December 2003 - cypherpunks-legacy

Kremlin v1.04
by Mark Rosen 17 Dec '03

17 Dec '03

I'm sure you all remember my program, Very Good Privacy, and have been waiting for the release of the new version with bated breath. Well, it's finally here! Only, after being contacted by PGP, Inc. regarding a possible trademark violation, I've changed its name to Kremlin. Remember: it's like an iron curtain for your data. The new version still uses the same algorithms. The algorithms can be grouped into three categories: ASCII and Vigenere, which give little security, but are extremely fast, DES, NewDES, and Safer SK-128, which will protect against all but the most well-funded adversaries, and Blowfish, IDEA, and RC4, which are perhaps the most secure algorithms available today. The key-size of the algorithms ranges from 64-bits (actually 56-bits) in DES to 128-bits in IDEA, NewDES, and Safer SK-128, and infinite length in ASCII, Blowfish (up to 448-bits), RC4, and Vigenere. If the "Hash Passkey" option is checked, then the passkeys are hashed with a 64-bit per-source file salt using SHA1 to form a 160-bit passkey; extra bits not used by the fixed-length algorithms are discarded. Without the "Hash Passkey" option checked, the passkey is only XORed with the salt and retains its original size. If the "Encrypt Headers" option is checked, then the filename and file size of the files are encrypted, giving an attacker no information about the source files. Once the files have been encrypted, you have the option of securely deleting them by overwriting them a user-definable number of times with random data; the most secure encryption algorithm in the world is useless if the plaintext is left unsecured on the hard drive. All of this is done through one simple dialog box. To launch Kremlin, just drag a file or directory (or a combination of files or directories) onto the Encrypt icon on the Windows 95 desktop. To decrypt a file, just double-click on it and enter the passkey; no unwieldy tabbed dialog boxes or file directory navigation boxes. Plus, as a added bonus, anyone who orders 10 or more copies of Kremlin will receive a can of Spam (TM) for free! For more information on Kremlin, e-mail mrosen(a)peganet.com To download Kremlin, go to: http://www.geocities.com/SiliconValley/Pines/2690

1 0

new restrictions in EAR (over ITAR)
by Adam Back 17 Dec '03

17 Dec '03

(from "http://jya.com/bxa123096.txt") : a. ``Software'' specially designed or modified for the : ``development'', ``production'' or ``use'' of equipment or ``software'' : controlled by 5A002, 5B002 or 5D002. : b. ``Software'' specially designed or modified to support : ``technology'' controlled by 5E002. large integer libraries? (modexp functions?) : c. Specific ``software'' as follows: : c.1. ``Software'' having the characteristics, or performing or : simulating the functions of the equipment controlled by 5A002 or 5B002; : c.2. ``Software'' to certify ``software'' controlled by 5D002.c.1; this one (I presume) is addressed at people like microsoft with CAPI certifications, you can't export the signing software : c.3. ``Software'' designed or modified to protect against malicious : computer damage, e.g., viruses; - Virus scanning software? (Winn Schwartau's info warfare hype is rubbing off on the spooks) Makes one wonder, if it's purportedly in the national security interests to bar the export of virus scanners (of any quality), logically it's also in the national security interests for the NSA to write and distribute virii. - Programs which checksum themselves as a crude check against viruses/modification? (some _operating systems_ qualify on this basis) - md5file from rfc1321? (rfc1321 is the MD5 rfc, md5file checksums files with md5, useful for checking what's changed)? - firewalls! (whoops there goes a few more million in US trade) Madness, Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Hardening lists against spam attacks
by Bovine Remailer 17 Dec '03

17 Dec '03

So, we had a spike of spam attack around Christmas, primarily using the mechanism of subscribing the cypherpunks list to other mailing lists. Now, everybody is off designing methods to limit postings to the list. You know what this reminds me of? The enthusiasm displayed by the the current US government administration to get bills passed that would curtail even more rights of its citizens in the wake of the TWA flight 800 crash. Cypherpunks, you have met the enemy and it is you.

2 1

benefits of EAR (not)?
by Adam Back 17 Dec '03

17 Dec '03

Reading through "http://jya.com/bxa123096.txt": > 1. This interim rule has been determined to be significant for > purposes of E.O. 12866. A cost benefit analysis has been prepared and > is available upon request by contacting James A. Lewis at (202) 482- > 0092. Anyone availed themselves of this offer of a CBA for EAR? Just curious as to what the supposed benefits are :-) Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

4 3

Join Us "Special Conference Call"
by carrollw＠cadvision.com 17 Dec '03

17 Dec '03

Hello opportunity seeker, For most people, finding the RIGHT opportunity that provides the FREEDOM and the right CASH flow to earn a living working from HOME is a DREAM at best. Team 2000 has joined a company that has all the INGREDIENTS for this wish to be fulfilled and I extend a very CORDIAL invitation for you to join our Team 2000 TOLL FREE conference CALL on: THURSDAY Evening, January 2, 1997 You are invited to a Special Toll Free Conference Call with ... 1. The President of Idea Concepts, Ken Hampshire 2. The Co-founder of Idea Concepts, Steve Miles 3. Other key leaders of Idea Concepts 4. The Team 2000 Leaders 5. Most importantly: YOU Hear about the products, compensation plan and exciting late breaking news on this call! Please, write this number down now and put it on your calendar for Thursday night, January 2, 1997. At the appropriate time for you,(in your time zone) call 1-800-556-3844 9:30 pm Eastern Standard Time 8:30 pm Central Standard Time 7:30 pm Mountain Standard Time 6:30 pm Pacific Standard Time You may call in 2-3 minutes before the actual time. If you call in too soon you will get a busy signal, so just keep dialing back in. Your questions will be answered Thursday night on the TOLL-FREE Conference Call. In the meantime you may wish to review information on our website and follow the links: http://www.ideaconcepts.com Best Regards for a Healthy, Happy and Prosperous New Year! Wayne J Carroll Team 2000 - Leader

1 0

Travel Discounts
by travlpls＠netside.com 17 Dec '03

17 Dec '03

Fuck_God_Up_The_Ass, How would you like to save 65% on all your leisure and business travel? Save at thousands of fine hotels, resorts and condos, all around the world. Also, save on airfare, cruises, car and RV rentals, special attractions and MUCH MUCH more!! That's just the tip of the iceberg! For a limited time only, we are offering a golf package which includes 50% off green fees at over 2,000 golf facilities. This travel package will pay for itself the first time you use it!! *START SAVING NOW!! SIMPLY HIT REPLY AND TYPE "DISCOUNTS"*

1 0

stupid remailer-ignorant stud3nt caught by NY polic3
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

http://www.nytimes.com/yr/mo/day/news/national/psychopaths-educ.html Potential Killer or Just Disturbed? Psych Class Seeks Distinction By KAREN W. ARENSON NEW YORK -- The 20-year-old man with a Mohawk haircut, multicolored pigtails, tattooed arms and rings on every finger was an engineering student at a New York college when he sent e-mail to a public official threatening to torture him and rape his young daughter. The FBI arrested the student a few days later as he sat in his pajamas eating breakfast. Late last year, the case landed on the desk of Dr. Naftali Berrill, a forensic psychologist who had conducted court-ordered examinations of Joel Rifkin, the serial killer, and Colin Ferguson, the Long Island Rail Road killer. Now, Berrill is using the e-mail case in the class he teaches at John Jay College of Criminal Justice in Manhattan. The class is part of the college's fastest-growing area of study: forensic psychology. Six years ago there were 96 students in the masters program; now there are 271. "There is a fascination with this stuff," said Berrill, who assigns movies like "Klute," "Silence of the Lambs" and "Psycho" as homework, along with articles in scientific journals. "Popular culture has gone nuts with the idea of taking someone who has committed a crime and profiling the person, thinking about why he did it, what is behind it." The goal on a recent day was to get his students to judge whether the tattooed man was fit to stand trial, whether he was legally responsible for his behavior, or whether he might be considered legally insane, and whether he is in need of treatment. Berrill had evaluated the man and knew the court's ruling, but he wasn't about to tell his students until the exercise was over. "How should the young man be handled?" he asked the students. "Is he really dangerous or is he only sick? Is prison appropriate or does he need medical treatment?" First, the students wanted more information. They did not have the young man to question, so they began firing questions at their professor. Did the young man have prior problems with the law? Berrill shook his head no. Any history of psychological problems? Berrill reported that the young man had "apparently always been an odd duck, a person who felt separated from the group and who capitalized on his oddness." Since his arrest, he says he has had fleeting ideas of killing himself. How did he behave when arrested? He spoke quietly and his speech was fluent, articulate and terse. His reaction was more surprise than remorse. Any other unusual behavior? He used to have fantasies of protecting people beset by attackers. Sometimes he sensed the taste of chocolate, even when he had none in his mouth. Sometimes he walked around New York City with knives strapped to his chest and arms. For half an hour, the psychological sleuthing continued: What kind of family history did he have? He was the last of several children in an Irish-American working-class family, and he had brothers who had been arrested for drug use. Was he overprotected and coddled? The young man had said he was well cared for, but it was difficult to learn whether there was true affection. Finally, the students were ready to lay out their theories. The young man showed signs of a narcissistic personality disorder or a histrionic personality disorder, some said. He might have sent the e-mail message just to get attention, adding the rape threat for shock value but not really as something he intended to carry out. One group thought the student himself had been abused. And some saw his threats as reflections of his own sexual inadequacy. Some students suggested blood tests and psychological tests to see if he was depressed. For many students, the analysis was better than an evening in front of the television set. "I love it," said Adrienne Higgins, a former florist who returned to college and hopes to go on for a Ph.D. in neuropsychology. Eva Norvind, who has a master's degree in health education and counsels sexual deviants, calls the class one of her most challenging. Some students go on to earn doctoral degrees in psychology and begin a practice. Others go to law school, and still others go into social service or police work. But Berrill estimates that about a third of the students take the class to indulge in their own fascination with crime. Berrill got to the heart of the question: "If you were in law enforcement, is he a dangerous person?" Most class members nodded yes. The most telling piece of evidence, said one student, was "the fact that he was walking around the city, like an armed bomb waiting to go off." And the dissenters? "He needs help. I am very concerned about the homicidal and suicidal thoughts." Another commented, "In terms of being dangerous, he has no history. His use of e-mail shows a fear of social contact, and that doesn't fit the character type of a killer." Berrill was pleased. He had one more question: Does the young man have a shot at the insanity defense? No, most students said. "He was aware of everything he was doing," said one. "But he would be helpful to an attorney." Berrill beamed. In his view, the class had captured the important elements. "If I were asked by a judge," he told them, "I would say he is dangerous. Always err on the conservative side. He is in need of mental health services. But incarceration? No. He is not psychologically equipped to deal with real criminals or psychopaths." The court concurred. Earlier this year, a judge put the young man on probation and directed him to seek psychological counseling. - Igor.

1 0

IJLNotes is a Computerized Automated Messaging Center
by ijlnotes＠joblocator.com 17 Dec '03

17 Dec '03

What is IJLNotes? http://www.joblocator.com/ijlnotes/ Need help tracking your day, week or month ? IJLNotes is a unique Computerized Automated Messaging Center. Min. Hardware/Software Requirements Windows 3.1 , '95 or NT 386 or faster 4 MBs RAM Check out the screen shots on our web page http://www.joblocator.com/ijlnews/i5.gif http://www.joblocator.com/ijlnews/i6.gif Full working demo until Feb 10, '97

1 0

anonymous <-> anonymous; dcnets
by Laszlo Vecsey 17 Dec '03

17 Dec '03

Can someone point me towards a mailing list or two that is dedicated to the discussion and development of dcnets? Thank you! - Lester - A recent study has found that concentrating on difficult off-screen objects, such as the faces of loved ones, causes eye strain in computer scientists. Researchers into the phenomenon cite the added concentration needed to "make sense" of such unnatural three dimensional objects. -

