December 2003 - cypherpunks-legacy

Re: Best Computer School?
by Erp 17 Dec '03

17 Dec '03

On 28 Jan 1997, Derek Atkins wrote: > Erp <erp(a)digiforest.com> writes: > > > On Mon, 27 Jan 1997, SpyKing wrote: > > > This is really exagerating. You do not need a 4.0, 1600, etc. to be > admitted to MIT. Sure, you need good grades, but a 3.6 average and > 1350-1400 SAT scores is perfectly adequate to be admitted to MIT. You > can think of being admitted with even lower scores, if you stand out > in some way. MIT admissions looks for well-rounded students. You're > much better off being a writer/artist/musician than being on the > science or math teams. > Hmm.... Then a have a lieing blah blah blah of a counselor >) hehe I applied for MIT, and even had an interview.. Then dropped my application after getting chewed out by my counselor, and having had her refuse to fill out anything on my second part of the application that said specifically "COUNSELOR ONLY" went to the principal and he refused.. Filled it out myself, and since it didn't have the counselors signature ... I dropped it aka they dropped me but its easier to say it hteo ther way around. And yes I understand the well-rounded thing.. But then again you hav eto consider that the average student at MIT has applied at least two times. I know that one for a fact from some program or something I read that MIT puts out. > > what he wants to be before he goes to some major college such as MIT, > > because tuition at MIT costs approx 100,000$/4 years. Personally that is > > a hell of a lot, but then again *shrug*... I recommend going to a local > > It may be alot, but then again MIT is one of the best schools in the > world (I'm not going to be egotistical enough to say it *is* the best, > even tho Consumer Reports rated it such for the last N years). True, it is one of the best, can't argue against that.. But there are others that are better in certain areas.. from my knowledge MIT expresses more in its engineering departments than anything else though.. Although I do know a very philosophical physics professor there so *shrug*.. maybe I'll apply again some day.. And yes all the rest of my requirements wher ehigh.. I am a swimteam captain, first trombone in my school, for marching jazz pep and symphonic bands.. I'm also the lead french horn.. Then I have the little side things such as Chess team captain.. and have tha precious 3.6 GPA the only proglem with it is I ahve one teacher that gave me a D in my freshman year, so I can't get into honor society .. go figure... But hey such is life.. I'm planning on reapplying after I get into college and raise myself back to a 4 point so who knows what will happen.. > > This is untrue. The computer science department at MIT is really > good. As are the sciences, and even business! The MIT Sloan School > (Management and Economics) was rated #1 last year. The EECS > department (EE and CS are together) is top notch, too. Really good yes.. Not necessarily the best though.. Check everywhere.. each aspect of every college may have one thing that he is specifically interested in that would be better than going to MIT or some other such place3... > > Ciro Maria <cmaria(a)stevens-tech.edu> writes: > > > Yeah Stevens Institute in Hoboken. Its pretty good I got there. Also > > Caltech is good, I don't really know which else. > > When I looked at Caltech, their Engineering (and computer science) > really lacked. They were excellent for the Sciences (Math, Physics, > Chemistry, etc.) but their engineering school wasn't as good as others > I was looking at (both EE and CS). Things may have changed in the > last 8 years, however. *nod* I do agree with that... THey are pretty much the same now.. > > > Spyking, my advise to you: Look around at many schools. Go visit > them. Talk to the students there. Talk to the professors. Talk to > graduates. The more information you and your son have, the better > decisions you and he can make. > > Personally, I loved MIT -- it was the right place for me. It isn't > the right place for everyone. Make sure it is the right place for > your son before he applies. For what it's worth, I wanted to go to > MIT my sophomore year in high school, too ;) I havet o ask, did you make it in on your first apply to it? and please forgive the mistypes in this.. I'm really lagged for some reason.. And well, It takes forever to go back when it is lagged this bd, so I ahven't can back and changed things automatically like I usually do... > Thanks, Erp

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Mon, 27 Jan 1997 paul(a)fatmans.demon.co.uk wrote: > The list has been disentigrating for some time since the disgusting > incident when Dimitri was forcibly unsubscribed from the list. I'm curious about the gratuitous use of the word "forcibly" by Paul. Does this mean Gilmore took a fire axe to the computer or something? Dimitri was unsubscribed. It was done more or less against his will. ("More or less" because he in effect said to John, "bet you can't stop me.") What does "forcibly" add to this discussion besides melodrama? No force was required. John had the right and ability to pull the plug on Dimitri. "No animals were harmed in the making of this film." "Force," my ass. > have also been a number of postings from members of the list claiming > to understand anarchism who support censorship to "protect new > members of the list". There are various definitions of "censorship" and various flavors of anarchism. I'm a market anarchist, Paul is not. Paul claims to believe that any form of moderation is censorship. I think that enforcing standards of decorum on a private, voluntary list are not censorship. Reasonable minds may differ. I acknowledge that Paul's interpretations are not without some justification. (I just think they are incorrect in the instant case.) Paul, on the other hand, seems to be a True Believer. He brooks no view other than his own. (Curiously hypocritical under the circumstrances.) > So, there would be no intellectual dishonesty in a country claiming > to be a free and open society "trying out" fascism for a month or > two? - After all it`s a private country just as this is a private > list.... Paul's sophistry is showing. Nation-states are entities that exercise a monopoly on the use of force (real force, Paul) within (and often without) their boundries. Mail lists are far more like private homes, businesses or clubs. When you are a guest there, you are subject to their rules of behavior. > There is a clear trend easily observable on the list whereby certain > members postings are censored when their content is of a standard > that, if the moderation were objective and based on content alone, > would warrant their being sent to the censored list. Several substantive examples, please. True, nothing Bill Stewart has posted has been sent to CP-Flames. One guess why. Numerous posts by Dimitri have been posted to CP-Moderated, but many more have not made the cut. There are much more obvious reasons for this than Paul's biased analysis. > I can tell you one other thing for sure, even if the moderation > "experiment" were to end in a month as a last ditch attempt by John > Gilmore and Sandy Sandfort to recover some of their lost credibility > it would be a vain and entirely unsuccesful attempt. YMMV. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Re: Rejection policy of the Cypherpunks mailing list
by Dave Hayes 17 Dec '03

17 Dec '03

Dale Thorn writes: > I heard years ago that approximately 10% of the people on the street > are certifiably mentally unstable. This depends on your standads of "unstable". I'll bet genetic diversity is now much more of a factor then when those standards were written. > Multiply that by two at least for > Los Angeles (suburban L.A., actually, Hollywood for example is much > safer than Altadena or Westlake Village). I beg to differ. Which parts of Altadena and Hollywood are you referring to? ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Call on God, but row away from the rocks.

2 1

Re: Fighting the cybercensor
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > Look, I've proposed what I consider to be a remarkably consistent method to > prevent the kind of political tyranny that you criticize, and I don't see > any recognition of this fact. Thats because its a whacko solution that has no credibility or consistency. If anyone tried to set up such a market and a price went out on any of the heads of state fantasized about Mr Bell would be dead as a doornail in a week. Phill

2 1

Re: Fighting the cybercensor. (fwd)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Asgaard <asgaard(a)cor.sos.sll.se> wrote in article <5c92bo$lo9(a)life.ai.mit.edu>... > On Wed, 22 Jan 1997, Jim Choate wrote: > > >The Web does not equal the Internet, straw man argument. > Actually at CERN we considered the Web to be a superset of the Internet protocols and others such as DECNET which ran on private networks such as our HEPNET. Since most of those private networks are now obsolete I would consider Web==Internet to be a reasonable equivalence. We always considered email and news to be part of the Web (news:, mailto:). The narrow view that the Web was only HTTP and HTML was a piece of Andressen propaganda. Phill

1 0

Re: Rejection policy of the Cypherpunks mailing list
by OKSAS 17 Dec '03

17 Dec '03

On Tue, 28 Jan 1997, aga wrote: > On Tue, 28 Jan 1997, Igor Chudov @ home wrote: > > > Dale Thorn wrote: > > > > > > Kevin L Prigge wrote: > > > > paul(a)fatmans.demon.co.uk said: > > > > > > > > "cypherpunks will make the networks safe for censorship" > > > > > > > "Idiots will make the networks require censorship" > > > > > > The line above this one says it all, doesn't it? If I judge you to > > > be "an idiot", then, if I also have the power to shut you up, I can > > > not only shut off your "noise" from me, but also prevent anyone else > > > from hearing you as well. That's the real beauty of censorship - > > > if I have the power, I can make you a non-person by preventing most > > > people from hearing you at all. Oh, lovely, isn't it? > > > > > > > Don't you like power, Dale? > > > > - Igor. > > > > Power corrupts, in some instances. Instances where the power is concentratted to one individual or small group of individual....

