December 2003 - cypherpunks-legacy

Re: Please send me SSL problems...
by Erik E. Fair 17 Dec '03

17 Dec '03

> I'd just like to let all cypherpunks know that I'm really interested in >getting any feedback you might have about security problems with Netscape >products. I'm particularly interested in bugs in the our implementation >of SSL, and problems in the protocol that are not addressed in SSL 3.0. > > We have been collecting comments on SSL 3.0, and have started incorporating >that feedback into our spec. Please don't assume that our lack of response >means that we are ignoring your comments. Between Navigator 2.0 and >things like the SSL challenge and the RNG fire drill, we just have not had >the time to get a new rev of the spec out. Hopefully soon... Jeff, the SSL specification has a severe *architectural* problem - it assumes that Internet Protocols are APIs - interface standards, and that you can just slide a "layer" underneath without anyone noticing. Such is not the case - all the Internet Protocols are real protocol standards, in that they specify the syntax, order, and semantics of the actual bits on the wire. The IETF quite explicitly doesn't care about APIs - that's a host software issue, and it doesn't matter what the host software looks like (or even what the machine looks like), so long as it gets the bits on the wire right, according to the protocol spec. This is how the Internet can make very strong guarantees about interoperability. You can't fiddle with a communication protocol without getting agreement from everyone about the change, or extend it in a way that is compatible with the protocol you're modifying, on a per-protocol basis (e.g. adding a TELNET negotiation option to TELNET for encryption, an FTP command to FTP, etc). Otherwise, all you've done is made a private, non-interoperable change to an existing protocol that guarantees interoperability *failures* between systems that implement the existing specification, versus your own version of HTTP, or TELNET, or whatever. In short, the SSL specification, as written, proposes to change all Internet application protocols, globally - "slide in a layer." That's not how it's done, and it's not the right place to do it, even if it appears to work in an enclave of systems. About the SSL protocol, encryption algorithms, or the SQA that went into 'em, I think other people have expounded on those issues eloquently, and so I have nothing to add to that. Erik Fair

4 4

Re: Please send me SSL problems...
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <9509210118.ZM154@tofuhut>, jsw(a)netscape.com (Jeff Weinstein) writes: > I don't think that the API that SSLRef export is not particularly interesting. Yikes!! I can't believe I wrote that. What I meant was: I don't think that the API that SSLRef exports is particularly interesting. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

USACM APPLAUDS CALIFORNIA LEGISLATURE
by ACM US Public Policy Office 17 Dec '03

17 Dec '03

PRESS RELEASE Association for Computing U.S. Public Policy Office September 8, 1997 USACM APPLAUDS CALIFORNIA LEGISLATURE FOR UNANIMOUSLY ENDORSING RELAXED EXPORT CONTROLS ON ENCRYPTION As the Congress prepares to address the issue of computer security and privacy, the California legislature has sent a clear message that relaxing controls on cryptography is a critical first step. On September 5, the California legislature passed a resolution that calls on the California members in Congress to support legislation that would make it easier for US companies to develop and market strong cryptography products. The resolution was sponsored by Representative Vasconcellos (D. San Jose) and passed without opposition. Dr. Barbara Simons, chair of the policy committee for the Association for Computing (USACM), said that the California resolution makes clear that industry and users are united in support of good cryptography. "We believe that Congress should support the Security and Freedom Act, sponsored by Representative Goodlatte. The legislation will help protect security and privacy on the internet. It will be a serious mistake for the administration to oppose the development of this technology," said Dr. Simons. On August 26, USACM Chair Barbara Simons spoke in support of the Vasconcellos resolution before a California Senate committee. Also participating at the Committee hearing were Dr. Whit Diffie from Sun, Kelly Blough from PGP, Jack Wilson of ACL Datacom, Chuck Marson representing the California Internet Industry Alliance (Netscape, Microsoft, AOL, CompuServe and Netcom), and a representative of the Software Publishers Association. Undersecretary of Commerce Reinsch wrote a letter opposing the resolution. The Association for Computing (ACM) is an international non-profit educational and scientific society with 76,000 members worldwide, 60,000 of whom reside in the U.S. USACM, the Association for Computing's U.S. Public Policy Office, serves as the focal point for ACM's interaction with U.S. government organizations, the computing community and the U.S. public in all matters of U.S. public policy related to information technology. The USACM web site is located at http://www.acm.org/usacm/ For more information, please contact USACM Chair Barbara Simons at 408/256-3661 or USACM Associate Director Lauren Gelman at 202/544-4859. /\ /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Association for Computing, + http://www.acm.org/usacm/ Office of U.S. Public Policy * +1 202 544 4859 (tel) 666 Pennsylvania Ave., SE Suite 302 B * +1 202 547 5482 (fax) Washington, DC 20003 USA + gelman(a)acm.org To subscribe to the ACM Washington Update, send e-mail to: listserv(a)acm.org with "subscribe WASHINGTON-UPDATE name" (no quotes) in the body of the message.