1 0

Re: Crypto reg clarification from Commerce Department
by Greg Broiles 17 Dec '03

17 Dec '03

Lucky Green wrote: >I just got of the phone with Bruce Kutz, Export Policy Analyst, Office of >Strategic Trade and Foreign Policy Controls. (202) 482-0092. He seems to be >the contact person for the new regs. Well done, Lucky. This is what's needed to kick off a lot of commentary during the next 45-days. Backed by research, to be sure. The outpouring of such commentary on the full EAR from May 1995 to March 1996 shaped the final document, and that process is an excellent case study for how to affect the final form of the latest crypto regs. It's worth perusing the full EAR in the Federal Register: March 25, 1996 (Volume 61, Number 58), Pages 12713 et seq. for 325 pages (well over a 2.5MB -- it's also on our site, see URL below). Here's the portion of the EAR that Lucky and Kutz discussed: [Page 12805] Sec. 744.6 Restrictions on certain activities of U.S. persons. (a) General prohibitions--(1) Activities related to exports. (i) No U.S. person as defined in paragraph (c) of this section may, without a license from BXA, export, reexport, or transfer to or in any country other country, any item where that person knows that such item: (A) Will be used in the design, development, production, or use of nuclear explosive devices in or by a country listed in Country Group D:2 (see Supplement No. 1 to part 740 of the EAR). (B) Will be used in the design, development, production, or use of missiles in or by a country listed in Country Group D:4 (see Supplement No. 1 to part 740 of the EAR); or (C) Will be used in the design, development, production, stockpiling, or use of chemical or biological weapons in or by a country listed in Country Group D:3 (see Supplement No. 1 to part 740 of the EAR). (ii) No U.S. person shall, without a license from BXA, knowingly support an export, reexport, or transfer that does not have a license as required by this section. Support means any action, including financing, transportation, and freight forwarding, by which a person facilitates an export, reexport, or transfer without being the actual exporter or reexporter. (2) Other activities unrelated to exports. No U.S. person shall, without a license from BXA: (i) Perform any contract, service, or employment that the U.S. person knows will directly assist in the design, development, production, or use of missiles in or by a country listed in Country Group D:4 (see Supplement No. 1 to part 740 of the EAR); or (ii) Perform any contract, service, or employment that the U.S. person knows directly will directly assist in the design, development, production, stockpiling, or use of chemical or biological weapons in or by a country listed in Country Group D:3 (see Supplement No. 1 to part 740 of the EAR). (3) Whole plant requirement. No U.S. person shall, without a license from BXA, participate in the design, construction, export, or reexport of a whole plant to make chemical weapons precursors identified in ECCN 1C350, in countries other than those listed in Country Group A:3 (Australia Group) (See Supplement No. 1 to part 740 of the EAR). (b) Additional prohibitions on U.S. persons informed by BXA. BXA may inform U.S. persons, either individually or through amendment to the EAR, that a license is required because an activity could involve the types of participation and support described in paragraph (a) of this section anywhere in the world. Specific notice is to be given only by, or at the direction of, the Deputy Assistant Secretary for Export Administration. When such notice is provided orally, it will be followed by a written notice within two working days signed by the Deputy Assistant Secretary for Export Administration. However, the absence of any such notification does not excuse the exporter from compliance with the license requirements of paragraph (a) of this section. (c) Definition of U.S. person. For purposes of this section, the term U.S. person includes: (1) Any individual who is a citizen of the United States, a permanent resident alien of the United States, or a protected individual as defined by 8 U.S.C. 1324b(a)(3); (2) Any juridical person organized under the laws of the United States or any jurisdiction within the United States, including foreign branches; and (3) Any person in the United States. (d) Exceptions. No License Exceptions apply to the prohibitions described in paragraphs (a) and (b) of this section. (e) License review standards. Applications to engage in activities otherwise prohibited by this section will be denied if the activities would make a material contribution to the design, development, production, stockpiling, or use of chemical or biological weapons, or of missiles. ----- The EAR covers all kinds of exports, so encryption and cryptography provisions are found by searching. The Federal Register published it in seven 50 page chunks, and is available at: http://www.access.gpo.gov/su_docs/aces/aces140.html Enter the search term: "Page 12713" (with quotes; repeat six times in sequence). We've combined the seven parts for searching: http://jya.com/ear032596.txt (2,570K)

1 0

One-time pads
by nobody＠replay.com 17 Dec '03

17 Dec '03

The arrival of warm weather is heralded by the pig shit (or whatever kind of shit Intel swines have for brains) getting soft in Timmy C[rook] Mayhem's mini-cranium and the resulting green slime seeping through his cocaine- and syphilis- damaged nose and onto his keyboard. o_, o <\__, v|> Timmy C[rook] Mayhem | < \

1 0

How to Reach The Most People
by iolkos＠ix.netcom.com 17 Dec '03

17 Dec '03

Targeted E-Mail Lists Will Get Your Message Out You probably have a special offer to make to many people over the internet. At ATS Publishers, Inc., we maintain a database of over 450 groups of e-mail addresses sorted according to the groups' demographic, psychographic, geographic, benefits-sought, and individual description. If you have a book, product, announcement, or service to advertise in a specific area, your greatest response rates will come from targeting these niche lists. You must have these addresses, as you will save money while no longer mailing your sales message to unqualified prospects. We absolutely guarantee your success with these lists. Here is a small sample: Opportunity Seekers, General Business, Sports (all), Entrepreneurship, Fitness & Exercise, Accountants, Health, Lawyers & Legal, Nutrition, Single Moms, Fashion, Outdoors, Dresswear, Computers, Math & Sciences (all), Finance, Investing, Fishing, Hunting, Hunting Dogs, Financial Markets, Race Boats, Wealth, Taxes, Languages, Millionaires, Divorced Parents, Gay & Lesbian, Kids, Teenagers, Adults, Seniors, Racial-Ethnic-Cultural (all), Criminal, Pornography, Shopaholics, Alcoholics, Virgins, Politics, Overweight, Paranormal, Psychology, Literature, Technical, Painters & Artists, Doctors & Medicine, Religion & Atheism, Government, Taxation, Food and Beverages, Wines & Spirits, Restaurants, Working Women, Geographical U.S., Sex, Physically Challenged Persons, Drugs, Hippies, Music and Musicians, Firearms, Militias, Students, AIDS, Disorders, Child & Baby Care, Feminists, Body Painting & Piercing, Massage, Activists, Homeowners, Real Estate, Automotive, Health Care, Insurance, Edu! cation, Infertility, Architects, Dating, Love, Telecommunications, Hardware & Tools, Homes & Gardening, S&M, Housekeeping, Spirits & Wines, Home Business, Star Trekkies, Athletes, Authors, Store Owners, Job Hunters, Photography, Plants, and another 350 groups targeted even further... If you do not see your group in these listings, don't worry! Even if they are not in our database, we will create one for you within 24 hours. Here's how to order: Write us a brief description of the groups you want to target. We will then ship you, in diskette form, a listing of the 10,000 most targeted prospects for your product. These are people who have PROVEN beyond any doubt that they are interested in the service you are offering. Each e-mail listing of 10,000 names costs only $19.95. And although $19.95 is our minimum order, you may buy in odd lots also, say, 15,000. Each additional name after 10,000 costs only 1/10th of a cent; in this 15,000 name case, you would pay only $24.95! For 20,000 names,you would pay $19.95 plus an extra $10 (10,000 X 10 cents) All orders are shipped via 2-3 day priority mail, and come with a 30-day No Questions Asked Money Back Guarantee. Mail your check or M.O., in the amount of $19.95 plus any additional charges, along with your groups' description, to: ATS Publishers, Inc. 3811 Ditmars Blvd. Astoria, NY 11105 Tel: (718) 274-9060 If the line is busy, keep trying! We're trying to keep up with the enormous demand, since Thursday the 26th, our first mailing. Thank you so much for your time.

1 0

E-Cash IPO! PCweek Mag!
by Robert Hettinga 17 Dec '03

17 Dec '03

I'm sure they'll be hearing from Digicash, BV's trademark folks on this one... Cheers, Bob Hettinga --- begin forwarded text From: latham(a)softcell.net To: Date: Thu, 02 Jan 1997 02:11:04 PST Subject: E-Cash IPO! PCweek Mag! E-Cash IPO! 625,000 shares - $1.60 per share As seen in PCweek online magazine: http://www.pcweek.com/news/0826/27email.html "E-commerce startup offers digital cash to each user who retrieves advertising e-mail from its web site. Digital currency units can be converted into US dollars, Japanese yen, Swiss francs, and German marks." Millennium Interactive Technologies, developer of the first ever system of advertiser funded digital cash system. (DCU) is offering 625,000 common shares directly to the public. The offering price is $1.60 per share. Qualified investors can obtain a printed copy of the offering prospectus, demo disk, and additional info on how you can earn digital cash for looking at e-mail by sending reply to: mailto:latham@softcell.net --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/ FC97: Anguilla, anyone? http://offshore.com.ai/fc97/

1 0

Re: Hardening lists against spam attacks
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 09:28 AM 12/31/96 -0800, you wrote: : :So in order to post here, I hafta install and run PGP? Well, people :were looking for the perfect formula to deny service to guys like me, :and guess what? You found it! I will *not* install and run PGP. Fill me in. Why do you choose not to install and run PGP? Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

2 1

Re: Would you be interested in SPAM?
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 12:51 AM 1/1/97 GMT, you wrote: To cypherpunks(a)toad.com :You can save a substantial amount of money on your next Florida :Vacation and receive an adult pass to Universal Studios. : No adults here, Spamboy.

1 0

FIPS for AES
by John Young 17 Dec '03

17 Dec '03

Federal Register: January 2, 1997, Pages 93-94. Announcing Development of a FIPS for Advanced Encryption Standard Agency: NIST Notice; Request for comments. ----------------------------------------------------------------------- Summary: A process to develop a FIPS for Advanced Encryption Standard (AES) incorporating an Advanced Encryption Algorithm (AEA) is being initiated by the NIST. It is intended that the AES will specify an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century. [Described as a successor for DES by 1998.] ----- http://jya.com/aes010297.txt (8K)