1 0

Re: Fighting the cybercensor. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> > Subject: Re: Fighting the cybercensor. (fwd) > Date: Mon, 27 Jan 1997 21:36:13 -0500 > > I don't agree with your view of states. The inhabitants of a > geographical area are not mere chattels of the governing power. Exactly! By jove you got it! By demanding your liberty but demanding that 'we' go to Singapore or anywhere else and treat them as chattels we have clearly instituted a double-standard. Most parties in this discussion still haven't made that distinction. All we have done is replace their current tyrant with a new one, mainly us. > The right to rule rests on certain criteria which I believe neither > country meets. The harassment of opposition politicians in > obviously trumped up charges disqualifies any country from > calling itself a democracy. Exactly. And by applying pressure on Singapore we only help them keep that tyrany in place. The quickest way I know to make a social institution band together is self-preservation from an outside threat, real or perceived. > I am a cyber-revolutionary and the world has bought into > the chaos of our revolution. I never intended the Web to be a tool > for confirming the present social order which is manifestly > corrupt. ALL social orders are corrupt. The 3 laws of thermodynamics apply to everything including social institutions. 1. You can't get ahead 2. You can't break even 3. You can't quit the game Heinz Pagels (RIP) Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Fighting the cybercensor. (fwd)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Jim Choate <ravage(a)einstein.ssz.com> wrote in article <5c5891$ah(a)life.ai.mit.edu>... > > Singapore and China are blocking certain net groups. I think > > this is a bad thing, question is how can we stop it? > > 'We' shouldn't, it is their own country and it is up to their populace to > stop it. Do you really want Singapore or China having a say in how we run > our web? I certainly don't, and won't support any move to force any > particular view on them. If Billy-Bob wants to shoot himself in the foot, > let him. Might be purty funny to watch. I don't agree with your view of states. The inhabitants of a geographical area are not mere chattels of the governing power. The right to rule rests on certain criteria which I believe neither country meets. The harassment of opposition politicians in obviously trumped up charges disqualifies any country from calling itself a democracy. > > The Web was conceived as offering despots and dictators a choice > > between remaining in the dark ages and allowing freedom of > > speech. Blocking and filtering schemes threaten this ideal. > > Bull, the web was conceived so physicist and other researchers could share > data in a easily digestible format. That was not all. We had a political Web site established during the '92 election. I was in contact with Clinton's people when we had fewer than 100 Web sites. I am a cyber-revolutionary and the world has bought into the chaos of our revolution. I never intended the Web to be a tool for confirming the present social order which is manifestly corrupt. Phill

3 2

Re: Rejection policy of the Cypherpunks mailing list
by aga 17 Dec '03

17 Dec '03

On Tue, 28 Jan 1997, Dale Thorn wrote: > aga wrote: > > On Tue, 28 Jan 1997, Dale Thorn wrote: > > > Igor Chudov @ home wrote: > > > > Dale Thorn wrote: > > > > But seriously, I was just telling the folks over the weekend, if I > > > had my hand on the button, a lot of people would die very quickly. > > > As in The Day The Earth Stood Still, a single act of aggression would > > > suffice to be immediately terminated. No trial, huh? The best place to begin, in > > > the USA at least, would be the public freeways. There you have the > > > most acts of aggression in a short space, and the best pickings for > > > liquidation. Give me the power, and I'll show you all those nifty > > > techno-ways of eliminating people that have been kept from the public > > > by our benevolent government ("sources and methods"). > > > > > > BTW, I don't give a damn about someone "cutting me off", since I'm > > > not aggressive enough (outside of my liquidation duties) to be bothered > > > by that in most cases. I'm primarily concerned with vehicles who get > > > too close behind, who pass with no safety margin, etc. I call these > > > people anal-compulsive (as opposed to anal-retentive). You've seen > > > the videos on PBS, the various animal species whose male members > > > perform occasional "mounting" of others to intimidate. There are a > > > large percentage of humans who try to do the same thing, demonstrating > > > that they (IMO) have no further need of their lives. > > > Boy, it is a fucking Bitch living in that L.A. traffic, huh? > > I heard years ago that approximately 10% of the people on the street > are certifiably mentally unstable. Multiply that by two at least for > Los Angeles (suburban L.A., actually, Hollywood for example is much > safer than Altadena or Westlake Village). > Just carry a gun all of the time when you go over there. > Quincy M.D. (the old TV show) did an excellent piece once on how a > person can more-or-less legally commit murder with a car, by passing > a deliberate act off as an "accident". It's one area of our law > enforcement where the law (or rules) as stated by the state and as > enforced by the state cops don't even agree. > Maybe it is best to travel only on the net any more. The highways are deathtraps.

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Dale Thorn 17 Dec '03

17 Dec '03

aga wrote: > On Tue, 28 Jan 1997, Dale Thorn wrote: > > Igor Chudov @ home wrote: > > > Dale Thorn wrote: > > But seriously, I was just telling the folks over the weekend, if I > > had my hand on the button, a lot of people would die very quickly. > > As in The Day The Earth Stood Still, a single act of aggression would > > suffice to be immediately terminated. The best place to begin, in > > the USA at least, would be the public freeways. There you have the > > most acts of aggression in a short space, and the best pickings for > > liquidation. Give me the power, and I'll show you all those nifty > > techno-ways of eliminating people that have been kept from the public > > by our benevolent government ("sources and methods"). > > > > BTW, I don't give a damn about someone "cutting me off", since I'm > > not aggressive enough (outside of my liquidation duties) to be bothered > > by that in most cases. I'm primarily concerned with vehicles who get > > too close behind, who pass with no safety margin, etc. I call these > > people anal-compulsive (as opposed to anal-retentive). You've seen > > the videos on PBS, the various animal species whose male members > > perform occasional "mounting" of others to intimidate. There are a > > large percentage of humans who try to do the same thing, demonstrating > > that they (IMO) have no further need of their lives. > Boy, it is a fucking Bitch living in that L.A. traffic, huh? I heard years ago that approximately 10% of the people on the street are certifiably mentally unstable. Multiply that by two at least for Los Angeles (suburban L.A., actually, Hollywood for example is much safer than Altadena or Westlake Village). Quincy M.D. (the old TV show) did an excellent piece once on how a person can more-or-less legally commit murder with a car, by passing a deliberate act off as an "accident". It's one area of our law enforcement where the law (or rules) as stated by the state and as enforced by the state cops don't even agree.

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

At 10:47 PM 1/27/97 -0800, jim bell wrote: ... >You misunderstand AP, yet again. AP doesn't really take votes, it merely >totals donations. It is an essential element of the AP system that even a >tiny minority should be able to kill individuals who are seen as threats, as >long as this capability is universal. True, the smaller the minority the >more uneconomical such an action would be for them, but it would be well >within the ability of 1% of the population to avoid a another Holocaust by >getting rid of those pushing for it. > >In the current political system, in the US for instance, 51% of the >population is able to screw the remaining 49%, just as long as they can >maintain the majority. Or, perhaps even more accurately and ominously, a >tiny fraction of the population (the current leadership class) is able to >screw the 49%, as long as they have the un-thinking backing of the remaining >and relatively uninvolved 51%. > >AP disables this system. AP turns government into the moral equivalent of a >pick-up football game: Nobody is being forced to play, and everybody and >anybody can simply "get up and leave" whenever he wants to. The moment the >"rules of the game" to make an individual's continued participation >unsatisfying, he can leave. > ... In our society, which, if I remember correctly, 10% of the population control 90% of the wealth, AP would only lead to 10% of the population being able to screw the remaining 90%. At least as it is, it takes a simple majority. As for the murder of the rich, here is a scenerio. A collection of poor pool their capitol to have a tyrant killed. The tyrant assembles a counter-wager saying that anyone able to prove thier ability to kill him without harming him, and who can show they got through will get 110% of the poor's bid. The household is told that a standing bounty has been placed with a collection of individuals, on the head of the trigger man involved in the tyrants murder. The poor can not hope to match the tyrants bid as they only have 10% of the wealth, the household knows that thier participation in an attempt on the tyrant will get them killed. Even if the attempt was successful. The people from the outside who would benefit from the bounty benefit more by taking the tyrants offer and then trying again, i.e. tiger teams.

