December 2003 - cypherpunks-legacy

Waco FU-CU
by John Young 17 Dec '03

17 Dec '03

Tim's mention of cypherpunks reaction to Waco savagery at the time prompts an offer of the NYT firebrand today on nationwide reaction to the film, "Waco: The Rules of Engagement," which is revealing an upsurge in anti-government questioning of the official story, and "not just from the wacko right" says one of the leftist filmmakers: http://jya.com/waco-rules.htm Audience members boo Attorney General Reno and "any other figure of authority in the film." For the officials' growing record of the "still smoldering story," see the Treasury Deapartment's file on the Waco Administrative Review Group Investigation: http://jya.com/treas-do-waco.txt It's fair to guess that FBI has a similar cache on deer-killing dissidents in the national interest, but it's not flaunted to wolf-freak the sheep in the feebs "privacy" file, unlike Treasury's baiting of "for law enforcement use only" -- Tim's aptly acronymed FLEUO replacing FU-CU.

1 0

W3C on PICS
by nobody＠neva.org 17 Dec '03

17 Dec '03

http://www.collegehill.com/ilp-news/reagle.html f r o n t p a g e | a b o u t | b a c k i s s u e s | s u b s c r i b e | a d v e r t i s e The ILPN discusses PICS with Joseph Reagle of the W3 Consortium August 18th 1997 Joseph Reagle Jr. joined the World Wide Web Consortium (W3C) in October of 1996 to focus on policy issues related to the development of global technologies and their relationship to social and legal structures. Specifically, how to promote "good" engineering when applied to a multifaceted and often contentious policy environment; one result of this activity is the W3C Statement on Policy. Mr. Reagle has also been working on filtering, digital signature, intellectual property rights management, and privacy capabilities on the Web. He has also been an active contributor to the development of the Platform for Privacy Preferences (P3) project at the W3C. P3 will enable computer users to be informed and to control the collection, use and disclosure of their personal information on the Web.ÿ ILPN: How does PICS work? The Platform for Internet Content Selection (PICS) is an infrastructure for associating labels (metadata) with Internet resources. It was originally designed to help parents and teachers control what children access on the Internet, but it also facilitates other uses for labels, including code signing, privacy, agents, and intellectual property rights management. PICS allows organizations to easily define content rating systems, and enable users to selectively block (or seek) information. The standard is not a rating system (like MPAA or RSACi), but an encoding method for the ratings of those systems. Those encoded ratings can then be distributed with documents, or through third party label bureaus. ILPN: Can you summarize the origin of PICS as well as the coalition behind [Related Links] its development? What role is W3C playing in the The World Wide Web ongoing development and Consortium PICS Site promotion of PICS? Family Friendly During 1995, a number of activities occurred that Internet...The White were related to concerns House Internet Content of children accessing Filtering Plan. potentially inappropriate Web content: Australian Anti-PICS Site 1. The Senate Judiciary Committee heard Ratings Now, testimony regarding the "Protection of Censorship Children From Tomorrow...from SALON Computer Pornography Act of 1995" (S. 892) ACLU Press Release 2. The Information on the July White Highway Parental House Summit Empowerment Group (IHPEG), a coalition Foucault in of three companies (Microsoft Cyberspace: Corporation, Netscape Surveillance, Communications, and Sovereignty and Progressive Hard-Wired Censors ... Networks), was formed an absolute must read to develop standards article from James for empowering Boyle, a law professor parents to screen at WashingtonÿCollege inappropriate network of Law, content. AmericanÿUniversity. 3. A number of standards for content labeling were proposed including Borenstein's and New's Internet Draft "KidCode" (June 1995), the Voluntary Internet Self Rating by Alex Stewart and NetRate by Peter Wayner. 4. A number of services and products for blocking inappropriate content were announced, including Cyber Patrol, CyberSitter, Internet Filter, NetNanny, SafeSurf, SurfWatch, and WebTrack. By August, the standards activity was consolidated under the auspices of the World Wide Web Consortium (W3C) when the W3C, IHPEG, and twenty other organizations agreed to merge their efforts and resources to develop a standard for content selection. The intent of the PICS project was to demonstrate that it was possible and better for individuals and families on the Internet to have control over the the information they receive, rather than creating a national framework for censorship. Today, the W3C believes PICS-based technology can fulfill the requirements of mediating access potentially offensive or illegal content. The next big step is educating the users on how to use those technologies. For the future, we are working on the Resource Description Framework as the basis for a richer metadata infrastructure. Applications such as our P3 privacy project will use it to enable sites to make privacy statements. ILPN: Can you describe the difference between 'labeling' 'filtering' and 'blocking,' and why this set of distinctions might be important? Paul Resnick's PICS Options FAQ has a very good answer to this question and some of the others that you ask. To summarize, labels are statements. They have the capability to describe a Web page, or to make any arbitrary assertion. Obviously, people can use such information to block, or select what they want to see. To generalize, one can use metadata to "rate" a Web page with respect to some rating system. Given ratings, a user applies a filter (her preferences about the ratings) to determine which pages are most appropriate; some action is associated with the result of the filtering. The common result is the blocking or selection of a page, but the user could also be presented with a list of sites sorted according to her preferences. ILPN: What do you make of the opposition by EFF, the American Library Association and the Electronic Privacy Information Center to PICS? Do you see PICS as a bulwark of free speech, or simply as the lesser of two evils (the other being government regulation)? I would characterize the response from each of those organizations differently, and of course my response is based on my own understanding of that position:ÿ 1. The ALA does not oppose PICS or filtering in general. I believe they acknowledge its usefulness as a means of parental empowerment, but do not feel it is appropriate for installation on every computer by default in their libraries. I respect this point of view while acknowledging that libraries may have requirements placed upon them by their constituencies or by the law with respect to illegal materials; it is up to the libraries, their constituencies, and governments to appropriately resolve these concerns. 2. I personally like the direction the EFF took in working on "Public Interest Principles for Online Filtration, Ratings and Labelling Systems" and hope to see such efforts continue. The W3C feels that metadata is necessary to the Web. Hence, I think it is somewhat naive to criticize the capability to support metadata. While I do not agree with every position in the EFF document, I liked it because I think it is more constructive to discuss how that metadata infrastructure can be best used (or how to prevent abuse) rather than trying to hobble the Web. 3. I, and my colleagues at the W3C, encourage rigorous discussion on the use of filtering technologies and how they affect individuals' rights. I do not buy the slippery slope argument that all technology which governments could use to do "bad things" must not be developed. I do not see PICS in grand terms; PICS is an application of metadata, as I explain elsewhere. To respond to the later question I do prefer the capability to exclude unwanted speech over the suppression of it at its source. Also, metadata itself is speech -- having the capability to laud, critique and criticize others is fundamental to a robust society. ILPN: How likely is it that PICS-based software will be mandated by governments at the level of ISPs? Unknown. Also, governments could theoretically do a number of things such as : * create rating systems * determine filtering criteria * require the use of filtering technology in servers or in clients * require the use of certain rating systems, etc. They can accomplish this by legislative action, by interpreting existing statutes, by promoting self-regulatory structures, or by providing incentives to comply with the policies by attaching liability, or removing it, to the players involved. Even with a specific question in hand, it would be a difficult task to predict the path of any nation. ILPN: Are you concerned with the potential abuse of PICS by governments and/or employers? Yes. I personally would protest or subvert my employer's or government's efforts in applying mandatory filters against my will; I do use filters to select content I am interested in and to get rid of spam and bozos. Regardless of my personal opinion, the W3C does not have the competency to tell other organizations what their policies should be. We can tell them about the technology and consequences of its use, but what they do with it is their choice obviously. ILPN: What about the possibility that a third-party labeling organization will obtain too much power? In terms of an independent third party? Let the market decide. If there are monopolistic concerns, a nation may wish to apply anti-trust laws. If it is a political entity, I hope it has some mechanism for being held accountable to its constituency. ILPN: We tend to think of PICS in terms of excluding materials deemed offensive. What are more 'positive' possible applications of PICS? PICS is merely one application of "metadata." Metadata means "data about data" and we are working very hard on this with our Resource Description Framework (RDF). This is a fundamental computer science concept and is essential to the future of the Web. Any time you wish to make a statement or an assertion, to rely upon a trusted opinion, it is "metadata." Our Platform for Privacy Preferences (P3) is another application of metadata. We wish to enable sites to make statements about their privacy practices so users are informed and can make choices about how they wish to interact with sites. A useful feature of metadata is that it is can be machine readable, so agents can act on behalf of the user, freeing the user to concentrate on higher order content and interactions. Hence, when I configure my agent, I should be able to search Web sites with the type of content I like, those which have privacy practices that I like, or that are referred to me by trusted third parties, and those that support the payment capabilities that I posses. ILPN: PICS seems to transform the web from an arena in which anything goes, and in which each individual must define his or her own participation, to an arena in which various 'cultures' can establish their own, separately designed comfort zones. Was this an intention of the PICS developers, or is it simply an unintended consequence of an effort to protect children? I donût know if this was an original, explicit intention of PICS, but it soon became apparent that this is what PICS was about: allowing people to create their own cultural boundaries on the Web. I look at a lot of what we do at the W3C as not only providing the basic infrastructure for exchanging hyperlinked documents, but we are providing the capability to have more sophisticated interactions with other users and agents on the Web -- homegrown cultures and societies. "Real world" entities may see these tools as ways of extending their own social structure onto the Web, and this is actually what a lot of the PICS debate is about in my opinion. We'll see how successful governments can be. In the meantime, the W3C does want to mitigate the possible fragmentation on the Web from either: 1) people dropping off it all together and creating their own, or 2) tearing it apart from fighting over whose cultural norms should prevail. I'll quote from the W3C Policy Statement on this point: ...This architecture must allow local policies to co-exist without cultural fragmentation or domination... http://www.w3.org/Policy/statement.html ILPN: Is W3C promoting the development of PICS into proxy server products? Yes. The PICS Options FAQ states that filter processing can be centralized at a proxy server while still permitting individuals to choose the filtering rules. I will qualify this by saying that it has never been the intent of the W3C to create technology for governments to use as a means of centralized control. Not that governments couldn't do such a thing (and there are other ways for them to do it if they wanted to), but that isn't our intent in working on this technology. ILPN:. What kind of legislation, and court cases, do you expect to see in the future regarding PICS? I expect to see continued activity in: 1. drawing the line between "illegal" and "inappropriate" content 2. determining what obligations services have in restricting illegal material 3. developing self regulatory structures for limiting childrens' access to "inappropriate" materialÿ (promoting a "family friendly internet.") ILPN: What should people maintaining web sites be doing regarding PICS and the various rating systems? Should people be rating their sites now? What might the consequences be for neglecting to rate one's site? Is it important for people to keep track of how their web sites are rated, and if so, how can they do this? Technologies, such as Microsystems Software's CyberLabeler, are being developed which follow the recommendations of the PICS specifications and make labeling sites much easier. Content creators that want to label should continue to demand such technologies and that such technologies be integrated into Web development applications. I expect that in the near future, many sites will be generated dynamically from databases; those databases will be indexed and structured by metadata. At which point, labels and rating will be integral to the creation of dynamic, customized sites. Search engines may also begin relying upon the useful information found in metadata to return more appropriate -- on "target" -- information to users. The consequence of not rating your site might be that if you have potentially illegal or offensive material you may draw regulatory attention upon yourself. Also, by not labeling you may be overlooked by those using filtering and content selection technologies. Most adult sites are more than happy to label and use filtering services, they want to attract those looking for the services they offerÿ while avoiding the difficulties associated with angry parents. ILPN:Thank you for your time. My pleasure. Send us your comments on this article Copyright 1997. All Rights Reserved f r o n t p a g e | a b o u t | b a c k i s s u e s | s u b s c r i b e | a d v e r t i s e