1 0

What's with the list? (Ol
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

DM|Anyone else get old c'punks postings remailed to them from August? Yup. Blech. furi(a)the-matrix.com pgp-public-key(a)demon.co.uk C1225CE1 RADical 1 Systems - Multi-Platform Custom Programming, Service, & Support

1 0

Re: netscape's response
by Jeff Weinstein 17 Dec '03

17 Dec '03

NOTE: my first attempt to send this bounced at toad.com On Sep 20, 5:16pm, David_A Wagner wrote: > Subject: Re: netscape's response > In article <9509200139.ZM206@tofuhut> you write: > > On Sep 20, 12:29am, Christian Wettergren wrote: > > > One wild idea that I just got was to have servers and clients exchange > > > random numbers (not seeds of course), in a kind of chaining way. Since > > > most viewers connect to a number of servers, and all servers are > > > connected to by many clients, they would mix "randomness sources" with > > > each other, making it impossible to observe the local environment > > > only. And the random values would of course be encrypted under the > > > session key, making it impossible to "watch the wire". > > > > Wow, this is a great idea!! > > Are you quite sure this is a good idea? > > I'd be very scared of it. In particular, it opens up the chance for > adversaries to feed you specially chosen numbers to pollute your seeds. What I should have said is that its a very interesting idea. Given current perceptions of netscape, I should have made clear that I wouldn't do something like this without getting a lot more discussion and review of possible dangers and how to avoid them. I certainly can't fault anyone for wondering if we would just implement this without thinking it through, given recent events. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Letter sent to SJ Mercury staff on CA SJR-29 ...
by Ernest Hua 17 Dec '03

17 Dec '03

Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.current.s… The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

Credit Card might-as-well-equal SSN
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Tue, 9 Sep 1997 15:18:47 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Subject: Credit Card might-as-well-equal SSN Date: Tue, 09 Sep 1997 15:17:52 -0400 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/2196 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: Nev Dull <nev(a)bostic.com> Forwarded-by: Jon Loeliger <jdl(a)jdl.com> PRIVACY Forum Digest Monday, 8 September 1997 Volume 06 : Issue 12 Moderated by Lauren Weinstein (lauren(a)vortex.com) Vortex Technology, Woodland Hills, CA, U.S.A. ===== PRIVACY FORUM ===== ------------------------------------------------------------------- The PRIVACY Forum is supported in part by the ACM (Association for Computing) Committee on Computers and Public Policy, "internetMCI" (a service of the Data Services Division of MCI Telecommunications Corporation), and Cisco Systems, Inc. - - - ------------------------------------------------------------------- Date: Wed, 13 Aug 1997 21:38:55 -0500 From: MSproul <msproul(a)arnet.arn.net> Subject: U-Haul/Credit Cards/Social Security Numbers Today I went to the local U-Haul to rent a small trailer to move a lawn tractor. In the course of filling out the rental agreement I was asked for my drivers license then asked for my social security number which I refused to give. (Texas does not have SSN on the driver's license) The agent then asked for a credit card, which I was planning to use to charge the rental. During the subsequent discussion the agent told me that since the Oklahoma bombing if they don't get a SSN they are required to to get a credit card number as a second form of identification. They can then get the SSN from the credit card issuer. Questions: Is this for real? How wide spread is this? What does U-Haul do with your SSN? How difficult is it for someone (company) to get your SSN when you use your credit card? M. L. Sproul Amarillo, TX [ Under current law, your SSN is part of what's called "credit header" data, and is (no longer) protected under the FCRA (Fair Credit Reporting Act). This means that for all intents and purposes, your SSN is public information. -- MODERATOR ] --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

3 2

FW: Notification: Inbound Mail Failure
by Montgomery, Lynn 17 Dec '03

17 Dec '03

Please remove dpeterson(a)jonescyber.com from your mailing list. He is no longer at this company. -----Original Message----- From: Montgomery, Lynn Sent: Tuesday, September 09, 1997 2:46 PM To: Montgomery, Lynn Subject: Notification: Inbound Mail Failure The following recipients did not receive the attached mail. A NDR was not sent to the originator for the following recipients for one of the following reasons: * The Delivery Status Notification options did not request failure notification, or requested no notification. * The message was of precedence bulk. NDR reasons are listed with each recipient, along with the notification requested for that recipient, or the precedence. <dpeterson(a)jonescyber.com> dpeterson(a)jonescyber.com MSEXCH:IMS:JONES:CORPORATE:CEDAR 0 (000C05A6) Unknown Recipient Precedence: bulk The message that caused this notification was: To: cypherpunks(a)toad.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... From: Ernest Hua <hua(a)chromatic.com> Date: Tue, 9 Sep 1997 14:30:38 -0600 Cc: hua(a)chromatic.com Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.curren t.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

