December 2003 - cypherpunks-legacy

Re: none
by Arunas Norvaisa 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 12:09 AM 97.09.14 -0700, SL Baur wrote (and I quoted): > >bureau42 Anonymous Remailer <remailer(a)bureau42.ml.org> writes: > >> Since Sept. 11th: > >> http://www.ifi.uio.no/pgp/ > >> Forbidden > >> Your client is not allowed to access the requested object. > >Something is seriously wrong with the ifi.uio.no server. You can't get >much of anything off of it. I doubt the general outage is pgp related, >this isn't the first time there have been problems with it. > > Try this one instead...... http://zone.pspt.fi/pgp/ - -- greetz... Arunas Norvaisa - little guy, The Masses Inc. check the message headers for PGP key information _OR_ send mail with subject 'send key' to mailto:arunas@post1.com PGP for idiots page <http://www1.omnitel.net/an> and a US mirror site <http://www.post1.com/~arunas> IBM: I'm Beyond Mistakes -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Watch out for the Big Brother iQEPAwUBNBz6uSOu3BjJDX4hAQExswfQvEPFzM9qS7XYNev427X7qtVTA5T4WU0H OYeGOCgX3E34IqOboBU0gnl7ngB09f760W/BPvxb8e1ijMniaukTUPjTMi1aTSa4 EyWpWsGx5rWUrpvQnotb9MhqTkO5Crci+FxNffjj9FA2ZMYaksOOkrN2HN3wv7hm mRxSxLY4PKf2pYzPlKTAYbNkicqtzwhicEjMoKerUDGy8CIOkgslUHGEFT4JK5f9 7oM3/Y8Z1ZTDT0jL80ECeHe4jA6YKVKYtuVMxbdfNnKWYSK9UXmTWRSYKywBakSL JZIBoUM64INh19UsEGolNzPUOAB5GWqO/bB5WbIXHCoong== =83mA -----END PGP SIGNATURE-----

1 0

Ignore
by Anonymous 17 Dec '03

17 Dec '03

Gag test. Ignore.

1 0

Report on Privacy Loss
by John Young 17 Dec '03

17 Dec '03

NYT has a front page special report today on the booming computer investigative industry which is using legal and illegal means to mine and peddle personal, corporate and political data, dirt and damaging secrets. As one nabbed dick says, it's no longer ex-intel and ex-feebs who are doing it, now the techies and beagles of all sorts have rubbed their eyes at the amazing golddust on their screens. It might boost the demand for crypto and other essential tools for privacy, or it may just lead to more cyber-TLAs and -bounties willfully busting the wrong Jim Bells while warning their still-connected buddies of "court-okayed" wiretaps and traps. http://www.nytimes.com

1 0

Access to Plaintext: An Obvious Consequence
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Somebody Date: Tue, 16 Sep 1997 10:12:47 -0400 (EDT) To: rah(a)shipwright.com Subject: Access to Plaintext: An Obvious Consequence Bob, If no encryption product can be sold that can't decrypt everything it encrypts, then no public key systems can come to market. That would effectively eliminate the entire range of encryption products of interest to you. Surely, this is clear? <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

What version of PGP?
by bret＠bjohns.win.net 17 Dec '03

17 Dec '03

I got PGP 262 off MIT. The file was PGP262si.tar Is this the international version with week crypto? os is it the US version? Thanks....

2 1

Re: Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

>Unfortunately, strdup is not posix compliant. If you want to use >it and maintain portability, you'll have to write your own. Er, you're kidding, right? drand48 isn't in Posix either, for example. Someone who runs on Motif and Mac has strdup as the least of their worries. But just in case it's stopping anyone: char *strdup(const char *x) { char *p; return (p = malloc(strlen(x) + 1)) ? strcpy(p, x) : 0; } (Deliberately written too-cleverly. Lame compilers will need to cast to 0)

1 0

John Deutsch
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is coming to Yale tomorrow and I'm going to get the opportunity to have tea with him(and about 10 other folks). Is there anyone here that has anything that they want me to ask the man? Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGYm+r5ALmeTVXAJAQFeIQL9FmuCB93W4XANBdyQBOg224WW/sVetRI8 AZhM3HHjvNJ41YT7LCnRjLeRU1nUeBX1cI5MWBLNmKQXqR8+XmqboVU/k3jOxndy bNhH4rqb/zgH1cD65lo7IbTsVOJoHeDe =18Lm -----END PGP SIGNATURE-----