1 0

Re: write up AP for FC++
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Ian Grigg <iang(a)systemics.com>" typed: > > Zooko said: > > [ some mega-monkey drivel about all these ideas being the same ] > > More intellectual peasantry. There is more to an idea than who came > up with it first and whether it is related at some level or other to > another concept with a different name. Indeed there _is_ more to many ideas. Unfortunately, there is no more to this one. Regards, Zooko, Bane of Bogus Daydreams Posing As Ideas

1 0

Don't call if you are already rich!
by helledge＠oilfieldtrash.com 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// If you are already rich, don't call this toll free number. 1-800-811-2141 CODE 44393

1 0

CPAC Quotes Templeton
by Mike Duvos 17 Dec '03

17 Dec '03

Brad Templeton's thoughts on hyperlinks as copyright infringement may be browsed at... http://www.clari.net/brad/linkright.html -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 0

CPAC Quotes Templeton
by Mike Duvos 17 Dec '03

17 Dec '03

Those of you who have been following the efforts of CPAC and their associates to render homeless certain web sites which they feel might be frequented by thought criminals might find the following an interesting case of "strange bedfellows." It is apparent that CPAC doesn't like opposing points of view, particularly when they are seen in public forums hosted by CPAC on the Web. Messages which don't toe the CPAC party line mysteriously vanish and forums are frequently erased in their entirety when anything resembling a discussion appears. Now CPAC has claimed some new territory in their war to silence their critics. They maintain that no one who does not agree with their agenda may show a link to any of their publicly available resources on the Web, and that doing so constitutes theft of their bandwidth. <giggle> They quote as their cite for this concept a piece by Brad Templeton, ClariNet owner, who apparently shares their view that links can constitute copyright infringement under certain circumstances. Fortunately, Brad does not restrict linking to the article in question, from which I offer the following tiny snippet under the "Fair Use" doctrine. > I, and many other people initially had the intuitive feeling that it > could never be a violation of copyright to make a link to a web page. > Of late, I've come to think that this might be wrong. Now what CPAC objects to is people who post messages saying, essentially, "Look at the silly CPAC people rant and froth. <Click Here>" I would suggest that CPAC is a political organization, with a very well-defined social agenda, which I have every right to comment on, and that illustrative hyperlinks in my commentary constitute "Fair Use" of their content. Am I on firm legal ground here? -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

5 4

Status of Cypherpunks list sites?
by Tim May 17 Dec '03

17 Dec '03

I've noticed that the list site name, "cypherpunks(a)toad.com", is still in use by many posters. I find it on most of the posts I reply to, and I have to manually change to one of the three current lists. Not too long ago I was subscribed to the "cypherpunks(a)algebra.com" address, and the list stopped flowing to me for a day or so. I resubbed under "cypherpunks(a)cyberpass.net." I noticed that Igor Chudov said he was taking a hiatus from the Net and lists, so I wondered if this meant his support for his site was either being dropped or might be subject to more frequent outages. Anyway, has anybody been doing any pings of the various lists to see which ones are most available and have the lowest latencies for redistribution to subscribers? And shouldn't we all be making a more serious effort to drop the use of the "cypherpunks(a)toad.com" address, as John said some months back that he would support forwarding stuff for a while, but not necessarily forever. As it is, it just adds another hop and another potential weak link. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 2