1 0

RE: Fighting the cybercensor
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>That's it? The system collapsed because the guards left their posts? >And no mutiny charges? Incredible. I was there. The collapse of East Germany was quite spectacular. There was at most three months of warning. First there was a series of sit ins at foreign embassies, then a migration of large numbers of people in their twenties within the eastern block. I missed the actual collapse of the wall itself having to go to England. I was told of the sequence of events by friends in Berlin. By this time the protestors were confident enough to stage open demonstrations. The authorities had tolerated small scale demonstrations for some time provided they did not appear to be part of a larger movement. The sudden increase in numbers from tens to tens of thousands left the authorities unsure of what to do. They could not be sure of the reliability of the police should they attempt to violently suppress the demonstrations. To imprison the ringleaders was equally dangerous. The communists were aware that the South Africans had continued to be troubled by Mandela and Biko long after they were imprisoned or murdered. At some point a group of protesters approached the wall, probably hoping to goad the police into making an arrest. The guards made no response and the numbers increased to the point where firing of warning shots was impossible without causing a massacre. West German protesters joined from the other side of the wall. The border guards did try to use a water cannon but to little effect since the range was insufficient. At some point someone appeared with a sledge hammer and a pickaxe. Some people say that this was at the start of the protest, others that someone fetched them. I have heard people who believe that they were brought from either side of the wall. They started attacking the wall and soon had removed one of the panels. Next day the border guards quite literally abandoned their posts. The Brandenburg gate was opened for the first time in fifty years and the party apparatus all but collapsed. The only military activity during this period was GDR forces preparing against possible invasion by Soviet forces. Not that this was a logistical possibility since it was unlikely they would get across Poland unopposed. Read Norman Davies book "Europe a history" if you want to find out the background for the velvet revolution. It is one of the most amazing events in political history. It is a pity that people have forgotten so quickly about the real causes. It was not military power that prevailed but the protest movement. Unfortunately US commentators tend to see everything in terms of US cultural norms, many of which were explicitly rejected by the protestors. The East Germans wanted West German affluence, they wanted to be part of Western Europe. They were certainly not responding to US military spending as right wing theorists claim, nor was the economy collapsing because of the arms race, it was collapsing because of the costs of a totalitarian state and the incompatibility of that state with modern industrial organization. Phill

3 2

Re: Libel/slander & crypto relevancy (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 28 Jan 1997 01:28:19 -0800 > From: Greg Broiles <gbroiles(a)netbox.com> > Subject: Re: Libel/slander & crypto relevancy > > Civil actions against people doing "graffiti" are only interesting where > the defendant has assets worth suing for. This economic dimension > substantially limits the number of suits which will be brought. Thank you for agreeing with my thesis that the legal industry is one driven by monetary gain and not justice. It is the one major problem with law today, it ignores those who are not 'worth it'. Justice is supposed to be blind and until that happens there can be no true liberty. Law should be involved in rights and wrongs and not 'how much money do I need to buy that villa in Spain'. There is also the aspect of 'reputation' of the organization which was defamed. This will become even more critical to good business over the Internet in the future than it is now. Now the only really important 'reputation' that one has to worry about is their credit report. Since it is very unlikely that such records will be made public in the future they won't be available so some other 'reputation' verification process will be required for parties interested in doing business with other parties they have no information on other than an email address or a webpage. This problem became very clear during the Austin Cypherpunks remailer project last year. The goal was to create a economicaly viable keyserver. The problem rapidly became one of trust and reputation and there was and still is no clear cut methodology for dealing with these concepts, let alone actualy trying to quantify them. Another aspect of this that keeps coming up is one of 'big' corporations with 'lots' of money, this monotonicity in legal thought is the reason I refer to the 'legal industry' and not 'legal profession'. Currently the main force driving law is how much money is available. Expansions of liberty simply can't happen in this environment because there is no mechanism to protect 'little' organizations or persons without 'lots' of cash. This problem is one that is not being addressed by anyone, most especialy lawyers who will loose income which they aren't apt to do voluntarily. > Criminal prosecutions for defamation (in the case of "graffiti") are still > unlikely - a much more straightforward charge would be unauthorized access > to a computer or some flavor of fraud, depending on the facts. This would be hard to do in the situation such as a mailing list because the parties would have 'authorized access' and it does not include the issue of inside parties nor 'web bbs's' where parties can enter comments and other statements in a 'authorized' manner. There are mechanisms to use computers for abuse of other parties besides hacking. > Confusion > aids defendants, so I predict prosecutors will avoid defamation law (and > its tar pits of actual malice and the defense of truth) when they are able > to do so and still have a reasonable chance of conviction. > > >If they don't > >understand the technology (eg forwarding private email to publicly > >accessible lists by accident) how in the world are they going to understand > >what is best, let along convince anyone else? > > There's a world of difference between understanding technology and screwing > up once in awhile. Absolutely. However, if there is not a fundamental understanding of the technology and its ramifications I certainly wouldn't want somebody making a case on my behalf because they would make assumptions which were not based in fact. In Toto's case the point I was refering to was not his sending private practice related material to a publicly accessible list (pretty reprehensible for my attorney accident or not) but rather his unsolicited admission that he didn't have any idea how it works. THAT would worry me if my liberty, possessions, or life were on the line. > I was that "party", and I guess that in trying to be civil I was actually > unclear. If you were a politically important person or organization, and if > Toto's message had caused you real damage, and if Toto were reasonably > available to prosecute, a prosecutor might get interested. But you're not > important, Toto would be difficult to extradite, and you weren't harmed. So > you picked a crappy example to make your point(s) with. Change the facts, > and you'll get a different answer. Duh. Actualy it is the PERFECT example of what is wrong with the law, it is the reason that I went to such extremes to force the situation. If the law can't protect Ma. and Pa. Kettle (their poor, being share croppers) under our 'democracy' it shure can't proctect them under a more 'liberalized' democracy which so many want and the technology will force. If the coming technocracy can't (or for monetary reasons won't) then it won't be any different that what we have now. A tyrant is a tyrant, my goal is to get rid of the cage and not to put a new layer of gilt on it. > You picked a hypothetical which did a poor job of illustrating the points > you're making in this later message. Do you want to talk about whether or > not Toto is criminally liable for making fun of you while making a point > about ownership of networks and its relationship to freedom of speech, or > do you want to talk about the more general case of liability for > misattribution? If it's the latter, yes, there are some issues there, but I > still think that defamation law is a poor way to address them. You seem to > be having an "I've got a hammer, everything looks like a nail" problem. The point is not whether Toto did or did not make fun of me, you seem to have a prediliction for personal attacks. It ain't. The point is that if joe-six-pack isn't secure in knowing that his views and expression are not protected from abuse he won't use it. We all loose in that case. > And all of this seems a bit contrived if the real crypto-relevant point is > "use digital signatures to avoid misattribution". You missed the point, keep pondering. I am shure it will come to you. > Despite your closing, I haven't seen you write anything about "how it > should be", Because I don't know how it should be, and it isn't my place or yours to make that decision. It is our responsibility to discuss this issue and to review the various solutions and what they will mean in the long run (as near as we can make the future out that is). In this example, if party A makes a statement and then B changes it and then re-distributes it as original comments by A then there is a problem irrespective of the monetary worth of A or B. Digital signatures in and of themselves won't help this from happening unless it is required to include the full text and signature of any quote in any subsequent use of that material otherwise the quote and the digital signature are out of sync and therefore worthless. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Best Computer School?
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Erp <erp(a)digiforest.com> wrote in article <5cjlg0$2ij(a)life.ai.mit.edu>... > > > > On Mon, 27 Jan 1997, SpyKing wrote: > > > This is a little off topic but maybe someone can help. I've got a teenage > > son (HS sophomore) who's interested in majoring in computer science in > > college with a particular interest in cryptography. He's leaning toward MIT. > > Any suggestions from list members as to colleges to investigate? > > Well in reference to MIT.. I hope he has a 4.0 in highschool, is an > allsport, has a 1600 on his SAT's, and a prefect on his ACT.. Just to > even think about going there.. Let alone to include how well he'll have > to do on his interviews etc.. Also you may wish to have him look again at > what he wants to be before he goes to some major college such as MIT, > because tuition at MIT costs approx 100,000$/4 years. Actually MIT does not take notice of SATs, GSATs and other IQ nonsense. Basically the tests are meaningless at the upper end of the scale which is where most MIT students would score and a low score does not in itself demonstate stupidity. If he can get in then its difficult to imagine a better school for crypto in the US. There is a finacial support program and admission is "needs blind" so that grants are matched according to need. > I know pretty well positive that > MIT is excellent, but when you get down to the basics MIT is more of an > engineering school than a science/philosophical school which Computer > Sciences falls under.. Another good school from what I've heard is UCLA.. > then again you can discredit anything I've said, because I'm still a > HighSchool senior myself and have been looking into Computer Criminology > for the last three years, and I'm positive it is what i want so *shrug*.. Actually there is a reasonable school for philosophy just up the road but its not so good for computer science (it did produce Bill Gates.) The AI lab does have a number of people who lean quite heavilly to the philosophy side. Phill

