information really goes away fast at higher angular frequencies. So all in all, I am inclined to think that the best ground resolution attainable with a 2-meter aperture from orbit is about an inch. That is in fact just about enough to read a poker hand -- the spots on the cards are an inch or so apart -- but you might have trouble telling the face cards apart, as well as telling hearts from diamonds and clubs from spades. That is, if cards were well spread out you might see that a certain card had five black spots on it, or had a "face". I should probably explain about "Airy disc": The term crops up often in the study of astronomical imaging. The image of a point light source by perfect optics is a bulls-eye, a bright central spot surrounded by alternating light and dark rings, called the "Airy disc" after the physicist who first described it analytically. The 1.22 * wavelength / aperture is the angle from the center of the bright spot to the middle of the first dark ring. Of course, a possible way around this limit is to put up a larger, segmented mirror... -- Jay Freeman PS: References to physics texts on request...

7 7

Re: message splitting for better mixing?
by Hal 17 Dec '03

17 Dec '03

Jim Miller > > The idea: > > 1) write sender-side code to split message into N parts and send each > part through a different remailer chain. > > 2) decrypt the parts as they arrive as per normal encrypted remailer > messages. > > 3) write receiver-side code to detect "a part" and stuff it in a file > until the remaining related parts arrive. When all related parts > have arrived, present the complete message to receiver. Here is a program I found in the usenet archives which will do some of the splitting and merging features. Note that the merge is smart in that you just cat the pieces together and process them. The main feature of the prog is that you can reconstruct even with a few missing pieces, necessary because of the unreliability of remailer email. I don't think the splitting is cryptographically strong, but each piece could be separately encrypted if desired. > Path: ghost.dsi.unimi.it!rpi!zaphod.mps.ohio-state.edu!cs.utexas.edu!uunet!newsflash.concordia.ca!clyde.concordia.ca!altitude!mirkwood.CAM.ORG!hebrais > From: hebrais(a)mirkwood.CAM.ORG (Philippe Hebrais) > Newsgroups: alt.sources > Subject: shade -- split a file with shadows > Message-ID: <hebrais.0xu4(a)mirkwood.CAM.ORG> > Date: 13 Dec 92 07:57:05 GMT > Organization: Secte des adorateurs des semiconducteurs > Lines: 675 > X-Newsreader: MeNews 2.8.0 > > > SSSSS HH HH AAA DDDD EEEEEEE > SS SS HH HH AA AA DD DD EE > SSS HH HH AA AA DD DD EE > SSS HH HH AA AA DD DD EE > SSS HHHHHHH AAAAAAA DD DD EEEE > SSS HH HH AA AA DD DD EE > SSS HH HH AA AA DD DD EE > SS SS HH HH AA AA DD DD EE > SSSSS HH HH AA AA DDDD EEEEEEE > > `shade' is a file splitting and merging utility. It takes a large > file and splits it into uniformly sized blocks. It can also output > extra blocks (called shadows). These shadows can be used to recover > missing sections if they get corrupted or it they are lost. With a > single shadow, `shade' can recover ANY single missing block. As many > shadows are needed as there are blocks missing. If too few blocks > and shadows are available, nothing can be recovered. > > For example, foo.bar (259042 bytes) is split into 5 sections > of 45000 bytes, 1 section of 34042 bytes and 2 shadows of > 45000 bytes. Each of these 8 parts is sent through email. > Even if any two of these eight parts gets lost, the original > foo.bar can be reconstructed. > > `shade' is a simple application of the chinese remainder theorem > for polynomials with coeficients modulo two. For more information > see the comments at the beginning of project.c. > > > > SAMPLE USAGE > > Split "bar" (111042 bytes) into 20000 byte chunks and output 2 > shadows. All these parts will be uuencoded and output to > foo.uu.001, foo.uu.002, etc. > > % shade -u -k 2 -l 20000 -o foo bar > [001] [002] [003] [004] [005] [006] [aaa] [aab] Done. > > Merge these parts back together: > > % rm foo.uu.003 foo.uu.005 > % cat foo.uu.* | shade -m -u > Merging bar (111042 bytes) > Got section 4 (20000 bytes) > Got section 1 (20000 bytes) > Got section 2 (20000 bytes) > Got section 6 (11042 bytes) > Got shadow 1 (20000 bytes) > Got shadow 2 (20000 bytes) > > Missing: [003] [005] > > Recovering 2 sections: > [001] [002] [aaa] [004] [aab] [006] > > > > DISTRIBUTION > > Shade is copyright Philippe Hebrais 1992. You have the permission > to use this code is anyway you feel appropriate as long as you give > credit where it is due. There is no warranty of any kind. I am not > responsible for any damage caused directly or indirectly by this > program. > > > AUTHOR > , > Philippe Hebrais <hebrais(a)mirkwood.cam.org> > > -- > Philippe Hebrais hebrais(a)mirkwood.cam.org > Voix: (514)731-9146 uunet!philmtl!altitude!mirkwood!hebrais

1 0

spy satellites
by Hal 17 Dec '03

17 Dec '03

Two points re the spy satellite thread. First, spy satellites want to be close to what they are looking at, so they can see it better. That means they are generally in low orbits, and low orbits are fast orbits. Typical speeds are on the order of 10,000 mph. This means that any given spot is in view of a particular satellite for only a few minutes on each pass, and due to the earth's rotation it is hard to pass repeatedly over the same spot frequently. This means you need a large number of satellites in order to provide much coverage, and even then you will probably get snapshots at an interval of hours at best (I don't know how many satellites are flying). This is OK for military bases where you are looking at construction, ships, and other large equipment, but it is not at all adequate for tracking the movement of terrorists. Secondly, any technology which did allow the government to surveil us well enough to track the physical movements and meetings of terrorists would be far more of a threat than any Clipper chip! Offering satellite surveillance as an alternative to Clipper jumps from the frying pan into the fire, IMO. Hal

1 0