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by David Van Wie 17 Dec '03

17 Dec '03

Perry E. Metzger at Sep 22, 95 01:19:37 am wrote: >David Van Wie writes: >> It just moves the prior art date from the date of invention to the date >> of filing the patent application. >What happens if the chronology goes like this ? > >(0) Alice invents a snaffleblort. >(1) Bob invents a snaffleblort. >(2) Bob files for a patent on a snaffleblort. > >From what you said, it would appear that Alice's prior art won't count when >it comes to considering the validity of Bob's patent claim. Is that correct ? Unless Alice made public statements about her invention, you are right. Something becomes prior art when it is made public. If she (like most patent lawyers will advise) kept her mouth shut about what she had invented until her patent application was filed, she would lose under first to file rules (assuming step three is that Alice files a patent application). A quick trip to the soapbox: First to files rules are good for big companies, and bad for small inventors. Big companies have many lawyers, and know exactly how each step of the process works. Small inventors usually don't know the process as well, usually have to scrape together the thousands of dollars necessary to pursue a patent, and then find a good lawyer that they can trust -- all while ensuring that they don't break one of the rules about how you must treat your invention before filing. Moral: First to invent rules, like "natural copyright," are good for the little guy because they base patent decisions on when the important things (i.e. invention and reduction to practice) happened, not administrative things (i.e. complex documents filed with dotted i's and crossed t's).

3 2

Re: John Deutsch
by Rich Salz 17 Dec '03

17 Dec '03

>Is there anyone here that has anything that they want me to ask the man? Why did he argue against MIT getting rid of Lincoln Labs?

1 0

real randomness for netscape - user clicking mouse
by Vincent Cate 17 Dec '03

17 Dec '03

Jeff Weinstein <jsw(a)neon.netscape.com> >If anyone has specific suggestions I would love to hear them so that we >can do a better job. Why not just do something similar to what PGP does? For netscape you could have a user make circling motions with the mouse and clicking at random times. For each click of the mouse you could get a few bits of randomness from the time, the X position, and the Y position. You could get random bits really fast this way. You only need to do this the first time a user uses encryption, or you might just go ahead and force all users to do this as part of starting up netscape the first time. On subsequent times you use your encryption algorithm to make your next seed. To be safe you could make up two seeds, encrypt each of them to mix them up a bit, and then XOR the results together. A random bit XORed with a non-random bit still produces a random bit. Actually there is probably a better way to just encrypt each input whole (padding to block size) and XORing as you go along - that way you would get whatever randomness was there to be had. Anyway, do something so you have as many or more bits of randomness in your seed as there are bits in your key or it will still be a weak link in your security chain. You could even get the randomness during regular mouse use. Unless the first thing a user did was try to use encryption I am sure you would have enough by the time he did use encryption (keep track). You must get the random bits from something that nobody else could watch. Network packets, process IDs, date, time, etc are not secure. On the other hand, an attacker would have to have broken the machine to get the mouse info used above, in which case netscape would have no security no matter what. -- Vince PS I want a free netscape server site license if you use this idea! :-)

5 5

Net KiddiePorn Hype on TV
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Yet Another Alarmist TV Show About Child Molesters on the Net: During their coverage of an NFL game on Sunday, the Fox announcers plugged an upcoming episode (sometime this week) of _New York Undercover_. They used a depressing line like "Think the Net is a safe place to play ? Think again !" Apparently the show will portray a child molester luring kids via the Net, etc., etc. "In a story pulled straight from today's headlines !" Anyway, the mainstream media trashing of the Net continues. Check your local listings. -Futplex <futplex(a)pseudonym.com>

1 0

Re: macworld crypto articles
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

In article <4444rl$nrh(a)life.ai.mit.edu> Chen writes: > It's truly a deplorable state of affairs. For the next version, include PGP free with every version of Quicken, and have Quicken just "call" PGP. Of course, users can encrypt their files now with PGP. Is there an Intuit bboard where someone could post instructions? -- --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