RE: Letter sent to SJ Mercury staff on CA SJR-29 ...
by Chris DiBona 17 Dec '03

17 Dec '03

The reason is because... The sjmn is crap. Thier valley coverage is terrible, and when it isn't it's coming off ap or reuters. They commonly commit factual errors and thier business editor is a joke. My friends and I in the valley don't even call it by it's name, it's become known as the "Fry's ad" (for those not in the valley, frys is a large consumer and computer electronics shop. But on steriods. And they advertise like crazy all over the sjmn). Remember SJMN motto: If it's news, it ain't here. Chris -----Original Message----- From: Ernest Hua [SMTP:hua@chromatic.com] Sent: Tuesday, September 09, 1997 1:31 PM To: cypherpunks(a)toad.com Cc: hua(a)chromatic.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.cu rrent.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

Re: first virtual "security" (!!) (was Re: Security Flaw Is Discovered InSoftware Used in Shopping)
by NSB's Portable (via RadioMail) 17 Dec '03

17 Dec '03

At 4:32 AM 9/21/95 +0200, Laurent Demailly wrote: >You have excellent points in your detailed answer, thank you, but Thanks. I'm glad to be able to conduct this discussion at a cordial and intelligent level. >If FV was as used as SSL could be, what prevents, to use your terms, >someone to get MILLIONS of FV's identifiers and use each one only >once, etc ... (imo your figures about SSL and crypto softs risks are >over evaluated, so I over evaluate the 'risks' of yours using same >assumptions) I think you still don't get it, Laurent. If you intercept millions of credit cards, you immediately have something very valuable and untraceable. An FV-ID is much less useful than a credit card number, because it only works with email confirmation and only works on the net. And merely intercepting them doesn't get you anything -- you have to be able to answer the confirmation messages, which is much harder to do "en masse" than passively sniffing for things (and possibly then decrypting them). And a scheme that also replies to such messages is far more likely to leave traces by which the criminal is caught. In other words, when you look at the "millions of interceptions" case, the value of doing this is lower for FV, the difficulty of automating it in the large scale is higher, and the risk of detection is higher, as compared with a one-way scheme that transmits credit cards, whether encrypted or not. >There can't be more security by transferring data on the clear >compared to an encrypted one... except maybe that people using >encryption can often feel overconfident. Of course there can, if you're not talking about the same data, which we're not. It's much safer to transmit something without high intrinsic value in unencrypted form than to transmit something with high intrinsic value in encrypted form. That's why FV-ID's were designed the way they are -- low intrinsic value, easy to revoke & reissue, etc. By analogy, it is safer to send a weather report unencrypted than to send detailed instructions about nuclear weapons encrypted. >So, as someone pointed out, >it is not that much a problem about CC# which are available easily >anyway, but in fact, using encrypted communications is the only way to >ensure (some) *privacy*, in addition to being a security improvement. Also not true. A scheme like FV's gives a fairly high privacy level through the use of pseudonyms. Your FV-ID can be traced to you *only* by FV, and we won't hand out that informaton without a court order. >financial insecurity never was a problem as >long as it remains under a small %. This is an amazing statement, Laurent. It's sort of like saying that building a city in the middle of a flood plain isn't a problem as long as there isn't a flood. You can't dismiss even a low-probability disaster if the consequences of the disaster are extremely high. If the SSL bug had been discovered AFTER there were hundreds of millions of credit cards being transmitted via SSL, and if the person who discovered it had criminal intent, the entire global credit card infrastructure really would have been endangered. Personally, I'm always suspicious of any claims to have "fixed the last bug", so I don't see any reason to assume this isn't inevitable in the long run if a scheme like SSL is used. >Anyway, if you have happy customers, good for you... I'd suggest that >you'd use "Security through Clarity" as motto ;-) That's not a bad motto. I'd prefer to describe our system as focusing on practical, comprehensive security rather than chasing the myth of perfect cryptographic security. (For example, we've probably put more effort into making our server secure from breakins than just about any other site on the Internet.) We're not opposed to cryptography, by the way. There are some obvious places where the use of digital signatures could directly enhance our system, and we're pursuing them. It has also not escaped our notice that, even though we strongly believe that transmitting FV-ID's in the clear is safer than transmitting credit cards encrypted, it would be safer STILL to transmitthe FV-ID's encrypted -- sort of the best of both worlds. And you can count on our doing that when there is a good Internet infrastructure for doing so, which we don't yet believe to be the case. -- Nathaniel

1 0

Re: Please send me SSL problems...
by Rich Salz 17 Dec '03

17 Dec '03

>None of these organisations have mentioned GSSAPI to me. >Do you have a source? Digital: ask John Wray. IBM: find someone in the DSOM group HP: no name I can give.