2 1

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Happy New Year. Associated Press: Monday, December 23, 1996 Three Credit Card Firms Seek To Promote Internet Shopping Three credit card companies on Monday announced an agreement on chip card standards in an effort to promote shopping on the Internet. Europay International, MasterCard International and Visa International said in a statement that they'll integrate in chip bank cards a technology developed for safe electronic payments. The agreement is based on the Europay-MasterCard-Visa specification, which established the financial industry's first global chip card payment infrastructure, and on MasterCard and Visa's Secure Electronic Transactions specification for magnetic stripe-based card transactions. Guido Heyns, director of 'smart card' development at Europay International, said in the statement that the Belgium-based company believes chip cards are the most secure and consumer-friendly solution for making payments on the Internet. Steve Mott, senior vice president of MasterCard International, agreed. 'Consumers and merchants want to conduct transactions over the Internet in a safe manner. By integrating chip and electronic commerce technologies, we are offering them the opportunity to do so as quickly and practically as possible.' An open comment period on the new standard will begin in the third quarter of 1997, according to the statement. American Banker: Monday, December 23, 1996 As the Technology Advances, Security Debate Still Rages By JEFFREY KUTLER In one of the more startling public statements by a banker in 1996, Citicorp chairman John Reed said it would take two generations -- 50 to 70 years -- for on-line electronic banking to gain full public acceptance. Taken out of context, his remarks to a Treasury Department conference on electronic money sounded like an invitation to complacency, or a dose of disinformation from one of the world's more aggressive purveyors of electronic financial services. But Mr. Reed chose his words carefully, citing a lesson learned from his 30-plus years at Citicorp: Banking markets, and society generally, take time to change. He seemed to suggest that high-technology advocates can become so enthralled with the elegance of their systems and convinced of their viability that they overlook the most common of all constraints: consumer behavior. "Privacy and security are at the top of the list" of consumers' concerns, the Citicorp chief executive said. "They won't deal with anyone who doesn't give them assurance." While "some early innovators will be your electronic banking customers," he said, "the average consumer is not there yet and isn't going to be there" for some time. "This is not a question of economics or efficiency. It is a question of trust. The consumer will have to trust you. The Internet is fundamentally flawed in that regard." Essentially alone among the major U.S. banking organizations, Citicorp has been openly wary of Internet security and refrained from joining the rush to interactive banking and monetary transactions via the World Wide Web. Mr. Reed and his senior technology officer, Colin Crook, have publicly expressed interest in and enthusiasm for the Web but not yet for transactional purposes. When Mr. Reed was asked during the Treasury conference in September when Citi would offer Internet banking, he replied, "Not until it's secure." "There is no absolute security," said Mr. Crook, perhaps the only banker raising concerns about an "information warfare" attack on the banking system. "It is a risk management issue." The Citibankers contend the risks of cyberspace are fundamentally different from those in other payment systems, and have yet to be addressed. "Security will be more demanding than even the government itself is used to," Mr. Crook said at the Treasury meeting serves more customers via personal computer than any other, through conventional dial-up connections and with software it developed more than a decade ago. Citibank also has placed a bet on a digital currency for on-line transactions, the invention of one of its own vice presidents, Sholom Rosen. The bank claims it will be more secure than competing alternatives like Cybercash Inc.'s Cybercoins, Digicash Inc.'s Ecash, and the Mondex smart-card-based system. Putting considerable prestige and intellectual firepower behind its cautionary principles, and behind the notion that the issuing of electronic currency should be reserved for regulated financial institutions, Citicorp has kept alive a debate that is likely to resound for months if not years in public policy circles, with effects not just on the battle for technical and competitive superiority but on the very consumer behavior Mr. Reed is trying to gauge. Consider some recent twists and turns: The U.S. government continues to struggle toward a policy on data encryption, the technology crucial to on-line transaction security, that would be agreeable to the high-tech community while addressing national security and law enforcement concerns. A May 1996 report by the National Research Council of the National Academy of Sciences -- Citicorp participated in and vocally endorsed the study -- criticized the government for being backward with its restrictions on encryption, particularly regarding its export. (See related article on page 14A.) Hewlett-Packard Co. in November announced its International Cryptography Framework, the first "strong encryption" method to get U.S. export clearance. While the framework is adaptable to various and changing government policies, it did not fully resolve the controversial issue of access to encryption keys. An information security team at the National Security Agency produced a monograph (excerpted at left) critical of the degree of anonymity built into Digicash's Ecash. The NSA, of course, is part of the establishment attacked in the National Research Council report. Digicash and Mondex, which is being taken over by MasterCard International, continually trade charges about their degrees of anonymity and security. Both sell anonymity of payments as a necessary analogue to cash. In that Digicash's anonymity appears more absolute, it may raise more governmental concerns. But Digicash, the brainchild of the renowned cryptologist David Chaum, accuses Mondex of not being "true electronic cash." First Virtual Holdings Inc., an Internet payment pioneer, does not trust Web security; its transaction data flow instead over private E-mail. By contrast, Cybercash Inc. chairman William Melton is so confident of the available technology that he tells bankers: "Security is essentially done. Just tell your customers, 'Don't worry, we'll take care of it.' " (He is more worried about privacy as a political flashpoint.) Enter the central banks of the Group of 10 industrialized countries, the constituents of the Bank for International Settlements in Basel, Switzerland. This august global regulatory body has signed off on a moderate, largely laissez-faire approach to the electronic evolution of money. A task force empaneled by the G-10's payment and settlement systems committee, which is headed by Federal Reserve Bank of New York president William McDonough, spelled out its conclusions in a 64-page booklet, "Security of Electronic Money," dated August 1996. The task force was generally impressed by existing security capabilities, particularly those incorporating hardware components like smart cards. The report took the eight-member task force less than a year to complete. Chairman Israel Sendrovic, the New York Fed's executive vice president of automation and systems services, asserts that this was no rush to judgment. He personally did due diligence on all of what he calls "the usual suspects" -- the electronic money schemes not mentioned by name in his report (but presumably in this article). In a recent interview, Mr. Sendrovic stressed that there are no absolutes. "There is no such thing as one secure measure," he said. "It's a combination of measures, and the combination of measures changes the risk management of an attack." His measured response to a lot of questions - pertaining to money laundering or the market potential of electronic currency and how it is to be regulated -- was, "It depends." He did say, in response to the recent flurry of questions about smart card security emanating from Bellcore and other research laboratories, that the cards were advertised as "tamper-resistant, not tamper- proof." Mr. Sendrovic said his panel has disbanded, satisfied with its work and having gotten positive feedback. "Then again, it didn't break new ground," he said. "Remember, it was designed not for the cognoscenti but for the Group of 10 governors. "We stay in close touch and follow these things," he said of the task force, adding that it may have cause to renew its inquiry in a year or two. Though the task force acknowledged "comprehensive security risk assessments of the entire system" are still lacking, it said they are within reach. And its words lacked the alarm or urgency of, say, the Citicorp contingent. Sholom Rosen, inventor of Citibank's Electronic Monetary System, characterized the risks as "very high" and not yet fully analyzed. Digital cash gains legitimacy when it is interchangeable with other forms of money, he said, but its interactions with those systems -- how an attack on one mechanism would affect others -- must be studied. And he said he believes the answers do not lie in technology alone but in the fundamentals of the "three pillars of security" -- prevention, detection, and containment. Where Mr. Rosen sees enormous hazard, Mr. Sendrovic retains faith in barriers to entry, as might be expected of someone who has worked with the dependable Fed Wire for many years. To be legitimate, electronic money "has to be cleared," he said. "At some point it has to get into the payment system." Is "the payment system" at risk of infection from the new forms of money? Based on what we know so far, it depends. ABA Banking Journal, 12/96 SMART CARDS POSE TAX PROBLEM FOR MERCHANTS A consensus is emerging that the success of smart cards hinges at least as much on merchants accepting them as on consumer acceptance. Increased tax liability is one reason for merchants' muted enthusiasm -- besides the fact that merchants are the only ones so far being asked to pay for using smart cards."There's a resistance to forms of payment besides cash," said Bruce Brittain, whose firm Brittain Associates, Inc., polled merchants that participated in the smart card test during the 1996 Summer Olympics in Atlanta. Some merchants admitted to understating their cash receipts so as to reduce their tax burden, he said. (Smart cards leave an electronic audit trail by recording deductions in card value each time merchandise is purchased.) On the flip side, franchisors may push for the adoption of smart cards in their stores, since some Atlanta operators told Brittain, "We want to collect more fees from our franchisees." (The franchisor's cut of the receipts will be reduced if the franchisee understates his receipts.) Other sources said they heard the same thing. The wish to under report receipts may pose a greater obstacle to smart cards when they undergo their next major test in New York City next year, because more "Mom and Pop" stores will be participating, Mr. Brittain said.

1 0

None One-time pads
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May is just a poor excuse for an unschooled, retarded thug. /''' c-OO Tim May \ -

1 0

Re: Hardening lists against spam attacks
by Hal Finney 17 Dec '03

17 Dec '03

I think this is an interesting theoretical discussion, although it's not clear whether it is actually a good idea to try implementing this. From: nobody(a)replay.com (Anonymous) > A very good scheme, but why not give each subscriber a token when s/he > subscribes? Something along the lines of: > > - - - - - - - - - - - - - - - - - - - - > Welcome to Cypherpunks. > > Your unique token is: 0A553FC1771623109504522E31C07F44 > > This token must appear either as the first line of the message body or in an > X-Token: header for any mail you send to the list. Any messages sent to the > list > address without this information will be discarded. > [...] > Bob wants to post something anonymously. His token isn't associated with his > user ID -- the only thing Majordomo knows about it is that it's in the token > file and it's flagged as active. He sends the message through the remailer > network with his token in it, and Majordomo validates it, strips it out, and > passes the message to the subscribers, decrementing the number of messages Bob > has remaining for that day. This requires Bob to trust the server to keep his identity secret. Although you _say_ that majordomo didn't associate the token with the userid, how does Bob know that? Certainly majordomo did, when Bob subscribed, see the association between the userid and the token. Now he has to trust that it has been forgotten. Even if it has, what about eavesdroppers on the list channel? What about the operator on the machine, who is peeking at what majordomo is doing? This mechanism will not provide enough anonymity for most posters. An alternative similar to what I proposed earlier is for majordomo to provide a blinded token, one which it doesn't see. This would be used specifically for anonymous postings. It does have the problem that it allows linking postings by the same pseudonymous nym - all will have the same token. But maybe we want to encourage that. (The full proposal I made involved use-once tokens, just like online digital cash, so that there would be no linkage and it would allow real anonymity.) > Mallory wants to spam the list. He subscribes and gets a token, which he > uses to > forward commercial announcements to the list. The list manager checks the logs > to see which token was used, and reduces its posting limit or invalidates it. > Mallory is no longer allowed to post, unless his token is reinstated (or he > unsubscribes and resubscribes). This unsubscribe/resubscribe issue has been mentioned before as a problem. I am not too concerned with it, for a few reasons. First, it may not be too difficult to recognize that it is happening. If the same user name is used we can prevent issuing new tokens on an unsubscribe/resubscribe cycle. If different user names are used but common domain names (an attack which many people could mount) we could recognize that with somewhat more difficulty, and mark those domains as special. Most people would have trouble getting lots of different accounts with different domain names. Eric Hughes maxim, "all crypto is economics", applies here. We can easily make it much more difficult for flooding attacks to occur. Hal

3 3

Re: New crypto regs outlaw financing non-US development
by Bovine Remailer 17 Dec '03

17 Dec '03

At 31 Dec 1996 22:32:38 -0500 (Lucky Green) <shamrock(a)netcom.com> wrote: > At 01:05 PM 12/31/96 -0800, Ian Goldberg wrote: > > > >But it _specifically_ restricts virus-checkers (and, also, it would seem, > >backup programs, but that could be stretching it): > > > >ECCN 5D002.c.3: > ># ``Software'' designed or modified to protect against malicious > ># computer damage, e.g., viruses > > My mistake. I overlooked this paragraph. I thought it had not made it into > the final version. Virus checkers, programs like Tripwire, and all firewall > products are export controlled under the new regs. Regardless if the > program uses crypto or not. > How long before the United Police States of America bans the export of medicines and medical technology because it can be a defense against biological warfare?

2 1

New rules for Internet sales to CA buyers
by Greg Broiles 17 Dec '03

17 Dec '03

The following subsection of California Business & Professions Code section 17538 took effect 1/1/97 and may be of interest to people following state attempts to regulate net sales: [...] (d) A vendor conducting business through the Internet or any other electronic means of communication shall do all of the following when the transaction involves a buyer located in California: (1) Before accepting any payment or processing any debit or credit charge or funds transfer, the vendor shall disclose to the buyer in writing or by electronic means of communication, such as E-mail or an on-screen notice, the vendor's return and refund policy, the legal name under which the business is conducted and, except as provided in paragraph (3), the complete street address from which the business is actually conducted. (2) If the disclosure of the vendor's legal name and address information required by this subdivision is made by on-screen notice, all of the following shall apply: (A) The disclosure of the legal name and address information shall appear on any of the following: (i) the first screen displayed when the vendor's electronic site is accessed, (ii) on the screen on which goods or services are first offered, (iii) on the screen on which a buyer may place the order for goods or services or (iv) on the screen on which the buyer may enter payment information, such as a credit card account number. The communication of that disclosure shall not be structured to be smaller or less legible than the text of the offer of the goods or services. (B) The disclosure of the legal name and address information shall be accompanied by an adjacent statement describing how the buyer may receive the information at the buyer's E-mail address. The vendor shall provide the disclosure information to the buyer at the buyer's E-mail address within five days of receiving the buyer's request. (C) Until the vendor complies with subdivision (a) in connection with all buyers of the vendor's goods or services, the vendor shall make available to a buyer and any person or entity who may enforce this section pursuant to Section 17535 on-screen access to the information required to be disclosed under this subdivision. (3) The complete street address need not be disclosed as required by paragraph (1) if the vendor utilizes a private mailbox receiving service and all of the following conditions are met: (A) the vendor satisfies the conditions described in paragraph (2) of subdivision (b) of Section 17538.5, (B) the vendor discloses the actual street address of the private mailbox receiving service in the manner prescribed by this subdivision for the disclosure of the vendor's actual street address, and (C) the vendor and the private mailbox receiving service comply with all of the requirements of subdivisions (c) to (f), inclusive, of Section 17538.5. --- Legislative history can be found at <http://www.leginfo.ca.gov/cgi-bin/postquery?bill_number=ab_3320&sess=PREV&h ouse=B> -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

4 3

it's back up again
by cybersource＠pwrnet.com 17 Dec '03

17 Dec '03

Hi, I just wanted to take a moment and let some of the folks with whom we've participated in online discussion on the Usenet boards know that our website if finally back up! Please feel free to visit us there. Have a great New Year! The Downline Experience http://lifequest.net/tronix/ 1-800-678-5522 ext 8056 "Timing is everything... but positioning is critical!" (Larry Thompson -- Mentor to the Millionaires 1996)

1 0

Re: OCR and Machine Readable Text
by Bill Stewart 17 Dec '03

17 Dec '03

It's really embarassing to have to pay salaries of "public employees" who can't come up with better arguments than the paper/magnetic/OCR nonsense but don't have the guts to stop trying and admit they've wrong. Does the President still make $200K/year salary? You'd think he'd either read what he signs or tell his employees to only ask him to sign at least half-way credible stuff. The old regulations used to pretend that foreigners were too dumb to implement computer programs from algorithms; now they're pretending that foreigners are too dumb to type.* People used to say we have the best politicians money can buy, but you ought to be able to buy better politicians than that. At 10:31 AM 12/30/96 -0800, Tim May wrote: >And not only is OCR able these days to handle general fonts easily enough, >but almost all printed code is in fixed-width fonts, i.e., non-proportional >fonts. This makes OCR easy. The basic difference between "easily OCRed source code" and "not easily OCRed source code" is pretty much limited to two things 1) Half-decent print quality (black on white in Courier at 300dpi should do....) As Tim says, this stuff is child's play. Back when OCRs were $10,000 machines with cutting-edge 68010 processors, reading Courier was pretty easy but it helped to put in checksums; these days you don't really need that. (It also didn't like wet-process 240-dpi laser printing or faxes, but modern OCR software can generally deal with good-quality faxes and 2) Bound pages vs. loose pages (printing with perforated pages or selling the source code in loose-leaf might count as an "attractive nuisance" :-), but a band-saw can solve that problem for the OCR user unless it's printed on Tyvek or something silly :-) In the Karn case, the Feds made the silly argument that the floppy disk version had the files neatly separated, while the paper version split files between pages and had page numbers at the bottoms of the pages that weren't part of the source code. Even the $10K 68010 wonderbox could handle page headers/footers and margins, and modern software can do decent translations into different word processor formats. >For just the amount of money we've spent (in our consulting fees) on >discussing just this issue of OCRing, the entire content of the MIT PGP >source code book AND Schneier's AC could have been manually inputted by >Barbadans or Botswanas, or probably even by Europeans. There's one German university that OCRed the MIT PGP source code book. The PGP folks passed out copies of their new 3.0 Pre-Alpha and an update at a recent Cypherpunks meeting. See http://www.pgp.com/newsroom/sourcebook.cgi for ordering informaiton. It's been donated to some local libraries, such as San Jose CA, and I hope they'll send it to the Library of Congress and various non-US university and other public libraries - the recent rules change clarifying that it's ok to export source code should make this much easier. [* OK, it's not really possible to type or proofread perl code accurately :-) More to the point, OCRs aren't always real good about `backquotes' and other little blotchy marks that some languages use, and even humans don't always get them right.] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

"Onion Routing" Pipenet-like project at NRL
by Bill Stewart 17 Dec '03

17 Dec '03

http://www.itd.nrl.navy.mil/ITD/5540/projects/onion-routing/overview.html Michael G. Reed, Paul F. Syverson, and David M. Goldschlag have a bunch of papers on the Naval Research Laboratory Information Technology Division web site about Onion Routing, a pipenet-like anonymous communication system that sets up chains of encrypted IP tunnels between servers. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

EAR Doc
by John Young 17 Dec '03

17 Dec '03

We've prepared a hyperlinked version of the Export Administration Regulations (EAR) to assist analysis, evaluation and commentary on interim rules for encryption export: http://jya.com/eartoc.htm It's sobering to study the EAR and see the lethal weapons to which encryption is wed -- the most mass-murderous of high-technology calmly described as commercial warfare for the commonweal. Ponder the Commerce Control list to see the mayhem elite minds concoct.