Macintosh Users: "SpeedDoubler"
by tcmay＠got.net 17 Dec '03

17 Dec '03

For you Macintosh users, I thought I'd share with you my experiences with SpeedDoubler, a new utility that (effectively) doubles or even triples performance of many applications that still are heavily dependent on 68K code (as opposed to purely PowerPC code). My PowerMac 7100av is currently running at 80 MHz, with a 512K L2 cache, and 40 MB of physical RAM. (I can remember when 32K of "core" was a huge amount, and I can remember when Intel supplied 8 MB to CDC for their "Plato" system...at that time, one of the largest solid state memory installations ever.) SpeedDoubler, from Connectix, is a $60-70 (street) product that takes 68K code and makes various optimizations for the PPC. It's effectively the 68K emulator that Apple should have provided. (For you non-Mac users who are reading this, this technology of intercepting and translating code, is likely to be used to get higher performance out of code written ostensibly for one CPU but actually run on a later iteration of the processor. Such as the Pentium or P6 in running 16-bit code.) In Speedometer, I saw a 3.9x increase in "CPU"-related tasks (for 68K code), and a 2.4x increase in a SmalltalkAgents application which is only available at this time in 68K code form. Even the Finder runs faster, as various parts of it are still written in 68K code. So, as many programs are still in 68K code form, and not yet rewritten for the PPC, SpeedDoubler effectively gives you a machine that is almost twice as fast. There may be a few incompatibilities, and I would suggest you read comp.sys.mac.apps and other groups to verify that your critical apps are not having any problems. All I can say is that I'm very happy. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

ADULT VIDEOS
by 00896450＠hyperway.com 17 Dec '03

17 Dec '03

Explicit straight, gay and lesbian videos. http://www.espdirect.com/adult/ Absolutely discrete shipping within 24 hours. Visit our Web Site now... Adults only... You must be 18 years or over to visit. Click Here ********************************************************************* To be removed from our mailing lists, please send any message to: simrem(a)answerme.com Thank you *********************************************************************

1 0

Re: Phil Zimmermann/Amnesty International?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:50 AM 9/2/95, Robert A. Hayden wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On Fri, 1 Sep 1995, Michael Froomkin wrote: > >> I think he would have to be charged first. Have I missed something? >> PS when does the statute of limitations run out? > >I'm assuming that the statute of limitations has run out on most of these >things ( I don't know CA law, except to know it's weird :-) >What I'm concerned about, and nobody seems to have picked up on it, is >that one of the transcripts said that he and a partner beat up a bunch of >perps after they tried to surrender and that one of them died(!!). >That's murder in my book, and there is non statute of limitations on >that, even in California... Zimmermann and which partner? If it was Charlie Merritt, then all I can say is that I'm surprised. Kelly Goen...now there's a possibility. --Tim May P.S. As the thread title--"Re: Phil Zimmermann/Amnesty International?"--suggests, Phil Z. is the subject being discussed. Gary Jeffers made the bizarre speculation that Amnesty International might want to consider Phil a "prisoner of conscience" or a "political prisoner," or somesuch. All Michael Froomkin and others of us were pointing out is that this would be rather difficult, given that Phil has not even been charged, let alone tried, let alone imprisoned. How Mark Furhman migrated into this thread is beyond me. But, then, he killed Ron and Nicole, planted the glove to frame the nigger he hated so much, and was also involved in the bombing of the WTC. That he helped Phil export PGP is thus not surprising. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Direct Socket to Remailer?
by ROBO Mixmaster Remailer 17 Dec '03

17 Dec '03

I've heard of telnetting to port 25 to send SEMI-untraceable e-mail. The procedure, quite frankly, sounds rather complicated. Most of my mail that I don't want traced goes through the Mixmaster remailer network. I'm using Winsock-compatible software via a PPP connection. Is it possible, for example, to tell my mailer software to use the remailer itself, such as "remail.obscura.com" as the mail host, rather than "mail.myISP.com"? Will it work, at least for sending, without having an account at "obscura.com", or whatever remailer? Would that be less traceable than sending it through my ISP's mail host?

1 0

ADULT VIDEOS
by 00896450＠hyperway.com 17 Dec '03

17 Dec '03

Explicit straight, gay and lesbian videos. http://www.espdirect.com/adult/ Absolutely discrete shipping within 24 hours. Visit our Web Site now... Adults only... You must be 18 years or over to visit. Click Here ********************************************************************* To be removed from our mailing lists, please send any message to: simrem(a)answerme.com Thank you *********************************************************************