1 0

Re: House National Security committee guts SAFE, worse than nobill
by Jonah Seiger 17 Dec '03

17 Dec '03

At 2:17 PM -0700 9/9/97, Declan McCullagh wrote: >This version of SAFE, in fact, is //much worse// for crypto freedom than >having no bill passed at all. True. <...> >It's time for advocates of crypto-freedom to turn obstructionist and >oppose all legislation dealing with encryption. And expect to accomplish what? To stick our heads in the sand now would just make it easier for the FBI to roll right over us. We still need to fight the expected FBI key recovey amendment when the Intelligence Committee and Commerce Committee vote this week, and then onto the floor (perhaps next year). Not to mention the Senate. This battle is FAR from over. It would be a serous mistake to give up now. Best, Jonah PS: Interestingly, Reuters is reporting that the Administraon has "serious problems" with the Dellums/Weldon Amendment: Clinton official not backing new encryption plan WASHINGTON, Sept 9 (Reuter) - The Clinton administration has serious problems with a new congressional proposal to tighten export limits on computer encoding technology even though it prefers the approach to one contained in earlier legislation, a top official said on Tuesday. Under Secretary of Commerce William Reinsch told Reuters that an amendment approved by the House National Security Committee earlier on Tuesday would give the secretary of defense veto power over encryption export decisions. "Giving the secretary of defense a veto is inconsistent with the president's executive order and inconsistent with the policies of four prior administrations," Reinsch said. "The administration thinks all relevent agencies should have a seat at the table and none should have a veto." Under current policy, enacted by presidential order last year, encryption export requests are reviewed by the Departments of State, Defense, Energy, Commerce and Justice, along with the Arms Control and Disarmament Agency. The most powerful encryption products cannot be exported unless they contain a feature allowing the government to decode any messages covertly. The amendment, authored by Rep. Curt Weldon, Republican of Pennsylvania, and Rep. Ron Dellums, Democrat of California, would require the president to set "the maximum level of encryption strength that could be exported from the United States ... without harm to the national security of the United States." Products at or below the established level could be exported after a one-time review specified by the secretary of commerce with the concurrence of the secretary of defense. The proposal virtually gutted the bill to which it was attached. The original bill, written by Virginia Republican Rep. Bob Goodlatte, would greatly relax export controls. Reinsch said the administration supported the "harm to the national security" standard. "It gives the administration the authority it needs," he said. "We'd much rather have this than (the original)." Software companies, civil libertarians and Internet user groups all favor relaxing the current limits and expressed strong concerns about the Weldon amendment. The amendment appeared to outlaw differential treatment currently accorded to some encryption products used by financial institutions or subsidiaries of U.S. companies. Reinsch said that section of the amendment "could be more artfully drafted." He also criticized the proposal for not requiring companies to export products with features allowing for government access to coded messages, an approach known as key recovery. The current policy "links all of the parts together and uses export controls as a device to move towards key recovery," he said. "We believe export controls should include key recovery." --Aaron Pressman((202-898-8312)) Tuesday, 9 September 1997 18:02:46 RTRS [nN0972124] * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager: +1.202.859.2151 <jseiger(a)cdt.org> http://www.cdt.org PGP Key via finger http://www.cdt.org/homes/jseiger/

11 18

Renaming TEA remailer
by Antonomasia 17 Dec '03

17 Dec '03

I am advised by Mark Hedges that Anonymizer, Inc. owns the trademark for the product name "Anonymizer" and at his request I have changed name of the tea remailer to 'Tea Remailer'. I believe I have made changes everywhere the name appears. -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