3 2

Colin Powell coming to Dallas
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Colin Powell will be in Dallas at the Taylor's Bookstore out on Belt Line Rd. and Prestonwood (right next to Prestonwood Mall). October 3 at 6 PM. I plan to be there - anyone else from the DFW area going? Anyone have any questions they want asked (other than the usual "where do you stand on the administration's position regarding the use and exportation of so-called 'strong crypto' and the Clipper/Capstone fiasco"? - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi Q. What's the trouble with writing an MS-DOS program to emulate Clinton? A. Figuring out what to do with the other 639K of memory. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGY6vSS9AwzY9LDxAQGLeQP/R9wlGd5wRImcP/37nX9oxAA8+ob2+QHX uCSgdVQOBEYWCEcUXXioa4YgOJx/aptrQBUI23IudEJMMbXTVnQeZx8DPFbzLERI cva9aHTVcQwp/tqOa8NSjvm5UtOC9YtSlyyfFDaH4Amai2dYUPFFZXhhLp6O6jLt PZ56cNfMRYk= =iIKo -----END PGP SIGNATURE-----

1 0

"Free" Gift!
by Mzxyteq＠ibm.net 17 Dec '03

17 Dec '03

This is a one time mailing. You will receive no further E-mail. $$$$ NEED MONEY RIGHT NOW ? $$$$ "THE MONITORED CLUB" (Started September 1, 1997) THIS IS NOT MLM! JOIN TODAY AND RECEIVE A "FREE" GIFT!!! Your "FREE" bonus gift will consist of 500 reports showing you how to start your own shoe-string business. Everything from Basket Weaving, Day Care Centers, and Oil Changes to Franchising and much more. These reports alone are valued at $700.00. Yours free!!! Just for joining our club. Your "FREE" report will be e-mailed, via the monitor. THIS IS THE FAST ONE WHILE YOU'RE WAITING FOR THE OTHERS TO WORK...Guaranteed -You will have $5,000 in four weeks. IT'S TOTALLY MONITORED TO SAFEGAURD AGAINST DISHONEST PEOPLE, AND COMPLETELY LEGAL. This program is 100% legal because your investment will buy you three (3) valuable reports, that are guaranteed to put $5,000.00 in your bank account in 30 days! This program really works! YOU CAN'T LOSE! If you want to make a few thousand dollars really quickly, then please take a moment to read and understand this powerful program we're about to share with you. THIS IS THE FASTEST, EASIEST, MOST LUCRATIVE PROGRAM you will ever do. If you are doing other programs, by all means stay with them. The more the merrier. But PLEASE READ ON! First of all, no one gets cheated like the other programs. The response rate for this program is VERY HIGH, VERY FAST, and you receive your cash in about 30 DAYS. That's only FOUR WEEKS - not three months. Just in time to pay next month's bills!!! THIS PROGRAM WILL ANSWER YOUR PRAYERS! TRUE STORY: Julie Price tells how she participated in a similar program four times last year. "The first time I received $3,000 in cash in two weeks, and then $7,000 in cash the next three times". "THIS CAN DO IT FOR YOU"!!! A QUICK OVERVIEW: Send this program to as many people as you possibly can; the more the better. Keep in mind it's nothing more than a numbers game. Even if you are already in a program, continue to stay with it, but do yourself a favor and DO THIS ONE as well; RIGHT NOW!!! It is simple and takes a very small investment - not hundreds of dollars. It will pay you before your other programs begin to trickle in. Just give the three (3) people below $5.00 each (by way of the monitor),and request a report from each one of them. Dont forget to include your name, mailing address, and e-mail address. You will replace #3 on the list below. #3 moves to the #2 position. #2 moves to the #1 position. #1 is then removed from the list. Follow the simple instructions below, and in FOUR WEEKS, you will have at least $5,000, because most PEOPLE WILL RESPOND due to the LOW INVESTMENT, SPEED, and HIGH PROFIT POTENTIAL. So let's all keep it going, and help each other in these tough times. INSTRUCTIONS: 1. Please address three (3) individual envelopes to the people listed below. 2. Include a one time only investment of: A. $5.00 to Person # 1. Person #1 will send you report #1. B. $5.00 to Person # 2. Person #2 will send you report #2. C. $5.00 to Person # 3. Person #3 will send you report #3. 3. Make U. S. Money Orders Only (or equivalent), payable to persons #1, #2, and #3. Don't leave any Money Orders blank! NO PERSONAL CHECKS! 