1 0

IETF security report
by Rich Salz 17 Dec '03

17 Dec '03

>From saag-request(a)neptune.tis.com Fri Sep 1 19:09:55 1995 Received: from TIS.COM (neptune.tis.com [192.94.214.96]) by postman.osf.org (8.6.9/8.6.x) with SMTP id TAA08164 for <rsalz(a)osf.org>; Fri, 1 Sep 1995 19:09:54 -0400 Received: from neptune.tis.com by neptune.TIS.COM id aa06599; 1 Sep 95 16:20 EDT Received: from relay.tis.com by neptune.TIS.COM id aa06595; 1 Sep 95 16:18 EDT Received: from big-screw.mit.edu(18.72.0.176) by relay.tis.com via smap (g3.0.1) id xma004617; Fri, 1 Sep 95 16:07:54 -0400 Received: by big-screw id AA23873; Fri, 1 Sep 95 16:18:03 -0400 Date: Fri, 1 Sep 95 16:18:03 -0400 Message-Id: <9509012018.AA23873@big-screw> >From: "Jeffrey I. Schiller" <jis(a)mit.edu> Sender: jis(a)mit.edu To: minutes(a)cnri.reston.va.us Subject: IETF Security Area Report (July 17-21, 1995: 33rd IETF meeting) Cc: secdir(a)TIS.COM, saag(a)TIS.COM Status: R -----BEGIN PGP SIGNED MESSAGE----- IETF Security Area Report Jeff Schiller and Jim Galvin jis(a)mit.edu galvin(a)tis.com July 17-21, 1995 The Security Area within the IETF is responsible for development of security oriented protocols, security review of RFCs, development of candidate policies, and review of operational security on the Internet. The Area Director is assisted by a Directorate, an advisory entity with no standards-setting powers. The members of the Security Directorate are as follows. Jeffrey I. Schiller <jis(a)mit.edu> Ran Atkinson <atkinson(a)itd.nrl.navy.mil> Steve Bellovin <smb(a)research.att.com> Steve Crocker <crocker(a)tis.com> Barbara Fraser <byf(a)cert.org> James M. Galvin <galvin(a)tis.com> Phil Karn <karn(a)qualcomm.com> Steve Kent <kent(a)bbn.com> John Linn <linn(a)ov.com> Clifford Neuman <bcn(a)isi.edu> Rob Shirey <shirey(a)mitre.org> Ted Ts'o <tytso(a)mit.edu> In addition to the Directorate the Security Area is assisted by the Security Area Advisory Group (SAAG). The SAAG is an open group that meets at least once during each IETF meeting as well as electronically via the saag(a)tis.com mailing list. Send a message to the address saag-request(a)tis.com to join the list. During the Security Area Advisory Group (SAAG) meeting, the activities of the Security Area, including the Directorate, are reported and discussed. In addition, the SAAG meeting provides an opportunity for open discussion of security issues. Included below is a summary from those working groups and birds of a feather sessions with security relevant activities to report and the Security Directorate meeting summary. In addition, the following topics were discussed during the SAAG meeting. o Documents Approved as Proposed Standards The IESG approved the advancement of five of the IPSEC documents to proposed standards. With the advancement of these documents the IPSEC working group will focus on issues related to key management. The IESG approved the advancement of the two MOSS documents to proposed standards. With the advancement of these documents the PEM working group has completed its charter and will be closed. o Domain Name System Security The last revision of the enhancements for the DNS to support security has been released. It will enter working group last call very soon; no issues are expected to be raised. At the end of the working group last call the document will be submitted to the IESG to be considered for publication as a Proposed Standard. An implementation of the specification is available to U.S. and Canadian sites and individuals via anonymous FTP (see ftp://ftp.tis.com/pub/DNSSEC/README for details). o Key Management It was noted that the Internet needs two kinds of key management: one for short-term keys and one for long-term keys. The expected usage of short-term keys would be on a per connection or per message basis. Long-term keys, on the other hand, would probably be used to exchanged short-term keys. The distribution and management of long-term keys requires the existence of a global infrastructure. There are two options for the global infrastructure today: Secure DNS or The Directory (X.500). It is also possible that something completely different will be needed and developed. Key management is expected to get increasing attention in the IETF. o Internet Security Architecture Steve Crocker gave an abbreviated version of his presentation to the IAB the previous evening. He posed a challenge to the community to improve the network security at IETF meetings. The specific proposal is to have IPSEC available with manual keying, which would be enough to make a difference when compared to the current configuration. This should be available for use in the IETF terminal room by both the terminals/workstations and laptops. In addition, we should install a demonstration firewall that is IPSEC friendly. The goal is to make it available at the next IETF meeting in Dallas (December 4-8, 1995). The activity of the following working groups and birds of a feather sessions was reported. o Secure Socket Layer (SSL) BOF A consensus developed for the need for a session layer security protocol. This was predicated on observing that IPSEC is below the transport layer and the session layer is above it, and that implementing security in the transport or network layer would require changes to operating systems. In contrast, session layer security could be implemented and added non-invasively to existing systems, thus making security services available to a broad range of application protocols. As a result, a working group called Session Layer Security will be proposed. The Secure Socket Layer specification will serve as the starting point for the new working group. o Internet Secure Payments Protocol (ISPP) BOF This BOF met two times with more than a dozen technology presentations. Fortunately, the various technologies are much more similar than they are different. The consensus was that the IETF should have one or more working groups in this area. Charters will be proposed and submitted to the area director for consideration. o Simple Key Management for IP (SKIP) BOF SKIP is Sun's proposal for key management on the Internet. It is a competitor to the Photouris specification being discussed in IPSEC. It is still undecided as to whether this specification should be discussed as part of the IPSEC working group or within its own working group. Although there appeared to be consensus to move the SKIP specification onto the standards track, the authors will need to discuss the process and relationship to IPSEC with the area director and the Chairs of the IPSEC working group before this can be done. [Note: Since the IETF meeting took place discussions between the various parties are proceeding. The likely outcome will be for the SKIP work to take place within the IPSEC working group.] o Authenticated Firewall Traversal (AFT) There are currently four implementations underway with interoperability testing expected to begin shortly. If the testing is successful three documents will be submitted to the IESG to be considered for publication as Proposed Standards before the next IETF meeting in Dallas. o Common Authentication Technology (CAT) The CAT working group discussed topics related to active documents, including GSS-V2 (to receive another set of specific revisions at the Internet-Draft level, and then to be recommended for advancement to Proposed Standards), IDUP (where revised interface specifications and a new mechanism specification were discussed, with standards advancement to be considered at the Dallas IETF), GSS-API Negotiation (new draft discussed), Kerberos mechanism and extensions (status and comments discussed, new drafts to follow), FTP Security (to be recommended for advancement to Proposed Standard after inclusion of clarifying revisions), and a presentation of a new mechanism based on FIPS PUB JJJ cryptography. Presentations on work in progress included GSS-API integration into World-Wide Web browsers and servers, loadable GSS-API multi-mechanism support, and discussion of the use of RFC-1731 as a generic framework for integration of security tokens into text-based applications. The group also discussed a range of candidate follow-on topic areas related to authorization, and identified a subset with apparent common value and feasibility for proposals and work by group members. o Web Transaction Security (WTS) There were three short presentations on related subjects and a review of the two documents being developed by the working group. With respect to the requirements specification, several new issues were raised at this meeting and most, but not all, were resolved. There was consensus to resolve the remaining issues on the list and then submit the document to the IESG to be considered for publication as an information RFC. Recent changes to the SHTTP document were reviewed and no objections were raised. An outstanding issue is coordinating SHTTP with MOSS, which is dependent on the harder (and outside our scope) problem of coordinating HTTP with MIME. We remain hopeful that we will reach consensus on a document to propose to advance to Proposed Standard by the next IETF meeting Dallas. o IP Security (IPSEC) The interoperability testing of the recently approved Proposed Standards was discussed. The majority of the meeting was devoted to discussing Internet key management and the two working documents on Photouris and ISAKMP. o Site Security Handbook (SSH) Two documents are expected to be available by the first week of November, which will allow for final revisions to be proposed during the next IETF meeting in Dallas followed by advancing the documents onto the standards track as quickly as possible. The Security Area Directorate met on Monday afternoon for a 2 hour meeting. In addition to all of the above, the following was noted. o Intellectual Property Rights (IPR) The purpose of the discussion was information exchange. Several protocols are pending in the IESG as a result of unresolved IPR issues and several protocols from the security area are about to be submitted to the IESG with unresolved IPR issues. It is uncertain exactly what the outcome will be of any specific case. o Key-ed MD5 Key-ed MD5 is being used in a variety of protocols for authentication. The IETF needs an applicability statement which includes advice on how often to change the secrets. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEdqFMUtR20Nv5BtAQELhwP/eTwVc+07AA19P0Q7KdfHxTAaNjnsPBRY 4bb2ekatHDaL5oVH2bbad1DECgOVU2Y0tKBXBNO3Pw1vQiMOV874ZeMIWNtcuxJE MUcd9PLXekRoIUGmUdQMdnVhGEhb4NWPAi6KXzkWRxLN0wZNG9tyjkb7qLCo0dLe +98gDe4dO1c= =2CtY -----END PGP SIGNATURE-----