4 4

Re: Cdn-Firearms Digest V1 #982
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Forwarded from the Canadian Firearms Digest V1 #982 -------------------------------------------------------------------- Date: Tue, 9 Sep 1997 11:31:58 -0600 From: "David A. Tomlinson" <nfadat(a)telusplanet.net> Subject: Provincial-Federal Court Battle Over Gun Law The first day of court: An application from Clayton Ruby (the Coalition For Gun Control Lawyer [CFGC]) to have a paper by one Professor Killias admitted waas denied. The CFGC had submitted it, then fiddled around to prevent cross-examination of Prof. Killias. An earlier judge had then ruled the paper inadmissible because there was no opportunity for cross-examination. The Court ruled 3 to 2 to exclude the paper. Rod McLennan, acting for Alberta, then put Alberta's case. It quickly became evident that Chief Justice of Alberta Catherine Fraser had carefully studied the federal government's case. She mousetrapped McLennan into a swamp by asking him why registration of handguns was legitimate, and registration of rifles and shotguns was not. Instead of pointing out that the matter of registration of handguns was not before the court, that the question of the legitimacy of registration of handguns was an issue that might appear someday before some other court, that only the opinion of the judge in such a case could settle the legitimacy or otherwise of handgun registration, and that he could only give his personal opinion on the matter, McLennan tried to answer her. He assumed that handguns are intrinsically evil, that registration of handguns is legal and proper and constitutional. Those were dubious assumptions, and only his personal opinions. He characterized handguns as having no legitimate purpose, as being used primarily by criminals, and as legitimate targets for regulation within the criminal law. The judge then demanded to know why the arguments for registration of handguns should not apply to rifles and shotguns. McLennan was reduced to arguing that the difference between a rifle/shotgun and a handgun was "one of degree." He had been mousetrapped into fighting from a bad position that he could have -- and should have -- refused to move into. McLennan then recouped his losses by reading into the record a prepared statement (NOT something uttered in the heat of debate) made by Alan Rock during his introduction of Bill C-68. In that statement, he made it very clear that C-68 is not aimed at criminals, is expected to have no effect on crime or criminals, but is designed to make our society more "orderly," and to control property. In short, he gave a convincing presentation to tell Parliament that C-68 is REGULATORY law, dealing with PROPERTY issues, and equating it with automobile registration laws. Why is that important? Law is divided into regulatory law and criminal law. Broadly speaking, Criminal law prohibits behavior that is evil and damaging to the rights of others. Violation of a criminal law is, almost always, punishable by a term of imprisonment. Criminal law and its severe punishments are reserved for the worst evils found in society. The consitution allocates the power to make criminal law to the federal Parliament. Broadly speaking, regulatory law is law that regulates society, prohibiting behavior that normally will not -- but MIGHT -- have evil or damaging effects on the rights of others. Regulatory law is usually NOT punishable by a term of imprisonment. Regulatory law and its gentler punishments are reserved for REGULATION of our society, with the intent to make life easier and more orderly, and to deal with property issues (e.g., should you be allowed to own pesticides, or store pesticides where rain can corrode the containers). The Constitution allocates the power to make regulatory law -- in fields that existed before Confederation (1867) -- to the provincial legislatures. (In fields that did not exist prior to 1867 (e.g., air transport) and fields that straddle provinces (e.g., marine transport), the Constitution allocates the power to make regulatory law to the federal government. Firearms clearly existed before 1867, and their ownership, possession and use is local. Firearms are property.) Rock's equation of firearms registration with motor vehicle registration is useful. Motor vehicle registration is only required for motor vehicles that travel public roads, not for POSSESSION of motor vehicles. It is PROVINCIAL REGULATORY law, not FEDERAL CRIMINAL law. Imprisonment is NOT a punishment that can be imposed for violation of a motor vehicle registration law. When Rock equated the two in his prepared statement, he largely made the provincial case. Registration of firearms may be imposed by government in a law, but it is fundamentally REGULATORY in nature, not CRIMINAL. One question that has not been raised yet -- and should be -- is the question of licensing within the CRIMINAL law. Bill C-68 criminalizes simple possession of any firearm. If a person has possession of any firearm, that is a crime, and his or her behavior is criminal behavior -- according to Bill C-68. In Bill C-68, the federal government then offers to SELL the person a license to commit that crime. If that concept is worthy of inclusion in the criminal law, one wonders how far such a precedent may take us. Will our government someday be selling licenses to burgle? To murder? Obviously, those two suggestions are laughable -- today. We must, however, recognize how much laws change over a term of years. It was not that long ago that we prosecuted Mafia hirelings for their activities in selling gambling tickets that gave people chances to win money through the "numbers racket." Today, the "numbers racket" has been taken away from the Mafia. We buy our tickets legally -- from the federal government -- and the renamed "numbers racket" is called Lotto 6/49. Oddly enough, the Mafia used to give us better odds than the federal government does today. When one looks at licensing the commission of crimes, the problems become clear. If the criminal law is reserved for dealing with crimes and criminal behavior -- the sort of evils that have major damaging effects on the rights of others -- then how can such bad behavior be legitimized by selling a license to commit the crime to any applicant? Either the behavior is not that evil -- in fact, is perfectly acceptable in our society -- or the selling of the license to engage in the behavior is wrong. True, the C-68 system contains ways to deny the license; but it is unequivocal that the license is available, that the behavior is NOT intrinsically evil, and that the government expects huge numbers of Canadians to buy the license. The "evil" behavior is acceptable -- yet it is a crime. There is something wrong here. There is something very disturbing about the selling of licenses to commit crimes. One cannot help but feel that either the behavior is not truly criminal behavior, or, alternatively, the law is actually REGULATORY law that should NOT be embedded in the criminal law. And what happens when the applicant cannot afford to buy the license? Some of the licenses offered in Bill C-68 will cost over $1000. Is it fair or reasonable that a person should be criminalized by poverty -- or alternatively, denied the right to participate in a business, sport or recreational activity by government avarice? The more one looks at the regulatory nature of Bill C-68 -- as was so ably described by then Minister of Justice Rock -- the more one is disturbed to find it embedded within the criminal law, laced about with penalties of multiple years of imprisonment, and defective in its principles. For example, Bill C-68 makes it a criminal offence to be in possession of any firearm. Then it offers to sell a license commit that crime, to engage in that criminal activity. A Canadian buys the license, and engages in the behavior. Five years later, the license expires. If the person does not notice that his license has expired, the expiry criminalizes the individual without his knowledge. The penalty is multiple years of imprisonment. There have already been laws on the books that were struck down for that defect. The principles of our laws make it impossible to have a law that imposes imprisonment for an offence where the accused did nothing wrong, but merely did not notice that an expiring document was about to criminalize him or her. One hopes that those aspects of Bill C-68 will be brought out in future days of the Alberta Court of Appeal hearing. Dave Tomllinson, NFA -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by Pat Farrell 17 Dec '03