4. Please place each money order in the three (3) individual envelopes. Include a note asking each individual to send you a report (dont forget to include your name, address, and e-mail address). Request report #1 from person #1. Report #2 from person #2. And report #3 from person#3. 5. Place a POSTAGE STAMP ON ALL THREE OF THESE ENVELOPES. You must also put a Return Address on them in case they get lost in the mail. PLEASE DO NOT SEAL THESE THREE ENVELOPES (explanation below)! 6. If you dont have an e-mail address, include a large Self Addressed Stamped Envelope to receive your master printout, ID number, and additional information from the monitor. 7. Please fill out the Membership form below. 8. Include a one time only membership fee of $10.00 (CASH OR MONEY ORDER) made PAYABLE TO: Net Promo (The Monitor). 9. Make a copy of this entire letter for yourself and send a copy to the Monitor. 10. Place items 1-9 into a larger (9x12 or suitable) envelope. 11. See, it's just that easy. Your entire investment is only $25.00. And dont forget, youll receive your "FREE" bonus gift just for joining the club. PLEASE DO NOT SEAL THE THREE (3) ENVELOPES. Why??? Because the monitor must see these envelopes before you can receive your master printout and ID number. You will need the master printout to make duplicate copies of this letter for future mailings. Your ID number will be used for tracking purposes. This is to insure that everyone receive their cash. Your master copy and ID number will be e-mailed to you. All others will be postal mailed within 24 hours from the time they are received by the monitor. PLEASE POSTAL MAIL EVERYTHING TO THE MONITOR. Your Monitor Is: Net Promo 2100 Roswell Rd. Suite 200-C Marietta, GA 30062 Office: 770.977.5363 Email: Mailserve(a)aol.com ***************************************************************** Membership Form: (Please fill out completely, and Print clearly). Name: Address: City: State: Zip: E-mail: Telephone Number (optional): Please send $5.00 to: Request report #1 from Person #1 Anthony Thomas (ID# 118) 974 East 49th St. Brooklyn, NY 11203 Request report #2 from Person #2 Z. Williams (ID# 102) 8150 East Hildale Detroit, MI 48234 Request report #3 from Person #3 Success Communication (ID# 101) 1516 Garden Lake Dr. Riverdale, GA 30296 ***************************************************************** Don't remove any names from the list above. The Monitor will send your master copy to you, showing your name and ID number in the #3 position. #3 will be moved to the #2 position. #2 will be moved to the #1 position. #1 is then removed form the list. Please dont forget to request a copy of all three (3) reports from Persons #1, 2, and 3. All reports will be e-mailed, or U.S. Postal mailed. Dont forget to include your name, mailing address and e-mail address when requesting your reports from Persons #1, 2, and 3. Report #1- How to Extract and Mass E-mail for "FREE". Report #2- How to gather U. S. Postal Addresses For "FREE". Report #3- How and where to Advertise on the Internet for "FREE". If you would like to use our mass e-mail services (YES! We do the actual e-mailing for you), please mail a money order to Net Promo. Our rates are: ($15.00 / 500 names)($25.00 / 2,000 names)($50.00 / 7,000 names). For more than 3,000 names, please e-mail: Mailserve(a)aol.com for a price quote. We also have a mailing list service which we ship the same day we receive your order. Our rates are: ($20.00 / 200 names)($35.00 / 600 names)($50.00 / 1,500 names). For more than 1,000 names, please e-mail: Mailserve(a)aol.com for a price quote. ***Please, dont forget the following: PRINT this letter and read it TWICE for clarity. We strongly encourage you to save this letter to your hard or disk drive immediately. You will use it again to do mass e-mailings. Make sure items 1-9 (from instructions above) are in the large envelope you're sending to the Monitor! Congratulations, and we'll "See You At The TOP"

1 0

secure file system for Linux?
by Mike_Spreitzer.PARC＠xerox.com 17 Dec '03

17 Dec '03

Is there a secure file system (or secure directory branch) for Linux?