1 0

Re: O.J. ObCrypto: Fuhrman's Folly Fans Fakery Fears...
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 12:13 9/1/95, Bill Stewart wrote: >>I do not think that PGP 2.x can easily (ie: Automatically) use one key for >>Signing and another for Encrypting a Message (it does both at the same time >>if you ask). If I "Clear Sign" a message and then Encrypt it, then I get >>the result but I'm not sure if doing the decrypt on such a message will >>automatically spot the signature and verify it (as would occur with a E+S >>pass). > >PGP identifies the key for decryption and signature checking from the message. >When you're signing a message or key, you can pick which of your keys to >use with the -u option. OK - I'll rephrase my query/quandary. If I create a message by feeding in plain text and asking for an Encrypt and Sign is the FORMAT of the resulting file different from one there I Sign the Text and then (in a separate step/pass) Encrypt the Signed Message (IOW is E+S just a short cut for the two processes done in sequence using the same key for both operations)? If E+S is only a short-cut then doing the steps separately will give the result that PGP3 will get automatically with its Separate Function Keys Feature. >The difficulty is getting people to use your >encryption key instead of your signature key when encrypting stuff for you. >Derek mentioned one approach (get people to load the encryption key first); >unfortunately, you can't predict their behavior, and if you change encryption >keys more often than signature keys, they'll load the newest encryption key >last. >Another approach is to identify them in the names - my key certification key >says "KeyCert-only" in the text. > >For the problem that started this discussion, though, there's no good solution. >Since the Bad Guys _can_ encrypt a message to you with your signature key, >and send it to you by anonymous remailer, they can plant a reason to suspect >that you may have evidence encrypted with that key. This will all become (more) academic once PGP3 comes out and Sign-Only keys would not be usable for Encryption.