17 Dec '03

thad(a)hammerhead.com (Thaddeus J. Beier) writes: > At this point, in this country, a patent is secret until it is issued. This will change in the US fairly soon. It is fallout of one of the world-wide trade and tarriff treaties -- we have to make our patent process be more in line with the rest of the world. One of the big technical challenges that the PTO and PRC have is how to release in-process patents securly. (PRC is the systems integrator for the PTO's APS (advanced Patent System) that had all the text and images of all patents since 1970 online.) They have even talked about putting patents on the WWW, but actually doing it is quite a way off in the future. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: USA Today on Fear of Credit Cards over Net
by Randy Catoe 17 Dec '03

17 Dec '03

At 07:35 PM 9/20/95 -0400, Perry E. Metzger wrote: > >Re: The risk of credit cards. > >I suppose that indeed there are large risks elsewhere in the credit >card system. However, I think that the credit card system itself is >stupid and insecure and ought to be scrapped -- sending around account >numbers as magic keys to get payment is a stupid move. Its not >suprising how large credit card fraud is. > >One of the great hopes I have for cryptographic technology is its >ability to lower the incidence of fraud, and thus lower transaction >costs a lot. Someday, hopefully, everyone will be able to be a credit >card merchant because you won't have to trust the merchants not to >steal. > >Perry > > I'm told that the revenue lost to fraud in the credit card industry is around .15 percent of the gross purchase value. I'm also told that the credit card companies actually face higher costs from disputes, i.e. when you call them up and busy out a person to resolve a question on you bill. Randy

2 1

Re: Net Papa: Global Internet Taxes Inevitable
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> --------------------------------------------------------------------- > This mail is brought to you by the e$pam mailing list > --------------------------------------------------------------------- > (09/09/97; 12:00 p.m. EDT) > By Douglas Hayward, TechWire > > Cerf co-developed the > TCP/IP[LINK] protocol on which all Web and Net transaction depend. Net-Papa bullshit! > ..."If something is becoming an infrastructure that is important for > people's daily lives, then governments will have the right to be > concerned about the public's safety and well-being," Cerf said. Absolute Bullshit! Bit tax comes down to taxing thinking! This guy might have been a (past tense) a smart programmer but he'd better shut up about the rest... jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