1 0

RE: Libel/slander & crypto relevancy
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Jim Choate <ravage(a)EINSTEIN.ssz.com> wrote: I have received several private emails inquiring into what possible crypto relevance the recent exchange over libel/slander and the law. It is clear that even in democratic countries like Canada (not know as a freedom of speech protectorate) slander/libel is covered under criminal codes. While it is true that currently these statutes are not heavily used, if at all, this will change as businesses and special interest groups move even further onto electronic networks. Consider the zealous use of the law by the CoS. Ask Julf if the ramifications are not 'real world'. Jim Choate CyberTects ravage(a)ssz.com Not one to ever let a mention of Canada go unchallenged - even when it is a simple fact or a compliment - I thought I should jump into the discussion. Like the CoS, many companies have threatened libel actions as a means to silence people. The McLibel Two in Britian quickly come to mind. However, also like the Cos, many companies are finding that the net effect of these libel suites are not in their favour even when they win. Some brilliant examples of subversive use of trademarks can be found at the site: http://www.adbusters.org Specific examples: http://www.adbusters.org/Corporate/Greasestick.html http://www.adbusters.org/Gallery/spoofabs.html http://www.adbusters.org/Corporate/Kalvin.html A little clever marketing could go a long way to promoting privacy issues in the public consciousness. Perhaps an NSA Friends and Family calling plan? James

1 0

Re: Fighting the cybercensor. (fwd)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Jim Choate <ravage(a)EINSTEIN.ssz.com> wrote in article <5cg99p$7a(a)life.ai.mit.edu>... > The part of it that comes out of their pocketbook does. Just like the part of > 'the net' that I pay for belongs to me. The net is a bunch of computers, > running software, hooked together over cables and other links. Each and > EVERY ONE of these require installation, upkeep, repair, and utility > support. This costs money. He who pays the money owns the net, everybody > else is along for the ride. The network is largely an intellectual creation. The hardware is relatively unimportant, it can always be replaced. > If we take your argument to its logical conclusion then once a box goes on > the net it belongs to nobody/everybody. Clearly utter nonsense. If you start from such a state and property centered ideology perhaps. I'm a philosophical anarchist and I don't consider the state to have "rights" over its "subjects", nor do I believe in the pure ideology of property you do. Its worth noting that the origin of property is theft. In the case of the controllers of China literally so since they stole most of their "property" from the previous rulers. I believe that the relationship between a state and individual is a much more complex one than the slavish subjection model you propose. In this I am in agreement with practically every philosopher since Locke. It is true that there is the convenience of the state as agency but the question is on whose behalf that agency is exercised. I see no reason why I should not meddle in the affairs of states I'm not a 'subject" of. > If you really and truly believe that the net belongs to everyone and nobody > has a right to limit or otherwise control the hardware and software along > with the associated comm links they own and pay for then you obviously don't > understand what is going on. They are allowed to connect their machinery to the Internet so long as they are prepared to accept the Internet's ethic. They are not allowed to have a free ride, to demand a valuable connection facility on their own terms. > ps I also support France's current attempt at forcing the Georgia university > web site on French soil to use French. As a citizen of Europe I disagree. I believe that the narrow and parochial attitude of the French province breaches undertakings in the Treaty of Rome and under the European declaration of human rights. France is not a sovereign state and does not have the right to pass laws that infringe on the rights granted to European citizens as a whole. Phill

3 2

Re: Best Computer School?
by Derek Atkins 17 Dec '03

17 Dec '03

Erp <erp(a)digiforest.com> writes: > On Mon, 27 Jan 1997, SpyKing wrote: > > > This is a little off topic but maybe someone can help. I've got a teenage > > son (HS sophomore) who's interested in majoring in computer science in > > college with a particular interest in cryptography. He's leaning toward MIT. > > Any suggestions from list members as to colleges to investigate? > > Well in reference to MIT.. I hope he has a 4.0 in highschool, is an > allsport, has a 1600 on his SAT's, and a prefect on his ACT.. Just to > even think about going there.. Let alone to include how well he'll have > to do on his interviews etc.. Also you may wish to have him look again at This is really exagerating. You do not need a 4.0, 1600, etc. to be admitted to MIT. Sure, you need good grades, but a 3.6 average and 1350-1400 SAT scores is perfectly adequate to be admitted to MIT. You can think of being admitted with even lower scores, if you stand out in some way. MIT admissions looks for well-rounded students. You're much better off being a writer/artist/musician than being on the science or math teams. > what he wants to be before he goes to some major college such as MIT, > because tuition at MIT costs approx 100,000$/4 years. Personally that is > a hell of a lot, but then again *shrug*... I recommend going to a local It may be alot, but then again MIT is one of the best schools in the world (I'm not going to be egotistical enough to say it *is* the best, even tho Consumer Reports rated it such for the last N years). > small college, get his associates, see if that is what he still wants to > do, then go on from there. I know many people that started in Computer > Science and died after the first year. > Now colleges that are good for Computer Sc ience.. I have heard that RIT > is good.. but I'm nto sure on that.. I know pretty well positive that > MIT is excellent, but when you get down to the basics MIT is more of an > engineering school than a science/philosophical school which Computer This is untrue. The computer science department at MIT is really good. As are the sciences, and even business! The MIT Sloan School (Management and Economics) was rated #1 last year. The EECS department (EE and CS are together) is top notch, too. Ciro Maria <cmaria(a)stevens-tech.edu> writes: > Yeah Stevens Institute in Hoboken. Its pretty good I got there. Also > Caltech is good, I don't really know which else. When I looked at Caltech, their Engineering (and computer science) really lacked. They were excellent for the Sciences (Math, Physics, Chemistry, etc.) but their engineering school wasn't as good as others I was looking at (both EE and CS). Things may have changed in the last 8 years, however. Spyking, my advise to you: Look around at many schools. Go visit them. Talk to the students there. Talk to the professors. Talk to graduates. The more information you and your son have, the better decisions you and he can make. Personally, I loved MIT -- it was the right place for me. It isn't the right place for everyone. Make sure it is the right place for your son before he applies. For what it's worth, I wanted to go to MIT my sophomore year in high school, too ;) Good Luck, -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) Home page: http://www.mit.edu:8001/people/warlord/home_page.html warlord(a)MIT.EDU PP-ASEL N1NWH PGP key available

1 0

Internet companies demonstrate portable security
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

(Forward) Internet companies demonstrate portable security Six Internet companies have joined forces to develop a joint demonstration of smartcard technologies at the 1997 RSA Data Security Conference. Consensus Development Corporation, Gemplus, Hewlett-Packard, Litronic Inc., Netscape Communications Corporation and VeriSign, Inc., Monday announced "The Get Smartcard Demo." The interactive demo will allow each conference attendee to load X509v3 certificates on crypto-enabled smartcards. Participants will interact with the demo through mutually authenticated SSL connections and document signing. For the full text story, see http://www.merc.com/stories/cgi/story.cgi?id=1274540-213 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Multimedia