1 0

Hello
by MEGA Communications 17 Dec '03

17 Dec '03

Hello! Personal Note From Sender: You've probably received this opportunity by email several times by different people in the past twelve months. Do you know why? Because people everywhere are finding that it REALLY WORKS! Try it! I'm not kidding! **** FREE $400 Bulk e-mail Software **** **** FREE $200 Check by fax, email, phone Software **** **** FREE Business **** Receive Your Bulk e-mail and Checking Software the same day you receive Report #1 I will not ask you for any MONEY for the Software. Your Business is about to EXPLODE You Don't want toTrash This one !!!!! Read This Twice !!!!! <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> You are about to make at least $50,000 - In less than 90 days Read the enclosed program...THEN READ IT AGAIN!... <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> Please accept my apology if this was sent to you in error! Dear friend, The following income opportunity is one you may be interested in taking a look at. It can be started with VERY MINIMAL outlay and the income return is TREMENDOUS! The enclosed information is something I almost let slip through my fingers. Fortunately, sometime later I re-read everything and gave some thought and study to it. My name is Christopher Erickson. Two years ago, the corporation I worked at for the past twelve years down-sized and my position was eliminated. After unproductive job interviews, I decided to open my own business. Over the past year, I incurred many unforeseen financial problems. I owed my family, friends, and creditors over $35,000. The economy was taking a toll on my business and I just couldn't seem to make ends meet. I had to refinance and borrow against my home to support my family and struggling business. I truly believe it was wrong for me to be in debt like this. AT THAT MOMENT something significant happened in my life and I am writing to share my experience in hopes that this will change your life FOREVER....FINANCIALLY!!! In mid-December, I received this program via email. Six months prior to receiving this program I had been sending away for information on various business opportunities. All of the programs I received, in my opinion, were not cost effective. They were either too difficult for me to comprehend or the initial investment was too much for me to risk to see if they worked or not. One claimed I'd make a million dollars in one year...it didn't tell me I'd have to write a book to make it. But like I was saying, in December of '95 I received this program. I didn't send for it, or ask for it, they just got my name off a mailing list. THANK GOODNESS FOR THAT!!! After reading it several times, to make sure I was reading it correctly, I couldn't believe my eyes. Here was a MONEY-MAKING PHENOMENON. I could invest as much as I wanted to start, without putting me further in debt. After I got a pencil and paper and figured it out, I would at least get my money back. After determining that the program is LEGAL and NOT A CHAIN LETTER, I decided "WHY NOT". Initially I sent out 10,000 emails. It only cost me about $15.00 for my time on-line. The great thing about email is that I didn't need any money for printing to send out the program, only the cost to fulfill my orders. I am telling you like it is, I hope it doesn't turn you off, but I promised myself that I would not "rip-off" anyone, no matter how much money it cost me! In less than one week, I was starting to receive orders for REPORT #1. By January 13th, I had received 26 orders for REPORT #1. When you read the GUARANTEE in the program, you will see that "YOU MUST RECEIVE 15 TO 20 ORDERS FOR REPORT #1 WITHIN TWO WEEKS. IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL YOU DO!" My first step in making $50,000 in 20 to 90 days was done. By January 30th, I had received 196 orders for REPORT #2. If you go back to the GUARANTEE, "YOU MUST RECEIVE 100 OR MORE ORDERS FOR REPORT #2 WITHIN TWO WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX, YOU WILL MAKE YOUR $50,000 GOAL." Well, I had 196 orders for REPORT #2, 96 more than I needed. So I sat back and relaxed. By March 19th, of my emailing of 10,000, I received $58,000 with more coming in every day. I paid off ALL my debts and bought a much needed new car. Please take time to read the attached program, IT WILL CHANGE YOUR LIFE FOREVER! Remember, it wont work if you don't try it. This program does work, but you must follow it EXACTLY! Especially the rules of not trying to place your name in a different place. It doesn't work, you'll lose out on a lot of money! REPORT #2 explains this. Always follow the guarantee, 15 to 20 orders for REPORT #1, and 100 or more orders for REPORT #2 and you will make $50,000 or more in 20 to 90 days. I AM LIVING PROOF THAT IT WORKS !!! If you are a fellow business owner and you are in financial trouble like I was, or you want to start your own business, consider this a sign. I DID! Sincerely, Christopher Erickson PS Do you have any idea what 11,700 $5 bills ($58,000) look like piled up on a kitchen table? IT'S AWESOME! "RETIRED CHIEF OF POLICE" "As a retired Chief Of Police, I would not get involved in anything that was not completely legitimate. I have made thousands, thanks to this wonderful program." Ken Kennedy, CA "THREW IT AWAY" "I had received this program before. I threw it away, but later wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get a copy, so I had to wait until I was emailed another copy of the program. Eleven months passed, then it came. I DIDN'T throw this one away. I made $41,000 on the first try." Dawn W., Evansville, IN "NO FREE LUNCH" "My late father always told me, 'remember, Alan, there is no free lunch in life. You get out of life what you put into it.' Through trial and error and a somewhat slow frustrating start, I finally figured it out. The program works very well, I just had to find the right target group of people to email it to. So far this year, I have made over $63,000 using this program. I know my dad would have been very proud of me." Alan B., Philadelphia, PA A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM By the time you have read the enclosed information and looked over the enclosed program and reports, you should have concluded that such a program, and one that is legal, could not have been created by an amateur. Let me tell you a little about myself. I had a profitable business for ten years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate...because many of you know from first hand experience. There were more failures and bankruptcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received information that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to email a copy of this exciting program to everyone that you can think of. One of the people you send this to may send out 50,000...and your name will be on every one of them!. Remember though, the more you send out, the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent, IT IS UP TO YOU NOW! HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU $$$$$$ Let's say that you decide to start small, just to see how it goes, and we'll assume you and all those involved send out 2,000 programs each. Let's also assume that the mailing receives a .5% response. Using a good list the response could be much better. Also many people will send out hundreds of thousands of programs instead of 2,000. But continuing with this example, you send out only 2,000 programs. With a 5% response, that is only 10 orders for REPORT #1. Those 10 people respond by sending out 2,000 programs each for a total of 20,000. Out of those .5%, 100 people respond and order REPORT #2. Those 100 mail out 2,000 programs each for a total of 200,000. The .5% response to that is 1,000 orders for REPORT #3. Those 1,000 send out 2,000 programs each for a 2,000,000 total. The .5% response to that is 10,000 orders for REPORT #4. That's 10,000 five dollar bills for you. CASH!!!! Your total income in this example is $50 + $500 + $5000 + $50,000 for a total of $55,550!!!! REMEMBER FRIEND, THIS IS ASSUMING 1,990 OUT OF 2,000 PEOPLE YOU MAIL TO WILL DO ABSOLUTELY NOTHING... AND TRASH THIS PROGRAM! DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF ONLY 2,000. Believe me, many people will do that and more! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and email is FREE!!! REPORT#3 will show you the best methods for bulk emailing and purchasing email lists. THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY. It does not require you to come in contact with people, do any hard work, and best of all, you never have to leave the house except to get the mail. If you believe that someday you'll get that big break that you've been waiting for, THIS IS IT! Simply follow the instructions, and your dream will come true. This multi-level email order marketing program works perfectly...100% EVERY TIME. Email is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!! The longer you wait, the more people will be doing business using email. Get your piece of this action!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and The Wall Street Journal have stated that between 50% and 65% of all goods and services will be sold throughout Multi-level Methods by the mid to late 1990's. This is a Multi-Billion Dollar industry and of the 500,000 millionaires in the US, 20% (100,000) made their fortune in the last several years in MLM. Moreover, statistics show 45 people become millionaires everyday through Multi-Level Marketing. INSTRUCTIONS: We at FIKA International Limited, have a method of raising capital that REALLY WORKS 100% EVERY TIME. I am sure that you could use $50,000 to $125,000 in the next 20 to 90 days. Before you say "Bull", please read the program carefully. This is the GREATEST Multi-level Mail Order Marketing anywhere: Step (1) Order all four 4 REPORTS listed by NAME AND NUMBER. Do this by ordering the REPORT from each of the four 4 names listed on the next page. For each REPORT, send $5 CASH and a SELF- ADDRESSED, STAMPED envelope (BUSINESS SIZE #10) to the person listed for the SPECIFIC REPORT. International orders should also include $1 extra for postage. It is essential that you specify the NAME and NUMBER of the report requested to the person you are ordering from. You will need ALL FOUR 4 REPORTS because you will be REPRINTING and RESELLING them. DO NOT alter the names or sequence other than what the instructions say. IMPORTANT: Always provide same-day service on all orders. Step (2) Replace the name and address under REPORT #1 with yours, moving the one that was there down to REPORT #2. Drop the name and address under REPORT #2 to REPORT #3, moving the one that was there to REPORT #4. The name and address that was under REPORT #4 is dropped from the list and this party is no doubt on the way to the bank. When doing this, make certain you type the names and addresses ACCURATELY! DO NOT MIX UP MOVING PRODUCT/REPORT POSITIONS!!! Step (3) Having made the required changes in the NAME list, save it as a text (.txt) file in it's own directory to be used with whatever email program you like. Again, REPORT #3 will tell you the best methods of bulk emailing and acquiring email lists. Step (4) Email a copy of the entire program (all of this is very important) to everyone whose address you can get your hands on. Start with friends and relatives since you can encourage them to take advantage of this fabulous money-making opportunity. That's what I did. And they love me now, more than ever. Then, email to anyone and everyone! Use your imagination! You can get email addresses from companies on the internet who specialize in email mailing lists. These are very cheap, 100,000 addresses for around $35.00. IMPORTANT: You won't get a good response if you use an old list, so always request a FRESH, NEW list. You will find out where to purchase these lists when you order the four 4 REPORTS. REQUIRED REPORTS ***Order each REPORT by NUMBER and NAME*** ALWAYS SEND A SELF-ADDRESSED, STAMPED ENVELOPE AND $5 CASH FOR EACH ORDER REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER Please, no checks, cash only ! ________________________________________________________ REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTI-LEVEL SALES" ******FREE $400 bulk email program****** ******FREE check by fax, email & phone program****** ******FREE BUSINESS****** ORDER REPORT #1 FROM: MEGA Communications 10078 A Arrow Route Suite 173 Rancho Cucamonga, CA 91730 ________________________________________________________ REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ORDER REPORT #2 FROM: FIKA International Limited P.O. Box 39095 Washinton, D.C. 20016-9098 ________________________________________________________ REPORT#3 "SOURCES FOR THE BEST MAILING LISTS" ORDER REPORT #3 FROM: Global Innovations P.O. Box 3191 Salem, Oregon 97302 ________________________________________________________ REPORT #4 "EVALUATING MULTI-LEVEL SALES PLANS" ORDER REPORT #4 FROM: One Big Family 560 E. Rowland St. Suite J-1 Covina, CA 91723 ______________________________________________________ CONCLUSION .I am enjoying my fortune that I made by sending out this program. You too, will be making money in 20 to 90 days, if you follow the SIMPLE STEPS outlined in this mailing. Very few people reach financial independence, because when opportunity knocks, they choose to ignore it. It is much easier to say "NO" than "YES", and this is the question that you must answer. Will YOU ignore this amazing opportunity or will you take advantage of it? If you do nothing, you have indeed missed something and nothing will change. Please re-read this material, this is a special opportunity. If you have any questions, please feel free to write to the sender of this information. You will get a prompt and informative reply. My method is simple. I sell thousands of people a product for $5 that costs me pennies to produce and email. I should also point out that this program is legal and everyone who participates WILL make money. This is not a chain letter or pyramid scam. At times you have probably received chain letters, asking you to send money, on faith, but getting NOTHING in return, NO product what-so-ever! Not only are chain letters illegal, but the risk of someone breaking the chain makes them quite unattractive. You are offering a legitimate product to your people. After they purchase the product from you, they reproduce more and resell them. It's simple free enterprise. As you learned from the enclosed material, the PRODUCT is a series of four 4 FINANCIAL AND BUSINESS REPORTS. The information contained in these REPORTS will not only help you in making your participation in this program more rewarding, but will be useful to you in any other business decisions you make in the years ahead. You are also buying the rights to reprint all of the REPORTS, which will be ordered from you by those to whom you mail this program. The concise one and two page REPORTS you will be buying can easily be reproduced at a local copy center for a cost off about 3 cents a copy. Best wishes with the program and Good Luck! TIPS FOR SUCCESS Send for your four 4 REPORTS immediately so you will have them when the orders start coming in. When you receive a $5 order, you MUST send out the product/service to comply with US Postal and Lottery laws. Title 18 Sections 1302 and 1341 specifically state that: "A PRODUCT OR SERVICE MUST BE EXCHANGED FOR MONEY RECEIVED." WHILE YOU WAIT FOR THE REPORTS TO ARRIVE: 1. Name your new company. You can use your own name if you desire. 2. Get a post office box (preferred). 3. Edit the names and addresses on the program. You must remember, your name and address go next to REPORT #1 and the others all move down one, with the fourth one being bumped OFF the list. 4. Obtain as many email addresses as possible to send until you receive the information on mailing list companies in REPORT #3. 5. Decide on the number of programs you intend to send out. The more you send, and the quicker you send them, the more money you will make. 6. After mailing the programs, get ready to fill the orders. 7. Copy the four 4 REPORTS so you are able to send them out as soon as you receive an order. IMPORTANT: ALWAYS PROVIDE SAME-DAY SERVICE ON ORDERS YOU RECEIVE! YOUR GUARANTEE The check point which GUARANTEES your success is simply this: you must receive 15 to 20 orders for REPORT #1. This is a must!!! If you don't within two weeks, email out more programs until you do. Then a couple of weeks later you should receive at least 100 orders for REPORT #2, if you don't, send out more programs until you do. Once you have received 100 or more orders for REPORT #2, (take a deep breath) you can sit back and relax, because YOU ARE GOING TO MAKE AT LEAST $50,000. Mathematically it is a proven guarantee. Of those who have participated in the program and reached the above GUARANTEES-ALL have reached their $50,000 goal. Also, remember, every time your name is moved down the list you are in front of a different REPORT, so you can keep track of your program by knowing what people are ordering from you. IT'S THAT EASY, REALLY, IT IS!!! "I seem to have been only like a boy playing on the seashore, and diverting myself in now and then finding a smoother pebble or a prettier shell than ordinary, whilst the great ocean of truth lay all undiscovered before me." - Sir Isaac Newton