Re: USA Today on Fear of Credit Cards over Net
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)piermont.com> writes: > > Re: The risk of credit cards. > > I suppose that indeed there are large risks elsewhere in the credit > card system. However, I think that the credit card system itself is > stupid and insecure and ought to be scrapped -- sending around account > numbers as magic keys to get payment is a stupid move. Its not > suprising how large credit card fraud is. Hence the fast growing popularity of those cash cards. -- WebCasters(tm) James C. Grubs jgrubs(a)left.webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: amp(a)pobox.com > Date: Tue, 09 Sep 1997 09:26:21 -0500 > Subject: Re: Removing Tyranny from Democracy (Part II), > was Democracy is the true enemy... > > > I don't believe there are intrinsic flaws in democracy, so much as > > there are intrinsic flaws in *human*nature* that are coming to light > > after decades. government is a reflection of our human natures. > > one cannot really expect a government to correct the flaws of its > > users, any more than software could do the same. > > No intrinsic flaws in democracy? > > Surely you jest. Please be so kind as to detail your top three flaws... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

PRNG state (and conditioning) (was Re: netscape's response)
by Carl Ellison 17 Dec '03

17 Dec '03

If you are looking for PRNG conditioning code, feel free to snarf code from http://www.clark.net/pub/cme/html/ranno.html I'm assuming your new PRNG has enough state (more than 64 bits) that the 128-bit key (or later, larger keys) is worth its bits. I'm assuming you solve the problem of finding enough entropy bits for seeding the PRNG and considering how to keep as much of that entropy as possible in your PRNG seed (rather than, for a silly example, distilling it to an unsigned int for driving rand() ). For example, the state in ranG (from the giveaway code) or in ranM may not by itself lead to a secure PRNG, but when it drives a one-way function (e.g., ranH, ranD, ranN) the state is still serving a purpose. [ranG keeps 186 bytes of state while ranM keeps 32KB of state.] - Carl

1 0

Re: "random" number seeds vs. Netscape
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Philip L. Karlton said: > > I agree, but I have a hard arguing with those that asser that the security > of UNIX is weak enough that given what we are doing for the patch it will > be easier to become root from a logged in account than to hack the seed. > Why would you have to argue with them? When they say that's it's easier to become root from a logged in account tell them, "Good, that's just as it should be!" It's a feature, not a problem! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

A Short History of Liberty
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Below is a copy of "A Short History of Liberty" by Dean Russell first published in the Freeman in Jan 1955. Copied from "Essays in Liberty" Volume III, published by the FEE (The Foundation for Economic Education, Inc,) 1958. "From Biblical times onward, the history of liberty and progress among various peoples seems to have followed a remarkably similar pattern. there are exceptions, of course-and the time element varies widely-but the pattern may be generally described by ten key ideas in sequence:" 1. BONDAGE. At some point in their histories, all peoples seem to have existed in some form of bondage or slavery-frequently even to their own domestic rulers by their own votes or acquiescence. But when thoughtful persons finally become aware that they are no longer free men, they want to know why. When they ask themselves that question, they automatically turn to contemplation and soul searching. Out of this grows ... 2. FAITH. If people in bondage have no faith-either in a personal Creator or impersonal ideal-they will remain slaves and eventually die out or be absorbed by another culture. But an intelligent faith will almost always develop into ... 3. UNDERSTANDING. A person's faith needs to be buttressed by an understanding of why it is evil to force any peaceful person to conform to the will and ideas of another person. Otherwise, he is apt to remain a faithful slave or attempt to become a slave-owner. But the combination of faith and understanding results in the necessary ... 4. COURAGE. You may depend upon it, courageous men with faith and understanding will neither remain in bondage nor keep others in bondage. Even against great odds, this combination leads to ... 5. LIBERTY. Liberty is a relationship among persons wherein no person molests any other peaceful person in his ideas, possessions, or actions. Liberty may also be viewed as the responsibility one assumes for himself and recognizes in all others, for there can be no liberty where there is no responsibility. Liberty has never existed completely among any people at any time; but where it has existed to a high degree, the resulting freedom to work, trade, choose, win, lose, and bargain has always meant ... 6. ABUNDANCE. But if an abundance of material things is the primary aim of a person, his life is devoid of any real meaning. For if the goal is abundance, its achievement logically results in ... 7. COMPLACENCY. Complacency and self-satisfaction (the "full barns" of the Biblical lesson) inevitably lead to ... 8. APATHY. With apathy comes a dullness and loss of interest-a "let George do it" philosophy. And there will always be many political "Georges" around to accept this invitation to seize both the reins and the whip. This always degenerates into ... 9. DEPENDENCY. For a time, it is possible for dependents to be unaware that they are dependents. As they continue to shed the personal responsibilities which *are* freedom, they also continue to delude themselves that they are still free people-"We never had it so good." Or they may be deluded into believing that they are still free so long they themselves are able to participate in the mechanical processes of selecting their rulers-"We can still vote, can't we?" But dependents are at the mercy of the persons or groups or parties upon whom they depend for their housing, or security in old age, or subsidies, or education, or medical care, or any of the other "aides" from political authority which cause persons to depend on others instead of themselves. Sooner or later, this dependency becomes know by its true nature ... 10. BONDAGE. Fortunately, the record shows that people can regain their faith, understanding, and courage. They can again become persons and citizens who are responsible for their own welfare, rather than units and subjects identified by numbers for the purposes of regimentation and subsidization. The record shows that people can, by their own intelligent actions, regain their liberty any time they want it. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNBXK9I9Co1n+aLhhAQF1iQQAgaukTVudUNFRAZUk++bbiN6Q3UK4XMCN enLRoBh5fb5wuBi3UHj2jGZ9d5DAr4KeksyRUTbK4ULpi/UXs0Eo8Dcgjp6I4afH XBlgDO+brpCebSbKU5pHATu2gviSmFCAlWYtsDbQdzja3mHsaZtVfU57sn9ZntFa YLP0lRWw3bg= =CrrO -----END PGP SIGNATURE-----