1 0

can Sun Tzu be a cypherpunks?
by nobody＠nowhere.com 17 Dec '03

17 Dec '03

Quotations from the Art Of War by Sun Tzu A Military operation involves deception. Even though you are competent, appear to be incompetent. Though effective, appear to be ineffective. Draw them in with the prospect of gain, take them by confusion. Use humility to make them haughty. Tire them by flight. Cause division among them. Attack when they are unprepared, make your move when they do not expect it. The formation and procedure used by the military should not be divulged beforehand. Comment: He seems to be advocating security through obscurity here. The one who figures on victory at headquarters before even doing battle is the one who has the most strategic factors on his side. The one who figures on inability to prevail at headquarters before doing battle is the one who has the least strategic factors on his side. The one with many strategic factors in his favor wins, the one with few strategic factors in his favor loses--how much more so for the one with no strategic factors in his favor. Observing the matter this way, I can see who will win and who will lose. The superior militarist strikes while schemes are being laid. The next best is to attack alliances. The next best is to attack the army. Invincibility is in oneself, vulnerability is in the opponent. Therefore skilled warriors are able to be invincible, but they cannot cause opponents to be vulnerable. That is why it is said that victory can be discerned but not manufactured. Invincibility is a matter of defense, vulnerability is a matter of attack. Therefore the victories of good warriors are not noted for cleverness or bravery. Therefore their victories in battle are not flukes. Their victories are not flukes because they position themselves where they will surely win, prevailing over those who have already lost. So it is that good warriors take their stand on ground where they cannot lose, and do not overlook conditions that make an opponent prone to defeat. Therefore a victorious army first wins and then seeks battle; a defeated army first battles and then seeks victory. Those who use arms well cultivate the Way and keep the rules. Thus they can govern in such a way as to prevail over the corrupt. Comment: Would it not be wonderful if we could prevail over the corrupt? Making the armies able to take on opponents without being defeated is a matter of unorthodox and orthodox methods. Therefore those skilled at the unorthodox are infinite as heaven and earth, inexhaustible as the great rivers. When they come to an end, they begin again, like the days and months; they die and are reborn, like the four seasons. The unorthodox and the orthodox give rise to each other, like a beginningless circle--who could exhaust them? Disorder arises from order, cowardice arises from courage, weakness arises from strength. Therefore those who skillfully move opponents make formations that the opponents are sure to follow, give what opponents are sure to take. They move opponents with the prospect of gain, waiting for them in ambush. To unfailingly take what you attack, attack where there is no defense. For unfailingly secure defense, defend where there is no attack. So in the case of those who are skilled in attack, their opponents do not know where to defend. In the case of those skilled in defense, their opponents do not know where to attack. Be extremely subtle, even to the point of formlessness. Be extremely mysterious, even to the point of soundlessness. Thereby you can be the director of the opponent's fate. Comment: Are cypherpunks capable of this? To advance irresistibly, push through their gaps, to retreat elusively, outspeed them. Induce them to adopt specific formations, in order to know the ground of death and life. Comment: Sounds like known plaintext attack to me. Therefore the consummation of forming an army is to arrive at formlessness. When you have no form, undercover espionage cannot find out anything, intelligence cannot form a strategy. Comment: Sun Tzu seems to being saying that if your cipher is properly designed, you need not rely on security through obscurity. Victory over multitudes by means of formation is unknowable to the multitudes. Everyone knows the form by which I am victorious, but no one knows the form by which I ensure victory. Military formation is like water--the form of water is to avoid the high and go to the low, the form of a military force is to avoid the full and attack the empty; the flow of water is determined by the earth, the victory of a military force is determined by the opponent. So a military force has not constant formation, water has no constant shape;the ability to gain victory by changing and adapting according to the opponent is called genius. Foreknowledge cannot be gotten from ghosts and spirits, cannot be had by analogy, cannot be found out by calculation. It must be obtained from people, people know the conditions of the enemy. There are five kinds of spy: The local spy, the inside spy, the reverse spy, the dead spy, and the living spy. When the five kinds of spies are all active, no one knows their routes--this is called organizational genius, and is valuable to the leadership. Local spies are hired from among the people of a locality; Inside spies are hired from among enemy officials. Reverse spies are hired from enemy spies. Dead spies transmit false intelligence to enemy spies. Living spies come back to report. Question: Can cypherpunks use these methods to defeat those who would take our freedom?

3 3

Child Porn
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

(Forward) *** NY student charged with sending child sex photos over Internet Nathaniel Levy, a psychology major at New York State University, was charged Wednesday with using the Internet to transmit photos of infants having sex with adults, the New York state attorney general said. Levy, who wanted to be a kindergarten teacher, was arrested for promoting sexual performance of a child. If convicted he could receive seven years in prison. Levy, whose computer name was "NateTSnake," was released Wednesday on $20,000 bail. He allegedly transmitted 35 sexually explicit photos of children, some as young as 18 months. For the full text story, see http://www.merc.com/stories/cgi/story.cgi?id=1219452-9f3 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Multimedia

1 0

c2 internet accounts
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

does c2net still offer internet accounts? I liked their offer for internet accounts with a 5 mb web site via telnet. does anyone else know of a place for cheap telnet only accounts? thanks;

3 2

c2 internet accounts
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

does c2net still offer internet accounts? I liked their offer for internet accounts with a 5 mb web site via telnet. does anyone else know of a place for cheap telnet only accounts? thanks;

1 0

Child Porn
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

(Forward) *** NY student charged with sending child sex photos over Internet Nathaniel Levy, a psychology major at New York State University, was charged Wednesday with using the Internet to transmit photos of infants having sex with adults, the New York state attorney general said. Levy, who wanted to be a kindergarten teacher, was arrested for promoting sexual performance of a child. If convicted he could receive seven years in prison. Levy, whose computer name was "NateTSnake," was released Wednesday on $20,000 bail. He allegedly transmitted 35 sexually explicit photos of children, some as young as 18 months. For the full text story, see http://www.merc.com/stories/cgi/story.cgi?id=1219452-9f3 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Multimedia

1 0

Internet companies demonstrate portable security
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

(Forward) Internet companies demonstrate portable security Six Internet companies have joined forces to develop a joint demonstration of smartcard technologies at the 1997 RSA Data Security Conference. Consensus Development Corporation, Gemplus, Hewlett-Packard, Litronic Inc., Netscape Communications Corporation and VeriSign, Inc., Monday announced "The Get Smartcard Demo." The interactive demo will allow each conference attendee to load X509v3 certificates on crypto-enabled smartcards. Participants will interact with the demo through mutually authenticated SSL connections and document signing. For the full text story, see http://www.merc.com/stories/cgi/story.cgi?id=1274540-213 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Multimedia

1 0

[ANNOUNCE] PGP Signatures
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dinghy Vindictive K[ondom]OfTheMinute died of AIDS last night with his queer lover. _ O O _ \-|-\_/-|-/ Dinghy Vindictive K[ondom]OfTheMinute /^\ /^\ ^^ ^^ ^^ ^^

1 0

Re: Genetic Algorithms
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

What a joy to make a public mockery of Dr.Defecated L>eech< Vicious! |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Dr.Defecated L>eech< Vicious | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

1 0

Re: Trigger-Words...
by Martin Janzen 17 Dec '03

17 Dec '03

harka(a)nycmetro.com writes: >does anybody know any contact points/Web pages, where I might get >some information on e-mail filtering via trigger-words? I am >interested in how this technology specifically works and a >acollection of trigger-words would be nice too :) You might start with the Mail Filtering FAQ: http://www.cis.ohio-state.edu/hypertext/faq/usenet/mail/filtering-faq/faq.h… It's pretty Unix-specific, covering procmail, Elm filter, and mailagent. For PC-based mailers, you're probably better off checking the documentation and/or the web page for the one you're using. Finally, take a look at the comp.mail.* newsgroups. Or just use the search engines, throwing in combinations of the above terms... -- Martin Janzen janzen(a)idacom.hp.com Pegasus Systems Group c/o Hewlett-Packard Company, CMD Vancouver

1 0

AltaVista sprouts a hole ...
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Russell Stuart <R.Stuart(a)rsm.com.au> MIME-Version: 1.0 Precedence: Bulk Date: Wed, 29 Jan 1997 08:07:27 +1000 From: Russell Stuart <R.Stuart(a)rsm.com.au> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: AltaVista sprouts a hole ... From: risko(a)csl.sri.com (RISKS List Owner) Newsgroups: comp.risks Subject: RISKS DIGEST 18.77 Message-ID: <CMM.0.90.1.853810937.risko(a)chiron.csl.sri.com> RISKS-LIST: Risks-Forum Digest Monday 20 January 1997 Volume 18 : Issue 77 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for further information, disclaimers, caveats, etc. ***** <snip> ------------------------------ Date: Fri, 3 Jan 97 23:52:00 +0100 From: Anders Andersson <andersa(a)Mizar.DoCS.UU.SE> Subject: Leaking WWW surfer interest profiles I notice that AltaVista's inline advertisements link to a server outside Digital, "ad.doubleclick.net", and that the URL includes the user's list of keywords being searched. I'm concerned that these URL's may occasionally leak information about the user's interests and inclinations to third parties, information which the user may prefer to keep private. This is not a new problem that appeared with the inline ads, since also the Referer: field of the HTTP protocol discloses to a target server exactly what AltaVista index page led the user to it. However, this requires that the user willfully follows that link. If sensitive information being leaked via the Referer: field is a problem, the user may obtain client software that withholds Referer: data, either conditionally or unconditionally. Also, a user who has asked AltaVista for "gay" pages is probably not too concerned about accidentally disclosing this fact to the maintainer of said "gay" pages. However, the doubleclick.net ads appear to bear no relationship to the keywords being searched, and they appear not only in the URL for the hyperlink to follow, but also in the IMG SRC URL. This means that in order to avoid disclosing my keyword lists to doubleclick.net, I have to disable automatic loading of inline images when using AltaVista! Why is it that when I perform a search for, say, "gay OR nazi AND scientology", AltaVista tricks my browser to give this very search string away to an advertising company by means of an inline image (the contents of which has nothing to do with my search)? I think I can trust the AltaVista maintainers not to save my keyword lists for future analysis, but what about an advertising company? It's kind of serendipity reversed. When you open a book to look up information on a specific subject, the book scans your mind to find out what other interests and hobbies you have. Anders Andersson, Dept. of Computer Systems, Uppsala University Box 325, S-751 05 UPPSALA, Sweden +46 18 183170 andersa(a)DoCS.UU.SE ------------------------------ <snip> Regards Russell Stuart Software Development Manager RSM Technology PTY LTD ---------------------- Phone: +61 7 3844 9631 Fax: +61 7 3844 9522 Email: R.Stuart(a)rsm.com.au --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

Re: Trigger-Words...
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

harka(a)nycmetro.com wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hi there, > > does anybody know any contact points/Web pages, where I might get > some information on e-mail filtering via trigger-words? I am > interested in how this technology specifically works and a > collection of trigger-words would be nice too :) Look at http://www.algebra.com/~ichudov/usenet/scrm/robomod/robomod.html, and look for the explanation of how bad.words.list works in my robomoderator. - Igor.