2 1

Re: cookies
by kimkl＠calweb.com 17 Dec '03

17 Dec '03

>Return-Path: <rwright(a)adnetsol.com> >Comments: Authenticated sender is <rwright(a)adnetsol.com> >From: "Ross Wright" <rwright(a)adnetsol.com> >Organization: King Media and RW Marketing >To: kimkl(a)calweb.com (Kimberly Leahy) >Date: Wed, 1 Jan 1997 23:01:11 -0800 >Subject: Re: cookies >Priority: normal >X-UIDL: f3b0b16d616765cf37b9c5fa5150407f > >Send an inquiry to cypherpunks(a)toad.com You will get many >informative answers! >I be looking for your inquiry, I read that list also! > >On or About 1 Jan 97 at 21:55, Kimberly Leahy wrote: > >> Rossta, >> please enlighten on cookies that invade a browser's >> computer. where can i get more info? i was told that >> a utility is available to track and/or crush cookies. >> can you tell me where to get it or get info on such a >> thing? >> hopefully, >> kimmer >> >> > >=-=-=-=-=-=- >Ross Wright >King Media: Bulk Sales of Software Media and Duplication Services >http://www.slip.net/~cdr/kingmedia >Voice: 415-206-9906 > Cypherpunks, would you please send me infor or direct to a location where I may acquire information of these "cookies"? Thank You Ever So Much.

1 0

Cypherpunk Elitism and Spam Filters
by Alan Olsen 17 Dec '03

17 Dec '03

I have been watching the debate on Cypherpunk Extremism, filtering spam, and the like and have a few comments. When Tim May claims that Cypherpunk solutions lead to elitism, he is more correct than Vullis or any of his ilk are willing to realize. The reasons for this are out of implementation, not out of any ill-will or evil intent. It is because it requires special knowledge and/or software to be able to implement the "solution(s)". (Note that I am only aware of his comments through quotes of his material. I have blocked him at the procmail level, so I cannot go back through trash and read the originals. Probably a good thing, as it keeps me from sinking to the level of flames and personal attacks. Attention Vullis revels in...) I have watched the conversations on filtering and have seen few, if any, methods that would be usable by a poster of average experience without alot of extra frustration and/or time involved. For a filtering or posting method to be useful (or used), it has to be uncumbersome to use, no matter the platform. Charging for posting is not (in my opinion) a good method because conversions from real cash to e-cash are not very easy and/or available at this time. It would leave the posting to the "elite" who have connections to e-cash acceptable to the list management. Tokens are nice, but most plans for them make it a pain to post with any sort of e-mail software. (Cut and pasting a token will work for one or two sites, but if a user posts to many lists, keeping track of all those tokens could become quite a pain. There is also the risk of people posting their tokens for general use or the token being used to track anonymous posters. PGP signatures are a solution, but not a very adequate one at this point. Most autosign software has one or two minor problems. The first is that they do not line wrap before signing the text. This causes the sig to break. The second thing that people get bitten by is that some signing software only takes the "default" key. This means that, without special effort, they are stuck with one key to use for signing. (Which makes anon postings a bit of a pain.) The reason anon.penet.fi became as popular as it did is because it was easier to use than the alternatives. A solution that is difficult to use will be left to an "elite" to use. (If used at all.) A good example of this is the PGP aware version of Majordomo. The traffic on one list using that software is little to none. I believe that this is because the "ante" to post is too high. (It also has strange desires for specific linefeed formats, as well as other things that make posting a chore.) The "solution" to this is to design tools that make use of these things usable, not only for the "elite", but for the rest of the user community. (Or at least the upper 70-90%. There has to be some level of knowledge for entry into the game. The difficulty is knowing where to set that "bar".) Netscape is a good example of "transparent" crypto. It has problems though. How many sites do you connect to that use SSL? Damn few I will bet. How many encrypt everything, not just the "important stuff". Next to none. Why? Getting a secure server costs a fair chunk of change. It is possible to get one for "non-commercial use", but it is still going to cost you a bit for the certificate needed to run the server. ($295 bucks and the list of hoop to jump through. Verisign usually wants you to be a corporate entity.) Any chance of a CPunk CA coming into existence any time soon? A better chance for "transparent" security is with the IPSec FreeSwan project. How many of you out there are willing to put in the effort to get it to work though? It does have a pretty high cost in knowledge and effort. (It also seems to have some places that need work. Non-Unix clients and sites feeding off of dynamic IPs are going to be a future hurdle.) It does have probability of making things a whole lot more difficult for the busybodies at the various TLAs. (The NSA krill nets will no longer be as effective.) Until the bugs are worked out, it will be an "elitist" solution. There is no escaping that. (And since there are people who would rather concentrate on personal feuds instead of technical hurdles, it will probably remain one for alot longer.) I would like to see alot less of the "elitist" solutions. My reasons are very plain. Elitist solutions take far too much of my time to use. They do not have to be that way. There are Cypherpunks doing work to make these tools more usable. Most of them are doing it in the background and not looking for the "glory". Because of the self-centered ranting of a few, most of those who were the strongest supporters of "Cypherpunk goals" no longer associate with the list. The ones who have my highest respect are those that have actually done something to accomplish those goals, instead of writing (semi-)anonymous flames and personal attacks against Tim May and/or John Gilmore. (I sometime what Vullis has done to promote privacy and security for individuals. His pissing in the list pool certainly has done nothing positive that I have seen.) [Note that I do not always agree with Tim May. There have been many time I have read his posts and wondered if he was indulging in chemical recreation. (And he has probably wondered the same about some of my posts. probably about this one...) Sometimes he is dead on and well worth reading. But his posts are at least thought out and lack the most of the vitriol that some others on this list have been spitting. Part of the problem with reputation schemes is that humans are not always consistent. Sometimes they do not fit into the "yes" or "no" boxes we try and stuff them into.] Those who are working towards "elitist" solutions are at least working towards solutions. I think people need to ask themselves what goals they desire for themselves and what it will take to get there. You don't need to write code necessarily, but you do need to do something other than just bitch and moan. What have you done to support privacy today? --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

4 3

Re: OCR and Machine Readable Text
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:06 PM 1/2/97 -0800, Bill Stewart wrote: >It's really embarassing to have to pay salaries of "public employees" >who can't come up with better arguments than the paper/magnetic/OCR nonsense >but don't have the guts to stop trying and admit they've wrong. >Does the President still make $200K/year salary? You'd think he'd either >read what he signs or tell his employees to only ask him to sign >at least half-way credible stuff. The old regulations used to pretend that >foreigners were too dumb to implement computer programs from algorithms; >now they're pretending that foreigners are too dumb to type.* >People used to say we have the best politicians money can buy, >but you ought to be able to buy better politicians than that. Or beter excuses. >At 10:31 AM 12/30/96 -0800, Tim May wrote: >>And not only is OCR able these days to handle general fonts easily enough, >>but almost all printed code is in fixed-width fonts, i.e., non-proportional >>fonts. This makes OCR easy. > >The basic difference between "easily OCRed source code" and "not easily >OCRed source code" is pretty much limited to two things >1) Half-decent print quality (black on white in Courier at 300dpi should do....) > As Tim says, this stuff is child's play. Back when OCRs were > $10,000 machines with cutting-edge 68010 processors, > reading Courier was pretty easy but it helped to put in checksums; > these days you don't really need that. (It also didn't like > wet-process 240-dpi laser printing or faxes, but modern OCR software > can generally deal with good-quality faxes and >2) Bound pages vs. loose pages (printing with perforated pages > or selling the source code in loose-leaf might count as an > "attractive nuisance" :-), but a band-saw can solve that problem > for the OCR user unless it's printed on Tyvek or something silly :-) Even an exacto-knife would work. For proportional fonts it depends on how nasty the kerning gets and the shape of the characters. (And a san serif font without too many kerning pairs should go though fine.) The technology for this has progressed quite a bit in the last few years. Next thing you know, OCR software will be export controlled as well. (Or they will require something silly, like having all code samples in caligraphy fonts.) >In the Karn case, the Feds made the silly argument that the >floppy disk version had the files neatly separated, while the >paper version split files between pages and had page numbers at the >bottoms of the pages that weren't part of the source code. >Even the $10K 68010 wonderbox could handle page headers/footers and margins, >and modern software can do decent translations into different >word processor formats. And even if it didn't, just selecting and deleting the margin areas would not be all that difficult. (Ooohhh... A couple of extra hours is really going to slow someone down.) >>For just the amount of money we've spent (in our consulting fees) on >>discussing just this issue of OCRing, the entire content of the MIT PGP >>source code book AND Schneier's AC could have been manually inputted by >>Barbadans or Botswanas, or probably even by Europeans. I used to work for a company that would transfer entire archives of medical journals. Much of it we would just OCR. Some of it we would send off shore. The OCR software was about 95% reliable and this was over 5 years ago. (And we were using 286 boxes for much of the OCR work. Not a heavy technoligical investment.) I am sure that things have improved a great deal since then. (My new scanner included OCR software. I will have to run a test and report the findings. >There's one German university that OCRed the MIT PGP source code book. >The PGP folks passed out copies of their new 3.0 Pre-Alpha and an update >at a recent Cypherpunks meeting. See >http://www.pgp.com/newsroom/sourcebook.cgi >for ordering informaiton. It's been donated to some local libraries, >such as San Jose CA, and I hope they'll send it to the Library of Congress >and various non-US university and other public libraries - the recent >rules change clarifying that it's ok to export source code should make >this much easier. The page listed does not contain order information. Do you know costs and/or order info? >[* OK, it's not really possible to type or proofread perl code accurately :-) Yeah, just look at what happened with John Orwant's _Perl 5 interactive Course_. The book is being recalled due to all the typographical errors from the pubisher. Reading some Perl code is also quite impossible. (For the reasons behind this, i recommend Charlie Stross's article on the tpoic on page 36 of _The Perl Journal_ #4.) >More to the point, OCRs aren't always real good about `backquotes' and other >little blotchy marks that some languages use, and even humans don't always >get them right.] Many character sets are not very good at displaying "little used" characters clearly. (Some of the cheaper fonts do not even include them.) Backticks are a special problem. The latest Camel book has all sorts of problems with hard to recognise backticks. BTW, there is an article on Perl and randomness in The Perl Journal #4 by John Orwant. Pretty basic for most Cypherpunks, but good reading none the less... --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

6 5

[IMPORTANT] One-time pads
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Timmy Maya styles his facial hair to look more like pubic hair. _ >@) Timmy Maya (V(_ ^^\<