1 0

Re: RSA Prevails In Arbitration Against Cylink
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> Just a note for those who aren't aware, Business Wire is a pay-per-use > "news release" service. That is, RSA wrote the contents of what Bob > (Hi!) posted. > > The clue is at the bottom of the "story": > > CONTACT: RSA > Kurt Stammberger, 415/595-8782 > kurt(a)rsa.com > > This is not to say anything pro or con about the content of the press > release; just that it wasn't written by a third party. > > /jordan > I can't imagine that anyone wouldn't have known that, it was written from RSA's point of view. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

None
by Anonymous 17 Dec '03

17 Dec '03

John Young said: > Flame War, by Jonathan Quittner and Michelle Slatalla, > William Morrow, New York, 1997. 291 pp. $24.00 > ISBN 0-688-14366-0 Sure that isn't Alexis Slatella? ;) FedPlunger

1 0

With friends like these...
by Damaged Justice 17 Dec '03

17 Dec '03

...who needs enemas? (Administered by plunger, no doubt.) Internet Tax Plan Is Needed, Net Creator Says (09/09/97; 12:00 p.m. EDT) By [33]Douglas Hayward, [34]TechWire GENEVA -- Internet taxes are inevitable, according to the man dubbed the "Father of the Net." The only way to avoid global chaos is to create an international agreement on how to do it, added Vint Cerf at a meeting of the Internet Society here. Cerf co-developed the [35]TCP/IP[LINK] protocol on which all Web and Net transaction depend. Although proposals for taxing the Internet were rejected by both the Clinton administration and the European Commission earlier this year, there will be no way to avoid it, he said. "We need to be prepared for the day when there will be taxation as a consequence of Internet transactions," said Cerf, who is senior vice president for Internet architecture and engineering at MCI, in Washington. Taxation of the Internet, also called "bit taxes," must be well-planned, Cerf said. "And it must also be thought through on a global scale -- not parochially," he said. In the United States alone, there are 30,000 taxing authorities that might be interested in taxing transactions on the Internet, said Cerf, adding that right now, there is no way to determine which of those authorities should have jurisdiction over a particular transaction. "Imagine going through 30,000 tests for each transaction -- no transaction would ever go through," Cerf said. "If the Internet becomes a major tool for electronic commerce, every major taxing jurisdiction in the world will be interested in using that as a revenue stream." Although the rate of growth of visible Internet hosts appears to be slowing significantly, the growth of intranets is still on the rise, Cerf said. "Traffic is growing at such as rate that on [MCI's] backbone, we will have to consume as much fiber capacity for the Internet as for the telephone network by the third quarter of 2110," he said. As Internet traffic grows, Cerf said, legislators will move to regulate it. "You cannot have a fully and totally unregulated environment," he said. "If something is becoming an infrastructure that is important for people's daily lives, then governments will have the right to be concerned about the public's safety and well-being," Cerf said. "When you build roads, you make rules about how people are to behave on these roads, in order to protect people." [36]TW [37]Search Archives ____________________ [All CMP Publications] ______ Related Stories: [38]Europe Rejects "Bit Tax" [39]Congress To Take Byte Out Of Taxes [40]Clinton: Hands Off The Internet References 35. http://www.techweb.com/encyclopedia/defineterm.cgi?sstring=TCP/IP 36. http://www.techweb.com/ 37. http://www.techweb.com/search/search.html 38. http://www.techweb.com/se/directlink.cgi?WIR1997040812 39. http://www.techweb.com/se/directlink.cgi?WIR1997071107 40. http://www.techweb.com/se/directlink.cgi?INV1997070102

1 0