1 0

Re: Trigger-Words...
by Martin Janzen 17 Dec '03

17 Dec '03

harka(a)nycmetro.com writes: >does anybody know any contact points/Web pages, where I might get >some information on e-mail filtering via trigger-words? I am >interested in how this technology specifically works and a >acollection of trigger-words would be nice too :) You might start with the Mail Filtering FAQ: http://www.cis.ohio-state.edu/hypertext/faq/usenet/mail/filtering-faq/faq.h… It's pretty Unix-specific, covering procmail, Elm filter, and mailagent. For PC-based mailers, you're probably better off checking the documentation and/or the web page for the one you're using. Finally, take a look at the comp.mail.* newsgroups. Or just use the search engines, throwing in combinations of the above terms... -- Martin Janzen janzen(a)idacom.hp.com Pegasus Systems Group c/o Hewlett-Packard Company, CMD Vancouver

1 0

AltaVista sprouts a hole ...
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Russell Stuart <R.Stuart(a)rsm.com.au> MIME-Version: 1.0 Precedence: Bulk Date: Wed, 29 Jan 1997 08:07:27 +1000 From: Russell Stuart <R.Stuart(a)rsm.com.au> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: AltaVista sprouts a hole ... From: risko(a)csl.sri.com (RISKS List Owner) Newsgroups: comp.risks Subject: RISKS DIGEST 18.77 Message-ID: <CMM.0.90.1.853810937.risko(a)chiron.csl.sri.com> RISKS-LIST: Risks-Forum Digest Monday 20 January 1997 Volume 18 : Issue 77 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for further information, disclaimers, caveats, etc. ***** <snip> ------------------------------ Date: Fri, 3 Jan 97 23:52:00 +0100 From: Anders Andersson <andersa(a)Mizar.DoCS.UU.SE> Subject: Leaking WWW surfer interest profiles I notice that AltaVista's inline advertisements link to a server outside Digital, "ad.doubleclick.net", and that the URL includes the user's list of keywords being searched. I'm concerned that these URL's may occasionally leak information about the user's interests and inclinations to third parties, information which the user may prefer to keep private. This is not a new problem that appeared with the inline ads, since also the Referer: field of the HTTP protocol discloses to a target server exactly what AltaVista index page led the user to it. However, this requires that the user willfully follows that link. If sensitive information being leaked via the Referer: field is a problem, the user may obtain client software that withholds Referer: data, either conditionally or unconditionally. Also, a user who has asked AltaVista for "gay" pages is probably not too concerned about accidentally disclosing this fact to the maintainer of said "gay" pages. However, the doubleclick.net ads appear to bear no relationship to the keywords being searched, and they appear not only in the URL for the hyperlink to follow, but also in the IMG SRC URL. This means that in order to avoid disclosing my keyword lists to doubleclick.net, I have to disable automatic loading of inline images when using AltaVista! Why is it that when I perform a search for, say, "gay OR nazi AND scientology", AltaVista tricks my browser to give this very search string away to an advertising company by means of an inline image (the contents of which has nothing to do with my search)? I think I can trust the AltaVista maintainers not to save my keyword lists for future analysis, but what about an advertising company? It's kind of serendipity reversed. When you open a book to look up information on a specific subject, the book scans your mind to find out what other interests and hobbies you have. Anders Andersson, Dept. of Computer Systems, Uppsala University Box 325, S-751 05 UPPSALA, Sweden +46 18 183170 andersa(a)DoCS.UU.SE ------------------------------ <snip> Regards Russell Stuart Software Development Manager RSM Technology PTY LTD ---------------------- Phone: +61 7 3844 9631 Fax: +61 7 3844 9522 Email: R.Stuart(a)rsm.com.au --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

3 2

Re: Best Computer School?
by Matthew Toth 17 Dec '03

17 Dec '03

MIT is one the best schools in the country for C.S. Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, PA. (the folks who put out CERT.) Not sure how much Crypto they do, though.

1 0

Recovery of Windows NT administrator password
by Garrard, David 17 Dec '03

17 Dec '03

An inherited Windows NT system that I am involved with has a lost administrator password ( no one no longer knows what it is ). Can anyone point me to software products/companies that can help in the recovery. Given Microsoft's dismal record on security I am sure there must be solutions to this dilemma. Any help would be greatly appreciated. Best Regards David L. Garrard

1 0

Re: Best Computer School?
by Rick Osborne 17 Dec '03

17 Dec '03

At 12:32 PM 1/28/97 -0500, Derek Atkins wrote: >This is really exagerating. You do not need a 4.0, 1600, etc. to be >admitted to MIT. Sure, you need good grades, but a 3.6 average and >1350-1400 SAT scores is perfectly adequate to be admitted to MIT. I disagree and can speak from experience. I was denied admission to MIT even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I was on several academic teams, sang in Chorus, acted and stage managed in Drama, and played Tennis. The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" >For what it's worth, I wanted to go to MIT my sophomore year in high >school, too Lucky you. It had been a dream of mine since I was an annoying overachiever of 6. Sux to be white trash, I guess. MIT may be a great school, but they tend to be snooty assholes for the most part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty assholes", I'm just saying that I've yet to meet one that wasn't.) _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ "He who knows, does not speak. He who speaks, does not know."

1 0

Re: Fighting the cybercensor. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 27 Jan 1997 22:12:36 -0500 > From: "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> > Subject: Re: Fighting the cybercensor. (fwd) > > Jim Choate <ravage(a)EINSTEIN.ssz.com> wrote in article <5cg99p$7a(a)life.ai.mit.edu>... > > The network is largely an intellectual creation. The hardware is > relatively unimportant, it can always be replaced. Try doing it without the hardware and software. There is a distinction, you apparently don't make, between the content and the methodology of distribution. Without the methodology there is no content. Ideas are cheap, distributing and trying them out (ie great social experiments) is expensive. This is why it is absolutely critical in a democratic society that those who own the means of distribution be left to their own means with minimal regulation based on the ideal 'if their actions do not harm another or their property without their prior consent' it isn't anyones business what they are doing with their distribution mechanisms. Whether you like it or not, each and every one of us have a responsibility to every other person on the planet. That responsibility is to ensure that our goals and desires don't infringe their goals and desires without their prior consent, this is a fundamenal responsibility of government. As hard as it is for many social scientist to accept privacy is a fundamental requirement for a equitable government. I express this simply by, "Democracy works not because of compromise but rather the refusal to compromise." > If you start from such a state and property centered ideology perhaps. > I'm a philosophical anarchist and I don't consider the state to have > "rights" over its "subjects", nor do I believe in the pure ideology of > property you do. The 'state' is its subjects and the rules that are enacted to regulate their behaviour. In case it hasn't occured to you, even the regulators are subjects, and in the case of clearly oppressive societies victims as much as those they subjugate. It isn't some etherial entity. Only you, and those that proscribe to your views, are claiming that states are some homogenous (or should be) set of rules and actions. The way you speak of 'state' and 'citizen' implies some clearly observable demarcation, it don't exist. This is the problem with EVERY form of government except a democracy, it assumes that people are cogs in a machine. If it satisfies one it will satisfy all. A democracy recognizes this difference in what people value and the goals they desire as a fundamental distinction (ie. life, liberty, and the pursuit of happiness) worth protecting. I would suggest you read the 9th and 10th Amendments to the Constitution of the US and consider long and hard the ramifications of the (currently unenforced) limitations of government authority. Even European governments might learn something. > Its worth noting that the origin of property is theft. In the case of the > controllers of China literally so since they stole most of their "property" > from the previous rulers. Malarky. The origin of property is at least 300,000 years old, potentialy over a Million, and much older than China could ever hope to claim and most definitely NOT based on any concept of government. Property comes from small family clans of people who chose to move from a hunter-gather society to one of agriculture. To do that means that you have to lay out fields or other areas for cultivation. Initialy these groups moved around because the fields would go fallow. At some point some bright folks, either by accident or intentional experimentation (probably both), found that rotating crops would allow them to stay in one place. This allowed families to grow. In very fertile areas this caused population explosions as individual clans grew and began to interact with other local clans. At some critical size, undetermined as best as I can determine, this allows specialization of effort. This specialization of effort is what leads to governments as we recognize them. When property was 'invented' there were no rulers because there was no larger human organization than a familial tribe. I personaly believe that the concept of 'property' is a fundamental aspect of human psychology and not any structures they might impliment to express that need. I am as certain as it is possible to be that a Cro-magnon cave man felt that his throwing stick was 'his'. If not why did they bury their dead with flowers and other objects that apparently belonged to the person in life? It sounds like, by extrapolation, that your assertion is that they had government in the modern sense because of this. An assertion I find laughable at best. > I believe that the relationship between a state and individual is > a much more complex one than the slavish subjection model > you propose. In this I am in agreement with practically every > philosopher since Locke. But I don't propose a slavish subject model, you keep trying to make it seem like that is what I am proposing. Let me make it clear, I utterly reject ANY model that makes distinctions between those who rule and those who are ruled. > It is true that there is the convenience of the state as agency but > the question is on whose behalf that agency is exercised. Nobodies. The state is a means to regulate resources and commerce, anything else is a misunderstanding of what a state is. > I see no reason why I should not meddle in the affairs of states > I'm not a 'subject" of. Then don't bitch when they meddle in your affairs. I am shure Saddam Hussein (who I personaly believe is a piece of shit) will find it reassuring that you won't raise a complaint next time he decides some place in Europe would be a nice place to hang out with his armies. > They are allowed Allowed, hell. They pay for the privilege just like everyone else. Despite what you might believe the Internet is not a right or something anyone has a right to. > to connect their machinery to the Internet so long > as they are prepared to accept the Internet's ethic. There is no Internet ethic just as there is no community standard. It is a convenient concept for intellectuals to pass off utterly senseless theories and explanations, and in many cases justify subjugation and regulation for no other reason than their own emotional and economic comfort. > As a citizen of Europe I disagree. I believe that the narrow and > parochial attitude of the French province breaches undertakings in the > Treaty of Rome and under the European declaration of human rights. Absolutely. The difference in our approaches is that you feel that you have found a solution that satisfies you and therefore it should satisfy everyone. With this I disagree completely. People are simply too diverse to lump into the categories that you would like. If the French have a model that won't work, let them figure it out on their own. > France is not a sovereign state and does not have the right to > pass laws that infringe on the rights granted to European citizens > as a whole. I suspect most French people would have something contrary to say about that. Jim Choate CyberTects ravage(a)ssz.com