1 0

Re: Crypto reg clarification from Commerce Department
by Bill Stewart 17 Dec '03

17 Dec '03

http://jya.com/bxa123096.txt has the Federal Register text of the interim export administration rules. I haven't waded through all the comparisons of which interim amends what paragraph of what subplot of the revised prohibitions, etc., but there's one paragraph that may be relevant to the SWAN project. "This interim rule also amends part 744 to add a general prohibition in Sec. 744.9 with respect to technical assistance in the development or manufacture abroad of encryption commodities and software controlled for EI reasons and makes conforming changes throughout the EAR." Lucky Green has been talking with Commerce to try to get clarification of some of the requirements on a related issue; they say not to worry about some of the paragraphs because they only apply to missiles, nukes, and similar Real Munitions, but the paragraph above sounds like it's still talking about crypto. I'm not sure if "technical assistance" is clearly defined, and I'm not sure if hiring some foreigner to build something for _you_ counts as providing technical assistance to _them_, but it makes it more difficult to do the right thing while debugging non-US systems. Excerpts from Lucky's post: >From: Lucky Green <shamrock(a)netcom.com> >Subject: Crypto reg clarification from Commerce Department >Date: Mon, 30 Dec 1996 15:14:56 -0800 >To: cypherpunks(a)toad.com >.... >I just got of the phone with Bruce Kutz, Export Policy Analyst, Office of >Strategic Trade and Foreign Policy Controls. (202) 482-0092. He seems to be >the contact person for the new regs. > >I pointed Mr. Kutz to the section that alarmed me: >Sec. 736.2 General prohibitions and determination of applicability. [stuff you can't do about financing, supporting, proliferation etc.] >Mr. Kutz seemed surprised. Apparently he had not been aware that this >section was included in the new crypto regs. He then assured me that >1. Proliferation in the context of this paragraph applies only to >proliferation of >a) nuclear (bomb) technology b) missile technology ... >2. The Department of Commerce has no intention of banning the financing and >contracting of non-US crypto development. >3. Technical assistance to non-US parties requires a license. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

How to Reach The Most People
by staff＠optimalmethods.com 17 Dec '03

17 Dec '03

Targeted E-Mail Lists Will Get Your Message Out You probably have a special offer to make to many people over the internet. At ATS Publishers, Inc., we maintain a database of over 450 groups of e-mail addresses sorted according to the groups' demographic, psychographic, geographic, benefits-sought, and individual description. If you have a book, product, announcement, or service to advertise in a specific area, your greatest response rates will come from targeting these niche lists. You must have these addresses, as you will save money while no longer mailing your sales message to unqualified prospects. We absolutely guarantee your success with these lists. Here is a small sample: Opportunity Seekers, General Business, Sports (all), Entrepreneurship, Fitness & Exercise, Accountants, Health, Lawyers & Legal, Nutrition, Single Moms, Fashion, Outdoors, Dresswear, Computers, Math & Sciences (all), Finance, Investing, Fishing, Hunting, Hunting Dogs, Financial Markets, Race Boats, Wealth, Taxes, Languages, Millionaires, Divorced Parents, Gay & Lesbian, Kids, Teenagers, Adults, Seniors, Racial-Ethnic-Cultural (all), Criminal, Pornography, Shopaholics, Alcoholics, Virgins, Politics, Overweight, Paranormal, Psychology, Literature, Technical, Painters & Artists, Doctors & Medicine, Religion & Atheism, Government, Taxation, Food and Beverages, Wines & Spirits, Restaurants, Working Women, Geographical U.S., Sex, Physically Challenged Persons, Drugs, Hippies, Music and Musicians, Firearms, Militias, Students, AIDS, Disorders, Child & Baby Care, Feminists, Body Painting & Piercing, Massage, Activists, Homeowners, Real Estate, Automotive, Health Care, Insurance, Educa! tion, Infertility, Architects, Dating, Love, Telecommunications, Hardware & Tools, Homes & Gardening, S&M, Housekeeping, Spirits & Wines, Home Business, Star Trekkies, Athletes, Authors, Store Owners, Job Hunters, Photography, Plants, and another 350 groups targeted even further... If you do not see your group in these listings, don't worry! Even if they are not in our database, we will create one for you within 24 hours. Here's how to order: Write us a brief description of the groups you want to target. We will then ship you, via e-mail, a listing of the 1,000 - 5,000 most targeted prospects for your product. These are people who have PROVEN beyond any doubt that they are interested in the service you are offering. Each e-mail listing of 1000 names costs only $12.95. And although $12.95 is our minimum order, you may buy in odd lots also, say, 1,500. Each additional name after 1,000 costs only 1/2 of a cent; in this 1,500 name case, you would pay only $15.45! For 2,000 names,you would pay $12.95 plus an extra $5 (1,000 X .5 cents) for a total of $17.95. All orders are shipped via e-mail the same day, if paid by credit card (Amex/Visa/Mastercard/Diners). Or, mail your check or M.O., in the amount of $12.95 plus any additional charges, along with your groups' description, to: ATS Publishers, Inc. 3811 Ditmars Blvd. Astoria, NY 11105 Tel: (718) 274-9060 If the line is busy, keep trying! We're trying to keep up with the enormous demand, since Thursday the 26th, our first mailing. Thank you so much for your time.

1 0

Security & Hackerscene site
by Markus H|bner 17 Dec '03

17 Dec '03

During the last days the site "Security & Hackerscene" has been expanded. New sections specialized on intrusion detection, IP-spoofing, ... will help you to protect your site from break-ins and will give you an insight into the latest methods and tricks used by hackers to break into obvious secure computers. Furthermore many CERT advisories and other security related text files were redesigned and are now available in HTML format. You will also find links to the best information resources (files, e-zines, texts) on the net regarding Internet-Security. URL of the "Security & Hackerscene" site: -------------------------------------------------------------- http://www.geocities.com/capecanaveral/3498/security.htm -------------------------------------------------------------- Some of the items you will find: + IP-spoofing demystified + Intrusion Detection Checklist + CGI Security Holes + How hackers cover their tracks + Compromise FAQ + Protecting Yourself from Password File Attacks + The Ultimate Sendmail Hole List + An Architectural Overview of UNIX Network Security + Essential Security Information + UNIX Backdoors + UNIX System Security Issues + Tips for Improving Your Security + as well as files commonly found in the underground scene. I would be glad to receive your feedback. Markus H|bner ====================================================================== E-Mail: matic(a)bau2.uibk.ac.at WWW: http://bau2.uibk.ac.at/matic Working as a freelance WEB-programmer and security-consultant.

1 0

How to Reach The Most People
by iwlkos＠ix.netcom.com 17 Dec '03

17 Dec '03

Targeted E-Mail Lists Will Get Your Message Out You probably have a special offer to make to many people over the internet. At ATS Publishers, Inc., we maintain a database of over 450 groups of e-mail addresses sorted according to the groups' demographic, psychographic, geographic, benefits-sought, and individual description. If you have a book, product, announcement, or service to advertise in a specific area, your greatest response rates will come from targeting these niche lists. You must have these addresses, as you will save money while no longer mailing your sales message to unqualified prospects. We absolutely guarantee your success with these lists. Here is a small sample: Opportunity Seekers, General Business, Sports (all), Entrepreneurship, Fitness & Exercise, Accountants, Health, Lawyers & Legal, Nutrition, Single Moms, Fashion, Outdoors, Dresswear, Computers, Math & Sciences (all), Finance, Investing, Fishing, Hunting, Hunting Dogs, Financial Markets, Race Boats, Wealth, Taxes, Languages, Millionaires, Divorced Parents, Gay & Lesbian, Kids, Teenagers, Adults, Seniors, Racial-Ethnic-Cultural (all), Criminal, Pornography, Shopaholics, Alcoholics, Virgins, Politics, Overweight, Paranormal, Psychology, Literature, Technical, Painters & Artists, Doctors & Medicine, Religion & Atheism, Government, Taxation, Food and Beverages, Wines & Spirits, Restaurants, Working Women, Geographical U.S., Sex, Physically Challenged Persons, Drugs, Hippies, Music and Musicians, Firearms, Militias, Students, AIDS, Disorders, Child & Baby Care, Feminists, Body Painting & Piercing, Massage, Activists, Homeowners, Real Estate, Automotive, Health Care, Insurance, Educa! tion, Infertility, Architects, Dating, Love, Telecommunications, Hardware & Tools, Homes & Gardening, S&M, Housekeeping, Spirits & Wines, Home Business, Star Trekkies, Athletes, Authors, Store Owners, Job Hunters, Photography, Plants, and another 350 groups targeted even further... If you do not see your group in these listings, don't worry! Even if they are not in our database, we will create one for you within 24 hours. Here's how to order: Write us a brief description of the groups you want to target. We will then ship you, via e-mail, a listing of the 1,000 - 5,000 most targeted prospects for your product. These are people who have PROVEN beyond any doubt that they are interested in the service you are offering. Each e-mail listing of 1000 names costs only $12.95. And although $12.95 is our minimum order, you may buy in odd lots also, say, 1,500. Each additional name after 1,000 costs only 1/2 of a cent; in this 1,500 name case, you would pay only $15.45! For 2,000 names,you would pay $12.95 plus an extra $5 (1,000 X .5 cents) for a total of $17.95. All orders are shipped via e-mail the same day, if paid by credit card (Amex/Visa/Mastercard/Diners). Or, mail your check or M.O., in the amount of $12.95 plus any additional charges, along with your groups' description, to: ATS Publishers, Inc. 3811 Ditmars Blvd. Astoria, NY 11105 Tel: (718) 274-9060 If the line is busy, keep trying! We're trying to keep up with the enormous demand, since Thursday the 26th, our first mailing. Thank you so much for your time.

1 0

yawn
by ·Acid.Rain· 17 Dec '03

17 Dec '03

Someone please tell be what i must do to be banned from this list. I will refrain from describing the obvious idiocracy here. ----==······· ·Acid.Rain· ·······==--- http://www.scott.net/~acidrain/

2 1

Re: Crypto reg clarification from Commerce Department
by Richard L. Field 17 Dec '03

17 Dec '03

To follow up on Lucky Green's conversation with Bruce Kutz on Sec. 736.2: The General Prohibitions (1 - 10) in the EAR preexisted these new crypto regs. What was changed in General Prohibition Seven (which previously applied only to nuke and missile technologies) was the addition of a subpart (ii): "You may not, without a license from BXA, provide certain technical assistance to foreign persons with respect to encryption items, as described in Sec 744.9 of the EAR." Sec. 744.9 is a new addition. It says: "(a) General prohibition. No U.S. person may, without a license from BXA, provide technical assistance (including training) to foreign persons with the intent to aid a foreign person in the development or manufacture outside the United States of encryption commodities and software that, if of United States origin, would be controlled for "EI" reasons under ECCN 5A002 or 5D002. [...] Note in addition that the mere teaching or discussion of information about cryptography, including, for example, in an academic setting, by itself would not establish the intent described in this section, even where foreign persons are present." [...] When it comes to financing and contracting, it's General Prohibition Ten you ought to be looking at. That hasn't changed under the new rules and it doesn't just apply to nukes and missiles. It says: "Sec. 736.2(b)(10) General Prohibition Ten -- Proceeding with transactions with knowledge that a violation has occurred or is about to occur (Knowledge Violation to Occur). You may not sell, transfer, export, reexport, finance, order, buy, remove, conceal, store, use, loan, dispose of, transfer, transport, forward, or otherwise service, in whole or in part, any item subject to the EAR and exported or to be exported with knowledge that a violation of the Export Administration Regulations, the Export Administration Act or any order, license, License Exception, or other authorization issued thereunder has occurred, is about to occur, or is intended to occur in connection with the item. Nor may you rely upon any license or License Exception after notice to you of the suspension or revocation of that license or exception. There are no License Exceptions to this General Prohibition Ten in part 740 of the EAR." Furthermore, in the Violations section (Sec. 764.2) it says: "(b) Causing, aiding, or abetting a violation. No person may cause or aid, abet, counsel, command, induce, procure, or permit the doing of any act prohibited, or the omission of any act required, by the EAA, the EAR, or any order, license or authorization issued thereunder." "(e) Acting with knowledge of a violation. No person may order, buy, remove, conceal, store, use, sell, loan, dispose of, transfer, finance, forward, or otherwise service, in whole or in part, any item exported or to be exported from the United States, or that is otherwise subject to the EAR, with knowledge that a violation of the EAA, the EAR, or any order, license or authorization issued thereunder, has occurred, is about to occur, or is intended to occur in connection with the item." In the past, some banks worried about this when financing letters of credit. I'm told they were assured back then that this sort of financing was not going to be prosecuted....but it's still in the regs so I wouldn't bet the ranch on it never happening. - Richard Field

1 0

E-commerce Spying
by John Young 17 Dec '03

17 Dec '03

MSNBC today features E-commerce: http://www.msnbc.com/news/46897.asp With sidebars on how E-payment systems require money-tracking spies. In the cause of consumer security, at the cost of privacy. Kalliste reported yesterday on the White House's spying on global bank transactions: http://www.aci.net/kalliste/ In the cause of national security, at the cost of privacy. Defense into commerce, GAK privatized.