3 2

Re: secure file system for Linux?
by mch＠squirrel.com 17 Dec '03

17 Dec '03

> Is there a secure file system (or secure directory branch) for Linux? Yes, you can use CFS, which works on several versions of UNIX as well as Linux. Send email to cfs(a)research.att.com to get a copy. Someone exported it, and it is also available from ftp://ftp.hacktic.nl/pub/crypto/CRYPTOapps/cfs.1.3.tar.gz There is also something called the "loop filesystem" for Linux. I haven't tried it and don't know how well it would integrate into the newer Linux kernels. ftp://tsx-11.mit.edu/pub/linux/BETA/loop -- Mark Henderson -- markh(a)wimsey.bc.ca, henderso(a)netcom.com, mch(a)squirrel.com PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer -- ftp://ftp.wimsey.com/pub/crypto ftp://ftp.netcom.com/pub/he/henderso/change-sun-hostid-1.5.0.tar.gz

1 0

Re: Netscape for Linux?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:42 PM 9/23/95 -0400, you wrote: >It seems to me that you folks are going out of your way to deny the >fact that the Linux market exists. I think that its because you are >embarassed that all these people with a $20 operating system are >throwing money at you while all the folks with $10K operating systems >aren't talking to you at all. > >While you may WANT to have all your sales be for OSF/1 machines or >solaris, but refusing to support Linux and ignoring the demand for >your products by the Linux community just because you don't think it >would sound as impressive, is actually quite childish and doesn't make >any financial sense. Foo. Supporting applications in a professional way on Linux is _tough_; everybody's got their own self-hacked copy that may have started out as SlackOS 4.1.3 but has the TooManyNotes Sound Widget replacement and has the XBrokenX video driver instead of the original one that didn't work on the TiltedSquareSneakyVideoCard and a way-cool new Obfuscated File System. It's like supporting things on "Unix" was back when everybody had source and a different flavor of M680x0 box. You can't just ask "Have you changed the AUTOEXEC.BAT since the machine came from the factory?" like Windoze app-vendors. Netscape may not have ever been _compiled_ with the compiler version the user has, much less tested on that kernel version, and the user may or may not know if their X Window System really is installed right or the TCP/IP connection works well and has working DNS support. Sure, it's easy to charge money for shipping the stuff with a diskette and a manual, but not doing so until they're ready to provide high-quality support isn't childishness, it's ethics (well, and/or bad-reputation-avoidance.) Now, I haven't checked whether they've trained all their people who answer phone calls from the public to acknowledge that there is an unsupported Linux version for folks who don't mind dealing with unsupported software, or if they've even got it on their Web site; the current version is there for ftp. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

Netscape closes up 1 3/8 today!
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DF84AJ.41K(a)sgi.sgi.com>, carolann(a)censored.org (Censored Girls Anonymous) writes: > Lookit that! 416 trades and 11 times there was more > buying pressure than selling pressure.. > The rumors of bug fix are outweighing the facts of the crack! > I am totally amazed! But think company insiders are probably > supporting the stock. Holding up better than ascii armor, it is. I think it probably has more to do with the fact that the name "Netscape" has been on the front page of every major newspaper in the US. I guess bad press is better than no press at all. And the press hasn't even been that bad. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

11 14

Re: Freeh says FBI doing great, supports Weaver killer
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/15/97 12:36 AM, Douglas L. Peterson (fnorky(a)geocities.com) passed this wisdom: >Declan, just an observation, but have you noticed that the media seems >to incapable of saying the name Randy Weaver without using the words >white supremacist (or separatist)? Do you think this is deliberate or >just a case of following a pattern set by others? Randy Weaver maybe wasn't the most politically correct citizen of the state, but the whole thing that got him in trouble was that they wanted him to spy on the white supremacists that lived up in the hills near him and he refused. He had a 'live and let live' attitude about the whole thing. So far as I have read he wasn't an active white supremacist so much as he wouldn't come out against them ... now maybe other evidence has been unearthed since the last time I looked into the matter in any detail, but that is how I read it. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNB0sxcdZgC62U/gIEQJ+QQCg5/35nA58vcGCw0RwEdFQ7xGgpegAn0vZ +5bb/FWbCNOSZgUzsZHOTza5 =6QIX -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Home is where your books are" -- Kitty O'Neal