1 0

Crypto verification needed for Pretty Safe Mail
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

There have been questions raised on the newsgroups regarding Pretty Safe Mail, arguably the best implementation of a PGP product for the Macintosh. In response, the product manager at Highware has requested that a trusted third party verify the security of Pretty Safe Mail. However, a NON-U.S. cryptologer is needed. I'm including the post below. Please forward to any people you know who may qualify. Pretty Safe Mail is a GREAT product. If it can be shown to be safe and effective, it will do wonders to spread the use of strong crypto. ===== From: axel(a)highware.com (Axel de Landtsheer) Newsgroups: comp.security.pgp.discuss Subject: Re: Concerned about Pretty Safe Mail for Mac > I'm concerned about the product "Pretty Safe Mail" for the Macintosh, >by a company called Highware. I was wondering whether anyone here had >tried evaluating it at all. > > It is a complete PGP implementation (not a front-end). They claim >to have licensed some of PRZ's code from PGP. However, as far as I >can tell, they are not making any of the source code available. The source code for PSM is indeed not available. We are however eager to have the code checked by any trusted source. These sources cannot be US companies because of the new US regulations which state that US companies must not give such support to overseas companies. Us being a Belgian company, this makes things a little more difficult. Does anybody have a suggestion for such a trusted source outside the US? > As someone on the comp.security.pgp newsgroups pointed out, writing >a wonderful user interface on a PGP trojan horse that either crippled >the session key generator or used the session key to leak random >portions of secret key primes would be a perfect tactic for a >government wishing to penetrate PGP security. With such a great >interface, compared to the original PGP, it can't help but become >widely used. PSM is not a Trojan Horse. Does any trusted source want to check that? > I realize that without the source code, it's a major hassle, but >has anyone looked at Pretty Safe Mail (previously called Safemail) >at all for suspicious behavior? For example: > > 1) non-random session key generation? > 2) non-random key pair generation? > 3) unnecessary disk access to secret keys? > 4) anything else? Many people are worried about the random-key generation because they do not need to bang away on the keyboard for five minutes when they create a key pair. Apparently, this seems to loosen their nerves (I heard some people created about 10 key pairs a day - just a joke). In short, we use all events that happen on the Mac (clicks, typing, opening of windows, display of icons, ...) together with the time they happen, and encrypt these to fill a table which is the starting point for the random-number generator. Why make people type away on the keyboard if you have enough random events to start from? Again, we want to have this checked by a trusted source asap... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Axel de Landtsheer | Highware, Inc. | 109 av. H. Jaspar, 1060 Brussels, Belgium Product Manager | voice: +32 2 537-6810 fax: +32 2 537-5155 axel(a)highware.com | http://www.highware.com, ftp://ftp.highware.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To obtain my PGP key, send me a message with subject "Send PGP key"

1 0

CNN: Court ok's College control of Internet access
by Jim Choate 17 Dec '03

17 Dec '03

Note: Heavily edited. Forwarded message: > COURT SAYS COLLEGES CAN RESTRICT INTERNET ACCESS > > > January 28, 1997 > Web posted at: 1:35 p.m. EST > > NORMAN, Oklahoma (CNN) -- A U.S. District Court in Oklahoma has > ruled universities have the right to limit access to explicit > material on the Internet. > > A federal judge ruled University of Oklahoma president David Boren, > a former U.S. senator, has every right to determine what sites > students and faculty can view while on the campus Internet system. > > Boren was sued by University professor, Bill Loving, who claimed his > First Amendment rights were being infringed upon. > > The court ruled against Loving, also an attorney, saying his > constitutional rights were not violated and that he is not entitled > to injunctive relief. > > "I am certainly pleased by the judge's decision," Boren said. "The > university did its best to strike a careful balance in order to > protect legitimate academic and intellectual freedom while at the > same time assuring that the university not act as a distributor of > obscene material, which is not protected by the First Amendment." > rule

1 0

Physical meet, Sat. Feb. 15 - not 18. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From owner-austin-cpunks(a)ssz.com Tue Jan 28 20:10:19 1997 From: Jim Choate <ravage(a)einstein.ssz.com> Message-Id: <199701290209.UAA06585@einstein> Subject: Physical meet, Sat. Feb. 15 - not 18. To: austin-cpunks(a)einstein.ssz.com (Austin Cypherpunks) Date: Tue, 28 Jan 1997 20:09:55 -0600 (CST) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 784 Sender: owner-austin-cpunks(a)einstein.ssz.com Precedence: bulk Reply-To: austin-cpunks(a)einstein.ssz.com Hi all, I apparently didn't pay much attention to what month I was looking at when I made the initial meeting. Turns out the 18th is a Tuesday obviously a day that few of us can make. As a result I looked at the 'real' Feb. calendar and the meeting date is as follows: Saturday, Feb. 15, 1997 6pm. HEB Central Market Restaurant Look for the red 2nd. ed. Applied Cryptography book For more info email 'austin-cpunks(a)ssz.com' Also invited to this meet are members of the mailing lists: Experimental Science Instrumentation Advanced Computer Experimentation Sorry for the confusion. Jim Choate CyberTects ravage(a)ssz.com

2 2

Re: c2 internet accounts
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Tue, 28 Jan 1997, Vladimir Z. Nuri wrote: > does c2net still offer internet accounts? I liked their > offer for internet accounts with a 5 mb web site via > telnet. does anyone else know of a place for cheap > telnet only accounts? C2Net no longer offers new shell accounts and we are phasing out pre-existing accounts. We still offer virtual web hosting. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: can Sun Tzu be a cypherpunks?
by Toto 17 Dec '03