1 0

Modified Token Posting Scheme
by ph＠netcom.com 17 Dec '03

17 Dec '03

The proposal to limit "noise" posts by using re-usable tokens is interesting because it has the effect of filtering and at the same time remains responsive because the "moderator" passes judgement after posting has occurred. In essence, the poster is betting that the moderator will approve the post retroactively. The purpose of limiting the tokens available is to give them value so that there is a cost associated with losing the bet. However, distribution of the tokens has the same problems that centrally planned economies have distributing bread. Should people wait in line, receive bread at random, or get their bread through connections? None of these solutions is attractive. The right way to implement the scheme is to use dollars for tokens because the USG has already solved the problem of giving the tokens value. The "moderator" returns the money to people when posts are worthwhile and keeps it otherwise. This means that the "bet" can be quite a bit larger than a dollar because responsible posters will get their money back. Starving graduate students will not be discouraged from posting. Abusive posters, anonymous posters, or spam artists will have to pay a substantial fee for the privilege. Of course, there's no reason to have just one moderator on the list. A moderator could just be an e-mail account that forwards mail to the list if valid payment is received. (Moderators should PGP sign their messages so mail forging won't work.) Readers could filter on which moderators have approved the kinds of posts they want to read. The effect of this scheme is to allow newcomers, infrequent posters, or anonymous posters to get through killfiles without taking the time and effort to develop a reputation. Peter Hendrickson ph(a)netcom.com

2 1

The Credit Nard Network
by zvi 17 Dec '03

17 Dec '03

Hello: I wanted to folow up on your interest in Credit Card Network which you inquired about recently. My Name is Zvi Lichter, and I am the Internet Sales Manager for Credit Card Network. I have been representing Credit Card Network for over 6 months and I can help you to get the information you need to make your decision to sign up for our service. We are the solution you have been looking for. We authorize credit card transactions in realtime in less than 45 seconds. By linking your order form to our secure system we can provide you with approval/denial response in just a few seconds. We have over 240 active merchants and we are processing in excess of 20,000 transaction a day. More details can be found at : http://www.creditnet.com/cgi-bin/htmlscript?zvika.hts come visit and look up all the links. Prices: 1% on the transaction, one time set up fee of $395. No minimums or monthly service fees. ======================= SECURE ONLINE CREDIT CARD AUTHORIZATION The Credit Card Network offers secure, online credit card authorizations to internet businesses who are interested in actually making money on the internet. The service allows businesses to accept credit card payment on the internet in real time...meaning that the transaction is actually taking place while the consumer is online. This is how it looks from a consumers point of view... 1. The consumer fills out the order form on your website and gets a total price. 2. Upon clicking the consumer is then hot-linked into our secure server and our secure page comes up on his screen. The consumer then enters his credit card number and clicks on submit to charge the card. The information including total price, credit card number, name, and address is then electronically sent to the card processor at the bank. The consumer waits 10-15 seconds while the card is verified. 3. The consumer is then sent back to your website to the page where you want us to send him. It's that simple. 1.your order form ---> 2. our secure page ---> 3. back to your website We also support transparent processing. In this mode the customer stays on your order form and the credit card information is sent to Credit Card Network using sockets and PGP encryption. The result is returned in seconds. Then you can send the customer anywhere you choose and have full control over the memory variables. We have a module that automatically updates your password files with userids, passwords and expiration dates. We provide you with an expire routine that runs every 30 seconds. We also have scripts for one-time software downloads. Credit Card Network has been in business for 2 years. We have more merchants than Cybercash and we are easy to work with and pride ourselves on our customer service. If you are ready to make money on the Internet then Credit Card Network is the solution you need to be successful. The credit card network zvi(a)creditnet.com 1-206-287-1794 voice 1-206-933-1141 fax

1 0

invitation
by fgle＠sun1.uconect.net 17 Dec '03

17 Dec '03

Fuck_God_Up_The_Ass, A Web-based network of manufacturers, inventors, distributors, importers and exporters--can bring you together with companies interested in licensing and/or distributing manufactured products. The Exchange can help you: -Add dollars to your bottom line with no risk or capital outlay. -Get into foreign markets quickly. -Connect you with local and foreign business partners. Here's how it works: We post a description and photo of your products, design or service on the Exchange web site, where it will be seen by members in more than 56 nations. We collect inquiries and make the introductions. You, of course, retain complete control over any negotiations, and it's up to you to decide whether to go forward with a potential partner. Membership on the Exchange is free. To post a product, we ask for nothing up front, with a small fee only if you successfully conclude an agreement. This is an introductory offer where we defer the product web page construction and hosting cost until you achieve success. We're excited about this new Web-based marketing tool, and the response has been unusally strong. Among the individuals who participated in our 20-week test, 73% are in active negotiations with potential partners! For more detailed information about our free membership registration, just reply to this message and insert "info" in the Subject. We will email all the details. Douglas Cymbala Membership Department

1 0

Anonymous Remailer at DHP.com
by Jill014＠aol.com 17 Dec '03

17 Dec '03

In a message dated 97-01-01 18:55:24 EST, lucifer(a)dhp.com (Anonymous) writes: > Subj: Re: Anonymous Post Control > Date: 97-01-01 18:55:24 EST > From: lucifer(a)dhp.com (Anonymous) > Sender: owner-cypherpunks(a)toad.com > To: cypherpunks(a)toad.com > > ph(a)netcom.com (Peter Hendrickson) writes: > > > It's hard to filter anonymous posters. I want to see what a few > > of them have to say so I can't filter on the remailers. > > > > If anonymous posters PGP sign their posts, it is still hard to filter > > using a lame filter software such as that which comes to Eudora. > > Anonymous users willing to PGP sign their posts could just use a > service like nym.alias.net (mailto:help@nym.alias.net), which even > allows pseudonyms to advertise their PGP keys via finger (slightly > better than the PGP key servers). > > When people post anonymously rather than pseudonymously, it is > generally because they don't want a blatant link between all of their > posts (though obviously analysis of writing style is still possible). > But why do you always use the anonymous remailer from DHP.com? Why do you not use other places? JIll > > > ----------------------- Headers -------------------------------- > From cypherpunks-errors(a)toad.com Wed Jan 1 18:54:40 1997 > Return-Path: cypherpunks-errors(a)toad.com > Received: from toad.com (toad.com [140.174.2.1]) by emin08.mail.aol.com (8.6. > 12/8.6.12) with ESMTP id SAA26357; Wed, 1 Jan 1997 18:54:38 -0500 > Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id OAA12907 > for cypherpunks-outgoing; Wed, 1 Jan 1997 14:25:53 -0800 (PST) > Received: from dhp.com (dhp.com [199.245.105.1]) by toad.com (8.7.5/8.7.3) > with ESMTP id OAA12894 for <cypherpunks(a)toad.com>; Wed, 1 Jan 1997 14:25:06 - > 0800 (PST) > Received: (from lucifer@localhost) by dhp.com (8.8.4/8.6.12) id RAA17460 for > cypherpunks(a)toad.com; Wed, 1 Jan 1997 17:25:01 -0500 > Date: Wed, 1 Jan 1997 17:25:01 -0500 > Message-Id: <199701012225.RAA17460(a)dhp.com> > X-Authentication-Warning: dhp.com: lucifer set sender to lucifer(a)dhp.com > using -f > To: cypherpunks(a)toad.com > From: lucifer(a)dhp.com (Anonymous) > Comments: Please report misuse of this automated remailing service to < > lucifer(a)dhp.com>. > References: <v02140b0caeef4ce75c72(a)[192.0.2.1]> > Subject: Re: Anonymous Post Control > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk >

2 1

Re: yawn
by BJORN2LUZE＠prodigy.com 17 Dec '03

17 Dec '03

>> Someone please tell be what i must do to be banned from this list. I wil= >l >> refrain from describing the obvious idiocracy here. =20 >>=20 >Just who the fuck is this Acid rain guy, a newbie? If he is... FLOOD HIS MAIL BOX. - Goto: http://pages.prodigy. com/fifthnail/newbie.wav to download a kewlio WAV file.. it goes a little bit like this: 'Do I smell newbie?.. < guns start to fire... and he laughs >' it's a kewl wav file from the place where I found out how to get on this mailing list. http://pages.prodigy.com/fifthnail/maillist.htm GET ON MORE MAILING LIST! if you want to there are a ton more! >Doesn't this stupid bastard know that he is writing >to two different lists, and not just one? I donno. >>=20 >> ----=3D=3D=B7=B7=B7=B7=B7=B7=B7 =B7Acid.Rain=B7 =B7=B7=B7=B7=B7=B7=B7=3D= =3D--- >> http://www.scott.net/~acidrain/ >>=20 What a geek. >Dave, how the fuck did this acid rain asshole=20 >get on the Freedom Knights list? Mus' be on crank, you think? Whad'a cyber geek- TRASH HIM. Nail

1 0

Increasing dangers facing journalists who 'name the bad guys'
by Butler, Anthony 17 Dec '03