1 0

Re: SSL search attack
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 12:15 9/1/95, Lou Poppler wrote: >The ACK process and the allocation process are separate, and should >remain so. They run on different servers, and they run as separate >processes in the unix version of brloop. A little tweaking of brloop >could allow pre-fetching of the next segment to search, without any >effect on the ACK process. I dislike the idea of a client sending an ACK >before it has searched the entire segment. I was not suggesting that. I was just suggesting that the initial request be for twice the amount of segments as you want to process during your reporting interval and that except when you are getting ready to shut down, you have one allocation ready as a spare in case you can't immediately be given another allocation when you ACK one. Example: I will be running for 8 Hours and I will report back every 30 minutes. I get an Hours worth of segments (Chunk 1 +2) when I first connect. After 30 Minutes, I'm done with half of them. I then ACK that half (Chunk1) and request another 30 minutes worth of segments (for scanning at 1H-1.5H). If I do not get it, I'm still working on the 2nd Chunk. At 1H, I ACK Chunk2 and ask for Chunk4 (also I ACK Chunk 1 and/or request Chunk 3 if either failed the first time at .5H). This continues until 7.5 when I ACK and do not request a Chunk 17 (since I already have or I am requesting Chunk 16 for the 7.5H-8H period).

1 0

Re: SSL search attack
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 07:25 9/1/95, Daniel R. Oelke wrote: >> >> I see nothing wrong with the concept of being allocated an initial chunk >> and having the scan software attempt to ACK it when 50% of it has been >> searched. A successful ACK would allow the releasing of a new chunk (in >> response) equal in size to the returned chunk. A failure of the Server to >> accept the ACK would trigger a retry at set intervals (such as 75% and 100% >> or 60/70/80/90/100%) until the Server responds. Thus the scanner is always >> in possession of a Full Sized Chuck to scan (so long as the Server accepts >> an ACK before the 100% done mark) and temporary failures will not stop the >> process of a scanner as currently happens. >> > >The only way this can work is if the server is told it is a 50%/75%/etc >size ACK, and then latter the server is ACKed for the full 100%. > >Why? Because what happens if the client dies immediately after doing >the ACK - maybe only 51% of that space has been searched, yet >the server has already seen an ACK for it. I thought that the ACK gives starting location and number of segments. If I get 500 segments and ACK at the 50% point I am sending an ACK for the Starting Point and 250 Segments (the unprocessed part would then ACK Start+250 for 250 when done) Just as of I had only gotten 250 in the first place and was also given the next 250 Segment Chunk (ie: I was "Next Requester" after my original allocation of 250). >IMO - a % ACK is to much complexity and extra work on the server, >which is already having trouble keeping up. No - It is the same load if you allow the first request to be twice the size of the subsequent requests. If you ask people to request 30 minutes worth of segments, there is no difference in load (if the Server responds to each ACK when first attempted) if they start each run with a 1 hour chunk (ie: 2X Chunk) and check in every 30 min to ACK a Chunk (and to get the one to be worked on in a half an hour [and when you are 30 minutes away from your shut down time, just ACK and do not request another chunk]) and just getting a X sized chunk at your initial connection. In the 2X method, you still have a X sized Chunk to work on for the next 30 Minutes if the Server is ignoring your ACK attempt (and when that Chunk has been scanned you return both and get two more). This is hitting the Server once every 30 minutes and NOT pounding away at it until you get an ACK through (and more get more work) since you have no need for another chunk immediately (as you would with the X sized Chunk every 30 minutes method) and thus have no need to retry on a connect failure.

1 0

Crypto-anarchy and Haydn
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 19 Aug 1997 17:06:07 -0400 (EDT) From: Peter F Cassidy <pcassidy(a)world.std.com> To: dcsb(a)ai.mit.edu Subject: Crypto-anarchy and Haydn Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Peter F Cassidy <pcassidy(a)world.std.com> DCSBers, I'd like to invite you to the Longwood Symphony Orchestra's summer concert at the Hatch Shell in Boston on Wed. Aug. 20, 1997 at 7:30. It's free. The LSO is presenting Mendelsohn's Capricio Briliante Opus 22, the Haydn Cello concerto and the Haydn Symphony 104, the last movement of which contains a coded message. Played backwards at twice the normal turntable speed, you can clearly hear the composer shout, "Burn the mint" in the finale, about 64 bars from the end. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Cyphernomicon, and a section on Escrow and Reputations
by tcmay＠got.net 17 Dec '03