1 0

Re: Ship Code! Re: House Intelligence Committee Press Release
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/15/97 1:14 AM, Bill Frantz (frantz(a)netcom.com) passed this wisdom: >An encrypt to FBI key system has some really serious >vulnerabilities. I scares me to have our financial system, >utilities, and airlines, to name just a few vital civilian >services, depend on a system with such an obviousflaw. There are >people and organizations out there who would love to disrupt these >systems, and flawed encryption would give them a powerful tool. ... not the least of which is that the computing horsepower to look at each and every message (ya never know; a naked picture of my dog my get through) and do even the barest of evaluations on it would swamp the system. By way of barest evaluation, just examining the To and From fields to see if one of them is on *the list* of suspicious persons. Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "When you find yourself on the side of the majority, it is time to reform." -- Mark Twain

1 0

New Netscape RNG
by Ray Cromwell 17 Dec '03

17 Dec '03

I just glanced at the new Netscape RNG source. I don't really see anything bad, but I haven't analyzed it. However, I'm curious as to why variables like the username or the language locality are used as sources of entropy. These seem to provide almost nil. The username is going to be pretty much constant. In fact, even the current directory which is used as a seed can't provide more than a few bits of entropy. In all probability, the user name will usually be the same, and so will the current directory (and how many directories are there? 65,000 would only give you 16 bits of entropy, assuming you get a directory listing from the machine) I'm thinking from the standpoint of someone gathering data on someone or some server to mount a specific attack. a "most common directories on the macintosh" file for instance could be used to attack the current directory method. Using those sources probably can't hurt, they just seemed like odd choices, "grasping for straws" so to speak. Nevertheless, I would like to commend Netscape for releasing the source code for public review. You guys are clearly an intelligent company, in both your current developments, but also the way you have handled this bad press. -Ray p.s. i hope you guys do a good internal review of your code to remove buffer overflow bugs

3 3

EPIC and PI Charge US Violates Intl Crypto Agreement
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 15 Sep 1997 00:57:11 +0100 From: Dave Banisar <banisar(a)epic.org> Subject: EPIC and PI Charge US Violates Intl Crypto Agreement Press Release. Privacy Groups Criticize United States Crypto Policy. Charge US Violation of International Agreement. Brussels - Two leading privacy organizations said today that the United States cryptography policy violates an international agreement reached earlier this year by more than two dozen countries at the Organization for Economic Cooperation and Development. The Electronic Privacy Information Center and Privacy International said that recent legislative proposals introduced in the United States to establish controls on the use of data scrambling technology are contrary to the principles adopted by the OECD and should be withdrawn. Marc Rotenberg, the director of EPIC and a member of the expert panel that drafted the guidelines, said that "the OECD framework is based on the voluntary, market-driven development of encryption products and services. The Guidelines emphasize the importance of privacy protection and the need for careful assessment of any key escrow proposal. Their were specifically intended to remove technical and legal obstacles to the use of cryptography. But the US policy now points in exactly the opposite direction -- extensive government regulation, little regard for privacy, and the rapid development of key escrow techniques regardless of the consequences." Mr. Rotenberg said that the OECD member countries considered and explicitly rejected the US recommendation that cryptography policy be based on law enforcement access to private communications. "That proposal was turned down by the OECD member countries. The United States accepted the judgment of the OECD and endorsed the final recommendations. The U.S. should now honor its commitment," said Mr. Rotenberg. Simon Davies, Director General of Privacy International, said "The rush to encourage technologies for communications surveillance comes at exactly the wrong time. Illegal wiretapping is on the rise around the world. Dissidents, political opponents, journalists, and human rights organizers are most often the targets." The current issue of the International Privacy Bulletin includes a review of worldwide privacy abuses in 1996. Electronic surveillance features prominently in the report. The review is based on "The Country Reports for Human Rights Practices," prepared annually by the U.S. State Department. Mr. Rotenberg and Mr. Davies said that the U.S. policy now stands as the single greatest barrier to the development of tools to protect privacy and security on the Internet. The statement was made at a conference this week in Belgium, hosted by Privacy International and EPIC, on "Cryptography and the Internet: Developing Privacy and Security Policy for the European Information Society." Participants from more than twenty countries attended the event. The Electronic Privacy Information Center is a civil liberties organizations, based in Washington, DC. Privacy International is a human rights organization concerned with privacy, surveillance and data protection issues worldwide. It is based in London. Both organizations are members of the Global Internat Liberty Campaign. WEB RESOURCES o EPIC [http://www.epic.org/] o Privacy International [http://www.privacy.org/pi/] o Global Internet Liberty Campaign [http://www.gilc.org/] o Brussels Cryptography Conference [http://www.privacy.org/pi/conference/brussels/] o OECD Cryptography Policy Guidelines [http://www.oecd.org/dsti/iccp/crypto_e.html] CONTACT (15-17 September) Marc Rotenberg, EPIC (Brussels +32 2 227 05 05, voicemail +1 202 298 0824) Simon Davies, PI (Brussels +32 2 513 29 73)