17 Dec '03

DISCUSSION Increasing dangers should not deter journalists from 'naming the bad guys' TOPIC: "Frontlines and Deadlines: A View from the War Zones" SPEAKER Robert Fisk, correspondent, The Independent When John Owen first called me in Beirut and asked me to talk to you this morning about journalists under fire, several names immediately came to mind because they are colleagues and friends who proved how easy it is for a journalist to die in the Middle East: Bob Pfeffer, Larry Buchman, Sean Toolin, Clark Todd, Tewfig Ghazali and Bahij Metni. Bob Pfeffer worked for Stern and was investigating Palestinian gun-running when four members of the Popular Front for the Liberation of Palestine murdered him with automatic rifle fire outside the door of his home. Sean filed for The London Observer and was killed when two men, probably Palestinians, stabbed him to death by hitting him in the face with an ice pick on Abdul-Aziz Street, not far from my home. Clark stayed in the Druze village as the Phalange militia closed in on it, took a piece of shrapnel in the chest, wrote a last message to his wife on the pillowcase, and -- if one of the villagers I spoke to is to be believed -- was finished off by a Phalangist militiaman who shot him to death as he lay wounded on a sofa. Tewfig and Bahij were CBS cameramen blown, quite literally, to pieces by an Israeli tank shell which was fired, so the Israelis claimed, at what they called "terrorists." But I never imagined, when I originally wrote these first words for this talk, that I would find myself offering the name of another reporter who should have been sitting with us here this morning -- that of Veronica Guerin -- savagely murdered by hit men for a Dublin mafia boss. I worked in Ireland for five years and no man or woman there, back in the '70s, would ever kill a journalist. As one of Veronica's Irish colleagues said to me last night, "Everything has changed now. If it can happen once, it can happen again." A journalist, a mother, a great writer -- murdered because she had the guts to tell the truth. And the journalists who gather for Veronica's funeral tomorrow morning will feel anger and rage and pity and -- let us forgive them, for it applies to all of us when our colleagues die -- a little fear as well. In Algeria, almost 50 journalists have been killed, almost all of them working in the local press -- deliberately, grotesquely, their heads often severed from their backbones by men who call themselves Islamists, and who claimed the journalists worked for the military-backed government, even though some of those journalists had been imprisoned by that same government. My French colleague, Olivier Quemener, gave me a cheerful farewell in the Al Djezair hotel in Algiers a couple of years ago. He was off to the Casbah to film, he said. I was going to the Kouba district of the city. When I returned to our hotel, Quemener was dead -- shot in the chest and killed by a man who claimed he was an Islamist. His reporter, gravely wounded, was found lying, weeping beside his friend's body. In Bosnia, the cull of reporters and photographers and cameramen reached such proportions that we started armoring ourselves -- strapping 14 kilos of steel to our chests and backs and then curling ourselves into the bosoms of armored cars. A few weeks in Sarajevo and I realized why medieval knights had to be winched onto their horses by cranes. Running was so exhausting that I scarcely had the energy to file a report; the danger, so awful, that I was almost too frightened to perform the physical act of writing. We ask ourselves, of course, why we do it. Those of us who do not die find our own reasons. In a world of deceit, I believe we are among the few independent witnesses to history and to its wickedness. And although the risks are increasing as the old traditional protection bestowed upon journalists decays, I still believe we should be out there, naming the bad guys. In other words, I still think the risks are worth taking. But I use the word "think," and let me tell you why: Because weaponry is growing more sophisticated in the science of killing. Because we are not always supported by those who should wish to protect us but (who) instead ignore our requests for help or curse us for our attempt to tell the truth. Because journalists are being verbally targeted ever more assiduously by governments and pressure groups who wish to demean our work and prove that the risks we take are worthless. This may not be the message you expected to hear from me this morning, so let me, from my own experience, be more precise. Let's start with the weaponry. This is a tiny steel arrow. It was one of hundreds of equally tiny steel arrows packed into an Israeli tank shell that killed five civilians near the Lebanese town of Nabatea a couple of years ago. The shell is proximity-fused, timed to explode above the ground and turn any human beneath it to meat. These shells have been fired frequently over southern Lebanon. Since the danger of kidnapping by the Hezbollah (has subsided), these are my greatest fear and my greatest nightmare. And here is part of an aerial bomb dropped close to a U.N. convoy in which I was traveling in April, just a tiny bit of shrapnel that hissed over us, red-hot enough to sever a head or two. During that same Israeli offensive last April, set off when Hezbollah guerrillas fired Katyusha rockets into Israel after the killing of a Lebanese village boy by a bomb -- for which the Hezbollah claimed the Israelis were responsible and the Israelis said they were not -- Israeli gunboats shelled the coast road on which all of us journalists have to travel between Beirut and southern Lebanon. They were shooting, they said, at terrorists. Two American reporters and a British journalist asked their editors to make a demarche to the Israeli embassies in London and in Washington to protest the risk of death that their reporters were running at the hands of the Israelis in order to get the story. The British editor, not, I should add, my editor, declined to approach the Israelis because he said he didn't see the point. Both American editors refused to complain on their reporters' behalf because they said it would make no difference. In the end, it was we journalists in the field who had to discover that the Israeli gunboats cannot penetrate rain or fog with their radar. Thus, it was the pre-dawn mist off the sea and the decision to drive in rain squalls -- not editors -- which helped to save us. Now, I'll refer briefly to my paper, The Independent, which has loyally defended me and stood by my stories over many years. On the day of the Qana massacre, I spent seven hours under Israeli fire, had air strikes 250 meters from my location on three occasions and ended the day walking in the blood of a hundred dead refugees. Most of the letters from Independent readers thanked me for trying to tell how it was. Others did not. Let me quote from one of these. "I do not like or admire anti-Semites. Hitler was one of the most famous in recent history. You are a disgrace to a profession that should report the news." Nor should you believe that this kind of slander comes from those who support Israel, right or wrong. When I reported on Egypt's deeply flawed elections last year and investigated systematic torture and human rights abuses by the Egyptian State Security Police, I was attacked in Egypt's most prestigious newspaper, Al Ahram, by the columnist Abdul Aziz Ramadan. I was guilty, he said, of "spreading lies and deceit." I was "discredited," a "spiteful liar," a "fake," a "black crow pecking at the corpse of Egypt." And, after I investigated torture in the state security police headquarters in Bahrain -- a headquarters run, by the way, by a British former Special Branch officer called Ian Henderson -- the Bahrain newspaper, Akbar al-Khaleej, portrayed me in a cartoon, along with two colleagues -- Simon Ingram of the BBC and Christopher Walker of The Times -- as a rabid dog, straining on what was labeled a Murdoch/Maxwell leash, in my attempt to get my teeth into a bag of cash. Humorous enough, you might think. Certainly nothing to worry a hard-skinned reporter. True, but in the Arab world, a dog -- a kelb -- is something dirty. There is a word, najis in Arabic, dirty like a dog. A dog is an animal scarcely worthy of life, certainly not one whose life should be protected. And rabid dogs should be put down, exterminated. Lastly, a more disturbing example of the reason why I say I "think," rather than I "believe," about the risks we take. In 1993, I made three films with director Michael Dutfield called "Beirut to Bosnia" -- in Lebanon, Gaza, Israel, Egypt and Bosnia itself. They were made for Channel 4 in Britain and The Discovery Channel in the United States. They were an attempt to show why so much hatred and mistrust was building up against the West in the Muslim world. We filmed the Hezbollah, Hamas, the Israeli army during curfews, Israeli settlers, the family of a Holocaust victim whose tragic family history we retraced in Poland, and the forced evacuation of Muslims from their homes in Northern Bosnia. We were threatened with government censorship in Egypt, sniped at and shelled in Sarajevo, ordered to stop filming three times by Israeli troops in Gaza. Yet, after the film first aired in the States, Israeli lobby groups brought commercial pressure to bear on Discovery. Credit cards were returned to American Express, one of the U.S. sponsors, cut in half. One letter claimed that we should have called the occupied West Bank "disputed" rather than "occupied." To say, as we did, that Israel builds huge Jewish settlements on Arab land -- all facts acknowledged by Israeli human rights groups, as well as by foreign correspondents and diplomats -- was, according to the letter, twisted history. To say that Israeli troops sent the Phalangists into the Sabra and Chatila camp at the time of the 1982 Palestinian massacre -- an incontrovertible damning fact, agreed by Israel's own commission of inquiry -- was "an egregious falsehood." Another letter from a lobby group described me as "spreading venom into the living rooms of America." I was, and I quote, "Henry Higgins with fangs." Less funny, however, was Discovery's decision after receiving these extraordinary letters not to give the film a second showing. Asked if he had canceled the second showing because of pressures from these lobbyists, Clark Bunting, the channel's senior vice president, replied, "Given the reaction to the series upon its initial airing, we never scheduled a subsequent airing, so there is not really an issue as to any scheduled re-airing being canceled." When I read these gutless words, ladies and gentlemen, I was ashamed to be a foreign correspondent. Now, this, as the title of my talk says, is a view from the war zones -- a jaundiced view perhaps, certainly a personal one. But as one of those who has to drive into the smoke and fire from time to time, far too often, and I expect ever more frequently, I draw several conclusions: We are killed because of ill fortune and because the technology of death has improved. We are killed because of the evil of those who murder us to keep us quiet. We are, in effect, killed too because we are attacked by those who wish to take away our identity as honest witnesses, who wish to demean us, call us liars or racists, and thus, in effect, make us unworthy of the protection we so often need. Why, after all, should anyone care about a journalist whose work can be discarded for commercial reasons, or whose peers simply fail at the lowest hurdle to plead their reporters' cause? This last category, the lobby groups, the abusive journalists on government newspapers, are not killers in themselves, of course. But they seek to make our lives less worthy, and thus provide an environment in which our deaths are a small matter. So the message I find in my particular front line is a simple one: Defend our work and you protect our lives. DISCUSSION Jerry Lewis (Israel Radio): Why is it you seem to believe that everything that seems to go wrong has an Israel bias? I refer specifically to your television documentaries, except for the one on Bosnia itself. But [in] the ones concerning the Middle East, you seem to imply throughout that Israel's hidden hand is the cause of all the ills in the region. Robert Fisk: That's your interpretation. It's certainly not mine. Peter Hunter (manager of safety services for BBC News): One of the problems we have is that most journalists are not trained to protect themselves. What we have been trying to do for the BBC is to provide lightweight, high-quality body armor, which in fact enables you to do your job. Fisk: I don't know how to get around the body-armor problem. We never used it in Lebanon under shell fire in the siege of Beirut in '82, which was just as bad as Sarajevo. The reason is it was too hot. In southern Lebanon, when I am on U.N. convoys and they are under fire, I wear a U.N. flack jacket, which is very light. Otherwise, I'm in my ordinary clothes. It goes up to 110 degrees. If [journalists] haven't been to war before, [they should] forget everything they ever saw in Hollywood and realize that war is not about victory or defeat -- it's about death. The learning process comes in learning what roads to go down instead of rushing into the story, slowing down and asking the local people, "Have you seen anything? Has anyone come up this road in the other direction? If a car flashes its lights at you, why is it doing so?" These things I was told before I covered the war in Lebanon. But I didn't learn it until I was there, because you don't. If journalists spend as much time thinking about war as they do fitting on body armor and working out what their blood group is, it would do a lot of good. Journalists should read about what war is really like, over and over, before they go. Phil Hammond (London International Research Exchange): Why now is it such a topic of discussion, the risks that journalists take? Is it that the profession has become more dangerous? Or is it that conflicts are seen nowadays as something which threaten Western countries? Also I wonder whether you think it's still a danger, or more of a danger, nowadays that journalists identify closely with the military. Fisk: We've been talking about it for years, and I've been thinking about [the risks] every day for 20 years in the Middle East. I think the reason why we speak more about it publicly now is there are many more journalists. Television and radio has just blossomed with more and more correspondents, and with more journalists there are more deaths. I don't think it is healthy for journalists to meld into the military or into the government. There are countries, not the United States, not largely Britain, that do constantly challenge military assumptions. France is one. Mr. Lewis will tell you that Israeli journalists are constantly challenging the military assumptions and criticizing them most harshly, in a way that in Britain we do not do. If you look at the Israeli press's treatment of Israeli generals when they have made mistakes, they are very savage, and that's democracy. When you look at what the British and American press do, it's pathetic. We don't challenge these people, especially at a time of war when we need to, because there is, particularly in the United States, this dictatorship of consensus -- the feeling to criticize or suggest that your allies may be wrong is somehow unpatriotic. And that's enough to keep you off the networks. ---

1 0

Re: OCR and Machine Readable Text
by Hal Finney 17 Dec '03

17 Dec '03

Before you get too carried away by the capabilities of off the shelf character recognition, read Phil Karn's experience trying to produce a working DES program from the pages of Applied Cryptography. It was easier than writing it himself, but it was still far from a turnkey operation. This is from <URL: http://www.qualcomm.com/people/pkarn/export/karndecl.html > > 5. I began by first photocopying, on a standard office photocopier, the > 18 pages containing the Triple DES source code listing from Part V of > the Book. This took about 5 minutes. Second, I scanned in the 18 sheets > on a Macintosh Quadra 610 computer system equipped with an HP ScanJet II > flatbed scanner and Omnipage Professional optical character recognition > (OCR) software. The computer, scanner, and software are all readily > available through normal consumer computer supply channels. The total > scanning process took about one and a half hours. About an hour of this > time was spent learning to use the scanning system and conducting trial > runs, as I had only used it briefly some time ago. The actual scan of the > 18 pages took about 15-20 minutes. Third, I transferred the resulting > machine-readable file from the Macintosh to my own personal computer > and brought it up under GNU EMACS, a popular and widely available text > editing program that I have used for many years. In EMACS I compared, > by eye, the scanned file displayed on my screen against the printed > listing in the Book. I began correcting the scanner's many errors, such > as mistaking the digit '0' for the letter 'O' or mistaking the vertical > bar '|' for the letter 'I'. > > 6. After manually correcting those errors noticed through visual > comparison with the Book, I invoked the "C" language compiler on the > (partially) corrected file. The compiler immediately pointed out > additional errors I had overlooked in my visual inspection so I could > also correct them by reference to the Book. I also noticed several errors > in the listing printed in the Book. However, the programmer's intentions > were obvious from the context of each error and were easily fixed. About > fifty minutes later, I successfully compiled the file without error. > > 7. The fourth step was to write a small test program to execute > the DES code with the test vectors given at the end of the source > code listing. This trivial program took less than 5 minutes to > write. Unfortunately, the test did not succeed, meaning that at > least one error went undetected by the compiler in either the code as > printed in the Book or as scanned. Scrutinizing the code more closely, > I quickly found another error in the printed version that was easily > corrected. However, it still did not produce correct results. After about > an hour of searching, I finally located the error in a list of numbers > in a table -- another error in the printed version. By reference to the > DES algorithm description in the first part of the Book, which includes > the correct numbers in tabular form, I found and corrected the error. > > 8. At this point the test finally succeeded, so I knew I had a correct > program. However, to increase my confidence further I tried a few > other DES test vectors that were not included in the source code, but > were openly published by the US National Institute of Standards and > Technology (NIST). All passed. At this point it was beyond doubt that I > had a correct, working copy of the DES source code identical to that on > the Disk with all errors removed, including those printed in the Book > as well as those added by the scanning process. > > 9. Finally, in about 40 minutes I wrote and debugged a "driver" program > analogous to that included in the Crowell declaration. This driver program > takes a sample plaintext file, encrypts it, displays the encrypted file > in hexadecimal and then decrypts it.