17 Dec '03

I've been asked by two people in e-mail what the "Cyphernomicon" I referred to in a recent message is. It's been a while since I mentioned it, so I'll give some details. In late 1993 I foolishly committed to doing a "Cypherpunks FAQ," as several earlier attempts had gone nowhere. And since the most frequently asked question of all is always "Where's the FAQ?," followed closely by "How come there isn't a FAQ?," the need was there. (As it turns out, the people most in need of a FAQ seldom read FAQs, but this is another story.) I finished my first release, a megabyte-sized file done in MORE, a powerful outline processor (which enabled me to maintain notes, make cross-references, and generally manage such a huge writing project). I released it last year, and put it in my anonymous ftp account at ftp.netcom.com, in the directory /pub/tc/tcmay, as the file CP-FAQ. Netcom is often very crowded, though. I know of a couple of alternative places. A very nice job of HTMLizing it was done by Jonathan Rochkind, a Cypherpunk, and is located at the URL http://www.oberlin.edu/~brchkind/cyphernomicon/ Another URL, which is just one large file, is http://www.swiss.ai.mit.edu/6095/articles/cyphernomicon/CP-FAQ The recent thread about the dangers of anonymity and the role of escrow agents as possible fixes is a good excuse to include one of my sub-sub-subsections, to also illustrate the structure and expected contents. Enjoy it. But, please, don't nag me with suggestions that I should do, or should have done, the thing in HTML, or using your favorite tool set. --Tim May Crypto Anarchy: Escrow Agents and Reputations 16.24.1. Escrow Agents as a way to deal with contract renegging - On-line clearing has the possible danger implicit in all trades that Alice will hand over the money, Bob will verify that it has cleared into hisaccount (in older terms, Bob would await word that his Swiss bank account has just been credited), and then Bob will fail to complete his end of the bargain. If the transaction is truly anonymous, over computer lines, then of course Bob just hangs up his modem and the connection is broken. This situation is as old as time, and has always involved protcols in which trust, repeat business, etc., are factors. Or escrow agents. - Long before the "key escrow" of Clipper, true escrow was planned. Escrow as in escrow agents. Or bonding agents. - Alice and Bob want to conduct a transaction. Neither trusts the other; indeed, they are unknown to each other. In steps "Esther's Escrow Service." She is _also utraceable_, but has established a digitally-signed presence and a good reputation for fairness. Her business is in being an escrow agent, like a bonding agency, not in "burning" either party. (The math of this is interesting: as long as the profits to be gained from any small set of transactions is less than her "reputation capital," it is in her interest to forego the profits from burning and be honest. It is also possible to arrange that Esther cannot profit from burning either Alice or Bob or both of them, e.g., by suitably encrypting the escrowed stuff.) - Alice can put her part of the transaction into escrow with Esther, Bob can do the same, and then Esther can release the items to the parties when conditions are met, when both parties agree, when adjudication of some sort occurs, etc. (There a dozen issues here, of course, about how disputes are settled, about how parties satisfy themselves that Esther has the items she says she has, etc.) 16.24.2. Use of escrow services as a substute for government + as in underworld deals, international deals, etc. - "Machinery of Freedom" (Friedman), "The Enterprise of Law" (Benson) - "It is important to note in any case that the use of third- party escrow as a substitute for Government regulation was a feature of the Northern European semi-anarchies of Iceland and Ireland that have informed modern libertarian thought." [Duncan Frissell, 1994-08-30] 16.24.3. Several people have raised the issue of someone in an anonymous transaction simply taking the money and not performing the service (or the flip side). This is where _intermediaries_ come into the picture, just as in the real worl (bonds, escrow agents, etc.). 16.24.4. Alice and Bob wish to conduct an anonymous transaction; each is unknown to the other (no physical knowledge, no pseudonym reputation knowledge). These "mutually suspicious agents," in 1960s- and 70s-era computer science lingo, must arrange methods to conduct business while not trusting the other. 16.24.5. Various cryptographic protocols have been developed for such things as "bit commitment" (useful in playing poker over the phone, for example). I don't know of progress made at the granularity of anonymous transactions, though. (Though the cryptographic protocol building blocks at lower levels--such as bit commitment and blobs--will presumably be used eventually at higher levels, in markets.) 16.24.6. I believe there is evidence we can shorten the cycle by borrowing noncryptographic protocols (heresy to purists!) and adapting them. Reputations, for example. And escrow agents (a form of reputation, in that the "value" of a bonding entity or escrow agent lies in reputation capital). 16.24.7. if a single escrow agent is suspected of being untrustworthy (in a reputation capital sense), then can use _multiple_ escrows - with various protocols, caveat emptor - n-out-of-m voting schemes, where n escrow agents out of m are required to complete a transaction - hard to compromise them all, especially if they have no idea whether they are being "legitimately bribed" or merely pinged by a reputation-rating service - Hunch: the work of Chaum, Bos, and the Pfaltzmanns on DC- nets may be direcly applicable here...issues of collusion, sets of colluders, detection of collusion, etc. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: SSL attack
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: "Robert A. Rosenberg" <hal9001(a)panix.com> >I thought that the ACK gives starting location and number of segments. If I >get 500 segments and ACK at the 50% point I am sending an ACK for the >Starting Point and 250 Segments (the unprocessed part would then ACK With multiple heirchical servers, you don't have the same bottleneck problems. If you have a random mode that you can switch into, same deal (if you care to use it). There are a lot of people who want the anonymity and server-independance of random mode. There are people who don't want to add another 37% onto the processing time, given the unlikeliness of a D.O.S. attack on the server. I continue to support the idea of a two-pronged attack using both methods. Given that most of the server bottleneck was un-updated clients anyway, I think that the bottleneck-on-the-server problem is solved anyway, meaning there won't be any problems getting new keys - thus eliminating the need for a keyspace buffer queue. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMEfVssLa+QKZS485AQEV9QMAoue7RyySe1H0a7s6hBkjf7knaXesLY1h ZQg9rBZ9ZieJ5qWyBHL03Gn4XikSD8U6/MBbiyMvOnz+QTYRQcMxQioEu4YDcFdD etaful6wYhtXzd/MTn+VWjBf86poDeNK =Mp2o -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Re: Status of Cypherpunks list sites?
by Antonomasia 17 Dec '03

17 Dec '03

TCMay wrote: > Not too long ago I was subscribed to the "cypherpunks(a)algebra.com" address, > and the list stopped flowing to me for a day or so. I resubbed under > "cypherpunks(a)cyberpass.net." I noticed that Igor Chudov said he was taking > a hiatus from the Net and lists, so I wondered if this meant his support > for his site was either being dropped or might be subject to more frequent > outages. I re-subscribed to the algebra list when I returned from HIP97 and in fact got onto the ssz list. Seems like Igor diverted the subscription. Comments, Igor ? > And shouldn't we all be making a more serious effort to drop the use of the > "cypherpunks(a)toad.com" address, as John said some months back that he would > support forwarding stuff for a while, but not necessarily forever. As it > is, it just adds another hop and another potential weak link. Yes. -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # #### !!! PGP 5.0 beta available now at ftp.replay.com !!! ####

2 1

FSTC - Request for Info
by todd＠lgt.com 17 Dec '03

17 Dec '03

Hi all, I am now looking for pointers into this mystical coonsortium of financial wizards... Also do any of you know about online issues pertaining to new network adaptations of Unisys's proprietary banking protocols or the FEDLINE stuff? TIA Todd Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com

1 0

Re: FSTC - Request for Info
by John Curran 17 Dec '03

17 Dec '03

At 1:05 AM 9/2/95, Todd Glassey, Chief Technologist, Looking Glass Technologies wrote: >Hi all, > I am now looking for pointers into this mystical coonsortium of financial >wizards... A good place to start is the FSTC WWW pages: http://www.llnl.gov/fstc /John

1 0

Re: Status of Cypherpunks list sites?
by John Young 17 Dec '03

17 Dec '03

Okay, mace me, I'm still posting to toad, and receiving from it, along with dupes from cyberpass, and TAing the latency. Toad's stuff comes right through, fast, while it's +/- all over the chart from cyberpass -- up to eight hours delay at times, even a day later, with answers to vital controversies coming before the issue is shown to be misunderstood squat. Excuse cyberpass dis for disarray, but toad's speed is handy when you've nothing to say and want to instantly scream it very clearly to yourself and the empty void rather than face the horror of fixing insyntax. And, praise elvis, not all vaporings that come from toad makes it past molassel cyberpass, although most eventually oozes in. Null stench especially pops up from world-sucking toad, the kind that makes one's own East Coast voidance smell not so bad. Until the West Coast wakes up and sez jesus cork that, we're fetal lunged here. Still, if Tim's right to call for toad discon, its reliable speedy drip drip drip of 24-hour addictive invective will be sorely missed when it presents a last time middle web and hops off into the swamp leaving only one's own dig-itch digit to sniff and howl how awful.

2 1

Encrypted talk
by Jason Burrell 17 Dec '03

17 Dec '03

Does there happen to be a talk program out there that will allow more than two people to talk at once, and allow them to speak securely with strong cryptography, and will actually compile under Linux? Thanks.

3 2