1 0

Re: Netscape giving away T-shirts?
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:33 PM 9/24/95 -0700, you wrote: > My ex-gf just told me on the phone that her boss mentioned >that Netscape was giving away T-shirts to people who found holes. >Apparently her boss saw this on the news. Interesting. ;-) > > (For the over-stressed and/or humor-impaired: I'm not implying >that netscape is giving away t-shirts, just commenting on the accuracy >of the media.) Concidering that they do give out a fair amount of shirts, they might actually be doing this now. (If it was for bugs they would owe me quite a few shirts. ];>) If they offer you a shirt, ask for one of the "Mosaic Communications Corporation" t-shirts. (The one with the old version of Mozilla on the back.) They are evidently considered a status symbol at Netscape corporate. (And, no, you cannot have mine.) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

<Yet Another Alarmist TV Show About Child Molesters on the Net: <snip> <Anyway, the mainstream media trashing of the Net continues. And the trashing will continue. It is the classic scenario. Feed the media negative press clips about the entity you wish to discredit (here, the Net), e.g.: 1. All those pedophiles out to lure your children; 2. Big coverage on catching some of those pedophiles; 3. First page coverage on breaking Netscape's code with the headlines that your sensitive information such as your credit card numbers, etc. can be retrieved (ignoring that the reason was to show Netscape's poorly structered code would allow this and, therefore, preventing it before it could happen); 4. Expect cryptology to crop up in the Oklahoma bombing trial. There already has been articles of those involved having allegedly used that *damned* Net to correspond. Now, the stage is set. The general public will demand that the Net (the bastion of perverts and radicals) be controlled, monitored, and censored - all as a result of a carefully planned methodology of those specific powers that be. Having the general public believe that their children and the national security are being threatened makes it a much easier task for *them* to attain their goals. After all, who wants to be bothered with proposed legislation when you can have Jane and John Doe yelling for what may have taken *them* a while to attain by "normal" routes? Never underestimate.... Pathfinder

1 0

Crowds code NOW AVAILABLE for Unix
by Mike Reiter 17 Dec '03

17 Dec '03

Crowds is a new system for protecting your anonymity while you browse the web. We have recently obtained a release for the code from AT&T and have been testing the system with a handful of volunteers. Thanks to their efforts, we now feel more prepared to support a larger user community. So, if you are interested in browsing the web with better anonymity than the Anonymizer, check out http://www.research.att.com/projects/crowds There are two steps. The first is obtaining the code. After you accept the license agreement, expect a 24 hour turnaround to receive the code by e-mail. Second, if you would like to join our crowd, fill out the registration page, and expect 24 hours before you are admitted. (These steps can proceed in parallel.) The system requires Perl 5.003 or higher, and has been tested on SunOS, Solaris, and Irix. Our next target is Linux. - Mike Reiter and Avi Rubin

1 0