1 0

Re: ASSHOLE FAGGOT J.D. Falk
by aga 17 Dec '03

17 Dec '03

On Fri, 3 Jan 1997, Chris Rapier wrote: > In light of this post I have decided to make the spam-list moderated. Trying to cover up the truth again Chris, huh? > I > will not tolerate this sort of behaviour in a private forum. Hey, it was J.D. Falk that started the whole thing with a loaded defame.bot. All I did was respond to a Freedom-Knights mailing list article which happened to have your list in it. > This is not a > free for all newsgroup nor is it a soapbox for you to spout deragatory > views and opinions. It is a technical forum which will be working under > the ageis of the IETF. > As I said, J.D. Falk started the whole thing with his defamatory prose about "Continued harassment by Grubor." It was his fault, and nobody's at this end. > If you have something productive to contribute I encourage your offical > subscription to the mailing list. Please limit your comments to those of a > technical nature dealing with the matter at hand. > The recognition that most every problem person is of a homosexual nature is definitely a usenet body-politic phenomenon, which will be documented and verified with whatever means that become necessary. J.D. Falk Started the whole thing, and there is no way you can get around that. Go deal with the cypherpunks. I have already talked to Falk's boss and Lawyer about him, and I plan on seeing him in Court. That shit that he publishes is not going to last very much longer. Over half of the problem people on usenet are Faggots, and that fact is going to be made well known. I want the faggot cocksucker on the witness stand, and nothing less. cheers, > On Fri, 3 Jan 1997, aga wrote: > > > On Fri, 3 Jan 1997, J.D. Falk's Autoresponder wrote: > > > > "Continued Harassment by John Grubor" and this admitted asshole Faggot > > has had this same Autoresponder set up for Months at this CAIS > > Location. This is called a "defame-bomb" -- another asshole BOFH > > tradition. I had forgotten about this problem J.D. Falk faggot until > > now, but he has this dafame-bomb set up in his procmail, it looks > > like. > > > > Now this is a further example of just how much these homosexuals have > > ruined UseNet in the past. > > > > Don't worry J.D., I misplaced the file on you and that is the reason > > why we have not filed the Lawsuit against you and CAIS yet, but > > believe you me, we WILL be down to the D.C. area and file that Lawsuit > > against you. I have already spoken to your Lawyer, and this shit is > > the last straw. > > > > A further example of how the PROBLEM people on UseNet administration > > always turn out to be the GAY crowd. This recently discovered > > phenomenon must not go unreported. > > > > > > > >On Thu, 2 Jan 1997, Dr.Dimitri Vulis KOTM wrote: > > > > > > >> >From owner-spam-list(a)psc.edu Thu Jan 2 23:26:42 1997 > > > >> Received: by bwalk.dm.com (1.65/waf) > > > >> via UUCP; Thu, 02 Jan 97 23:27:15 EST > > > >> for dlv > > > >> Received: from mailer.psc.edu by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; > > > >> id AA17247 for dlv(a)bwalk.dm.com; Thu, 2 Jan 97 23:26:42 -0500 > > > >> Received: (from majordom@localhost) by mailer.psc.edu (8.8.3/8.8.2/mailer) id XAA30494 for spam-list-outgoing; Thu, 2 Jan 1997 23:06:35 -0500 (EST) > > > >> X-Authentication-Warning: mailer.psc.edu: majordom set sender to owner-spam-list using -f > > > >> From: peter(a)taronga.com (Peter da Silva) > > > > Another BOFH asshole who has been a major usenet problem > > for over 10 years. > > > > > > > >> Message-Id: <199701030359.VAA28649(a)bonkers.taronga.com> > > > >> Subject: Re: regarding the minutes for the filtering meeting... (fwd) > > > >> To: spam-list(a)psc.edu > > > >> Date: Thu, 2 Jan 1997 21:59:16 -0600 (CST) > > > >> In-Reply-To: <Pine.BSI.3.95.970102222523.23890E-100000(a)triste.psc.edu> from "Chris Rapier" at Jan 2, 97 10:41:01 pm > > > >> X-Mailer: ELM [version 2.4 PL24] > > > >> Content-Type: text > > > >> Sender: owner-spam-list(a)psc.edu > > > >> Precedence: bulk > > > >> Reply-To: spam-list(a)psc.edu > > > >> > > > >> > Well, the way i have been looking at things is that its going to be > > > >> > impossible to eliminate all spam. Boycotts can be routed around, > > > >> > > > >> And the secondary routes get blocked, and get injunctions against the > > > >> spammers, and so on. > > > >> > > > >> > payment > > > >> > systems for mail seems to be unweildy at the present time > > > >> > > > >> On the contrary, having advertisers paying for email is already working > > > >> with juno and hotmail and usa.net. > > > >> > > > > > > >You know, this is what I have been saying for years. Spammers will > > > >also PAY to spam UseNet, and we could finance the whole InterNet(tm) > > > >for FREE if we could just get rid of people like Chris Lewis and > > > >Chris Rapier. > > > > > > >We WANT MORE SPAMmers on the UseNet, because we can start charging > > > >them MONEY as their ISPs. > > > > > > >> > Filtration isn't perfect. Before a spammer can be blocked they have to > > > >> > spam... Modifying the headers will circumvent filters as well and well... > > > >> > you all know the shortcomings. > > > >> > > > >> The big problem with filters is that it adds support to spammer's arguments > > > >> that they're not the problem, that people who really don't want spam can > > > >> avoid it (even as they're working to make that harder). > > > >> > > > >> I dislike filters because they carry the distinct possibility of making > > > >> things worse, of establishing a basis for spam. And filters don't hurt the > > > >> spammers because they don't *care*. They'll just send more spam to the folks > > > >> who aren't filtering. It doesn't cost any more, and if they charge for 0.1% > > > >> response from a hundred thousand users they'll just charge for 0.01% from a > > > >> million... > > > >> > > > > > > >Spammers PAY money to SPAM, and every good ISP should charge the > > > >SPAMmers at their end. Then the whole Internet could be FREE for > > > >most all users. > > > > > > >These guys like Chris Lewis who cancel SPAM and Chris Rapier who > > > >tries to create "lists" of people, are both seriously harming the > > > >proper economic development of the InterNet. > > > > > > >The e-mail program that does not also contain newsgroups in the > > > >header is a NO NO. ALL traffic must be routed out of e-mail and > > > >into UseNet, but NOT vice-versa. > > > > > > > Chris Rapier > Systems Programmer/Cabin Boy 2nd Class > Pittsburgh Supercomputing Center > 11EE >

1 0

RSA Announces New "DES Challenge"
by Bob Baldwin 17 Dec '03

17 Dec '03

RSA Announces New "DES Challenge" Tens of thousands of dollars in cash prizes offered; contest should improve overall Internet security by illustrating relative strength of different crypto algorithms and keysizes. Business Editors and Computer Writers REDWOOD CITY, Calif.-Jan 2, 1997--RSA Data Security, Inc., a wholly owned subsidiary of Security Dynamics Technology, Inc. (NASDAQ: SDTI), today announced an Internet-based contest with cash prizes. The contest, known as the "RSA DES Challenge", challenges mathematicians, hackers and computer experts around the world to decipher encrypted messages. The goal of the contest is to quantify the security offered by the government endorsed DES encryption standard and other secret-key ciphers at various key sizes. The challenge proper will be launched during the RSA Data Security Conference to be held in San Francisco, January 28-31, with the target ciphertexts for the different contests being simultaneously posted on the company web-site, at http://www.rsa.com/ RSA Data Security pioneered the Internet-based "cracking" contest, when it launched the original "RSA Factoring Challenge" back in 1991. Since then, the company has paid out over $100,000 in prize money to mathematicians and hackers around the world, and the data gained from that Challenge (which is ongoing) has greatly increased mathematicians' understanding of the strength of encryption techniques based on the "factoring problem", such as the RSA Public Key Cryptosystem T. Background It's widely agreed that 56-bit keys, such as those offered by the government's DES standard, offer marginal protection against the committed adversary. By inertia as much as anything else, DES is still used for many applications, and the 20-year-old algorithm is proposed to be exportable under the latest incarnation of Clipper. It is the perfect time to demonstrate to the world that better systems are both required - and available - thus improving the world's security. There have been theoretical studies done showing that a specialized computer "DES cracker" could be built for a modest sum, which could crack keys in mere hours by exhaustive search. However, no one is known to have built such a machine in the private sector - and nobody knows if one has been built in any government, either. The successes of the RSA Factoring Challenge show that for some types of problems, it's possible to recruit spare "cycles" on a large number of machines distributed around the Internet. Therefore, by offering a suitable incentive, it should be possible to recruit sufficient CPU power across the Internet to exhaustively search the DES keyspace in a matter of weeks. Computer scientists have already developed software that will allow even the novice computer user to participate in the cracking effort. By incorporating the key search software in a "screen saver", a simple PC anywhere on the Internet can devote its spare time to working on the problem - remotely and completely unattended. Even people with limited computer skills will be able to participate. In the RSA DES Challenge, the motto will definitely be "The More, The Merrier". The Contest Full details of the RSA DES Challenge will be posted on the RSA home page (http://www.rsa.com/) during the first weeks of January. Complete rules for the competition will be provided as well as example challenges and solutions against which computer scientists and hackers can test their software. In conjunction with the RSA DES Challenge, RSA will simultaneously launch a series of other contests based around the RC5 Symmetric Block Cipher (another encryption algorithm). Since RC5 is a variable key length block cipher, targets that offer increasing resistance against so-called "exhaustive search attacks" will be posted in the hope of assessing the full impact of a widely-distributed exhaustive search. There will be 12 challenges based on the use of RC5. Prizes will be awarded for the recovery of each of 12 keys which are chosen to be of lengths varying from 40 bits all the way up to 128 bits, with the length increasing in steps of eight bits. The email sender of the first correctly formatted submissions to each contest will receive a cash prize. For the RSA DES Challenge the first sender of the secret DES key will receive $10,000. For the other contests the prize money awarded will vary with the difficulty of the RC5 key attacked. For more information about the ongoing RSA Factoring Challenge send email to challenge-administrator(a)rsa.com and for the latest news and developments send email to challenge-news(a)rsa.com. About RSA Data Security, Inc. RSA Data Security, Inc., a wholly owned subsidiary of Security Dynamics Technologies, Inc., is the world's brand name for cryptography, with more than 75 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, IT4, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developer's kits and end-user products, and provides comprehensive cryptographic consulting services. For more information on any of RSA's encryption technologies, please call RSA directly at 415/595-8782 or send electronic mail to sales(a)rsa.com. RSA also provides information on its Web site at http://www.rsa.com. **************************************************************** Kurt R. Stammberger Director, Technology Marketing RSA Data Security, Inc. (A Security Dynamics Company) 415-595-8782 vox 415-595-1873 fax kurt(a)rsa.com www.rsa.com

1 0

Re: Accounts payable
by nobody＠replay.com 17 Dec '03

17 Dec '03

Timothy May the self-admitted child molester possesses a rudimentary dick less than one inch long, half the size of his mother's clitoris, that barely makes a fistful. Thereby hangs the root of this Jew-hating sissy's sick fixation on little boys and Usenet forgeries. ____ \ _/__ Timothy May \\ / \/

1 0

Re: OCR and Machine Readable Text
by Jim Byrd 17 Dec '03

17 Dec '03

I used to work for an OCR company (Kurzweil, a division of Xerox; now Xerox Advanced Imaging). The OCR software they had did better than 95% over 10 years ago. And yes, you could run on a 286. The trick was to use a board plugged into the 286 which itself had enough horsepower (a Motorola cpu) to do the job. I actually started a project to develop a Windows (version 1.3!) driver for this, but at the time Xerox had no interest in Windows. So the project was cancelled and the Windows people essentially dismissed. Xerox now has a Windows product called TextBridge. At 12:35 PM 1/3/97 -0500, /**\\anonymous/**\\" <panther(a)iglou.com> wrote: >Alan Olsen wrote: >> I used to work for a company that would transfer entire archives of medical >> journals. Much of it we would just OCR. Some of it we would send off >> shore. The OCR software was about 95% reliable and this was over 5 years >> ago. (And we were using 286 boxes for much of the OCR work. Not a heavy >> technoligical investment.) I am sure that things have improved a great >> deal since then. (My new scanner included OCR software. I will have to >> run a test and report the findings. > > I'd like to know what OCR software you were using. All tests we >completed at my place of employment were very poor quality wise. We >showed >a %65 accuracy rate. Not very good when you need to transfer a five >year >backlog of medical and technical journals. This was using a high >resolution >scanner with a package that was bundled along with it. About a year >ago, >my employer considered transfering data taken off of forms into a >relational >database using an OCR program. Again, we found the findings to be too >innacurate for our needs. I may have just been using the wrong programs >for >the job, but the findings were depressing... > >panther > >> --- >> | If you're not part of the solution, You're part of the precipitate. | >> |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | >> | mankind free in one-key-steganography-privacy!" | Ignore the man | >> |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| >> | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com| > >

1 0

WIPO and domain names
by azur＠netcom.com 17 Dec '03

17 Dec '03

For those who haven't seen it already, there is something in the bushes: http://www.wipo.org/eng/internet/domains/index.htm

1 0

What happened to remailer-operators@c2.org?
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

Sorry for this somewhat off-topic post, but I figured it was the best way to reach people who would know. Does anyone know what happened to the remailer-operators(a)c2.org mailing list? I get: rcpt to:<remailer-operators(a)c2.org> 550 <remailer-operators(a)c2.org>... User unknown Thanks.

1 0

ONE MILLION CHILDREN.....
by gary＠safetydisk.com 17 Dec '03

17 Dec '03

...and pets are lost or turn up missing every year! Protect your loved ones today! Think about all the things you do to protect your loved ones. Isn't there one more thing you should do? Child and Pet ID Kits have been around for years, but most of them haven't changed with the years. Traditional ID Kits allow you to compile valuable information about your child or pet that you can use in the event your child or pet is missing. We are responding to the rapid changes in technology. We know that any ID Kit just isn't good enough. Our ID Kit is quite different! You supply us with up to three photos and pertinent information about your child or pet and we create a SAFETYDISK. In PC or MAC format, SAFETYDISK is a 3 1/2" disk that contains photos and valuable information that could help law enforcement agencies in the search for a missing child or pet. What makes our kit so unique is that each SAFETYDISK is actually pre-formatted for the World Wide Web. SAFETYDISK can be put on any Internet server within seconds and displayed to millions and millions of people who might spot your child or pet! For more information, visit our website at http://www.mvisibility.com/sd/ Thanks, Gary Aikens President, SafetyDisk, Inc.

4 5