17 Dec '03

nobody(a)nowhere.com wrote: > Question: Can cypherpunks use these methods to defeat those > who would take our freedom? WARNING! "The Xenix Chainsaw Massacre" Is A Very Dangerous Document ------------------------------------------------------------------- It is reputed among many of the top minds in the Computer Industry to be a very real, and revealing, documentary of some of the horrors of the Industry which are sometimes rumored, but seldom exposed. But be warned-they say it in private, not in public. Though management at the major Corporations in the Industry brush aside the document as the mad ramblings of an unstable, failed business executive, the fact remains that there are more and more people coming forward who claim to have suffered demotions or loss of employment after deliberately or inadvertently revealing their support of the document's claims and it's authenticity. If you choose to read this manuscript, do not speak of it in casual conversation at your place of employment, or around strangers in any business or social environment. Though it is almost impossible to document cases of reprisal of this nature, the increasing numbers of ex-employees of major Corporations in the Computer Industry making these claims, and the devastating consequences they allege to their professional and private lives, make it wise to be discreet in expressing any opinion, or even knowledge, of this document. If you choose to share this document with others, it would be wise to do so discreetly, even anonymously, should you be unsure of the reliability and discretion of whomever you choose to share this knowledge with. Though I personally lean toward viewing the manuscript as authentic, my exhaustive research into it's origin has always come to a dead-end, even among the principals involved. C.J. Parker, former President of Pearl Harbor Computers, Inc., denied emphatically, in a face-to-face encounter with anything whatsoever to do with the document. When I pressed him with questions regarding the hasty demise of his business and the unraveling of his personal life after the public circulation of "The Xenix Chainsaw Massacre" began, he became very agitated and distraught, bordering on violence, and the interview was abruptly terminated. Dr. William M. Denney, one of the few principals in the manuscript referred to directly, was reluctant to be interviewed, but eventually made a few comments which I found to be very revealing. Dr. Denney, Vice-President of Basis, Inc. in Emmeryville, Ca., consistently rated as one of the top ten Unix Open Systems vendors in the world, said, "I deny any knowledge of or participation, in any way whatsoever, with anything connected to 'The Xenix Chainsaw Massacre', and it would be wise for others to do the same." I find this statement to be very cryptic and, at the same time, very revealing; very much in line with what would expect from one associated with the alleged underground computer society described in the manuscript. As for Mr. Torry Basford, a former employee of Bell Labs who was Mr. Parker's first mentor in the world of Unix and is rumored to be laboring in obscurity in a small community college somewhere in the southwestern U.S., Mr. Parker would only say, "The man has suffered enough, please leave him alone." Regardless of the origins or authenticity of the document, it is considered by many to be extremely unsettling, perhaps even dangerous, and one might be better served to avoid reading the manuscript, if for no other reason than simple peace of mind. ___________________________________ If you would like a copy of the manuscript, send me a private email indicating a desire to receive it. Toto

1 0

Re: Fighting the cybercensor
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Phillip M. Hallam-Baker wrote: > > > > jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > > > Look, I've proposed what I consider to be a remarkably consistent method to > > prevent the kind of political tyranny that you criticize, and I don't see > > any recognition of this fact. > > Thats because its a whacko solution that has no credibility > or consistency. > > If anyone tried to set up such a market and a price went out > on any of the heads of state fantasized about Mr Bell would be > dead as a doornail in a week. But, if Jim writes the bot well, puts it in an unknown place (remember, all communications are done through remailers), he could die, but the assassination bot would still work. It may be an interesting problem: what steps are necessary to take to provide for the bot maintainers' sudden death in such a way that the bot would survive for a long time (at least 10 years) w/o any maintenance? Several things need to be done, such as running several versions of the bot so that they could all communicate and work as hot standbys in case one of the instances stops communicating; change their anonymous address from time to time to deal with shut down remailers; probably slowly propagate as virii, so that killing them all would be hard; what else? It could be done akin to Thompson's famous backdoor in /bin/login, as a perpetual trojan horse. How to prevent the bot's detection by sysadmins? - Igor.

1 0

Recovery of Windows NT administrator password
by Garrard 17 Dec '03

17 Dec '03

An inherited Windows NT system that I am involved with has a lost administrator password ( no one no longer knows what it is ). Can anyone point me to software products/companies that can help in the recovery. Given Microsoft's dismal record on security I am sure there must be solutions to this dilemma. Any help would be greatly appreciated. Best Regards David L. Garrard

1 0

Physical meet, Sat. Feb. 15 - not 18.
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, I apparently didn't pay much attention to what month I was looking at when I made the initial meeting. Turns out the 18th is a Tuesday obviously a day that few of us can make. As a result I looked at the 'real' Feb. calendar and the meeting date is as follows: Saturday, Feb. 15, 1997 6pm. HEB Central Market Restaurant Look for the red 2nd. ed. Applied Cryptography book For more info email 'austin-cpunks(a)ssz.com' Also invited to this meet are members of the mailing lists: Experimental Science Instrumentation Advanced Computer Experimentation Sorry for the confusion. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Best Computer School?
by Rick Osborne 17 Dec '03

17 Dec '03

At 12:32 PM 1/28/97 -0500, Derek Atkins wrote: >This is really exagerating. You do not need a 4.0, 1600, etc. to be >admitted to MIT. Sure, you need good grades, but a 3.6 average and >1350-1400 SAT scores is perfectly adequate to be admitted to MIT. I disagree and can speak from experience. I was denied admission to MIT even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I was on several academic teams, sang in Chorus, acted and stage managed in Drama, and played Tennis. The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" >For what it's worth, I wanted to go to MIT my sophomore year in high >school, too Lucky you. It had been a dream of mine since I was an annoying overachiever of 6. Sux to be white trash, I guess. MIT may be a great school, but they tend to be snooty assholes for the most part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty assholes", I'm just saying that I've yet to meet one that wasn't.) _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ "He who knows, does not speak. He who speaks, does not know."

3 2

CNN: Court ok's College control of Internet access
by Jim Choate 17 Dec '03

17 Dec '03

Note: Heavily edited. Forwarded message: > COURT SAYS COLLEGES CAN RESTRICT INTERNET ACCESS > > > January 28, 1997 > Web posted at: 1:35 p.m. EST > > NORMAN, Oklahoma (CNN) -- A U.S. District Court in Oklahoma has > ruled universities have the right to limit access to explicit > material on the Internet. > > A federal judge ruled University of Oklahoma president David Boren, > a former U.S. senator, has every right to determine what sites > students and faculty can view while on the campus Internet system. > > Boren was sued by University professor, Bill Loving, who claimed his > First Amendment rights were being infringed upon. > > The court ruled against Loving, also an attorney, saying his > constitutional rights were not violated and that he is not entitled > to injunctive relief. > > "I am certainly pleased by the judge's decision," Boren said. "The > university did its best to strike a careful balance in order to > protect legitimate academic and intellectual freedom while at the > same time assuring that the university not act as a distributor of > obscene material, which is not protected by the First Amendment." > rule

1 0

Re: Best Computer School?
by Matthew Toth 17 Dec '03

17 Dec '03

MIT is one the best schools in the country for C.S. Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, PA. (the folks who put out CERT.) Not sure how much Crypto they do, though.

2 1

Re: Machine readable form (was:RE: [DES] DES Key Recovery Project, Progress Report #7)
by Phil Karn 17 Dec '03

17 Dec '03

Read the following text from the introduction to the new December 30, 1996 regulations: A printed book or other printed material setting forth encryption source code is not itself subject to the EAR (see Sec. 734.3(b)(2)). However, notwithstanding Sec. 734.3(b)(2), encryption source code in electronic form or media (e.g., computer diskette or CD ROM) remains subject to the EAR (see Sec. 734.3(b)(3)). The administration continues to review whether and to what extent scannable encryption source or object code in printed form should be subject to the EAR and reserves the option to impose export controls on such software for national security and foreign policy reasons. This seems clear enough. If it's printed on paper, it's kosher for export. But if we're really overt about it, we may goad the government into attempting to control printed source code as well. That could prove most interesting. Phil

2 1

Last nail for US crypto export policy?
by Ian Goldberg 17 Dec '03

17 Dec '03

EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE CIPHER BROKEN IMMEDIATELY January 28, 1997 - Ian Goldberg, a UC Berkeley graduate student, announced today that he had successfully cracked RSA Data Security Inc.'s 40-bit challenge cipher in just under 3.5 hours. RSA challenged scientists to break their encryption technology, offering a $1000 award for breaking the weakest version of the code. Their offering was designed to stimulate research and practical experience with the security of today's codes. The number of bits in a cipher is an indication of the maximum level of security the cipher can provide. Each additional bit doubles the potential security level of the cipher. A recent panel of experts recommended using 90-bit ciphers, and 128-bit ciphers are commonly used throughout the world, but US government regulations restrict exportable US products to a mere 40 bits. Goldberg's announcement, which came just three and a half hours after RSA started their contest, provides very strong evidence that 40-bit ciphers are totally unsuitable for practical security. "This is the final proof of what we've known for years: 40-bit encryption technology is obsolete," Goldberg said. The US export restrictions have limited the deployment of technology that could greatly strengthen security on the Internet, often affecting both foreign and domestic users. "We know how to build strong encryption; the government just won't let us deploy it. We need strong encryption to uphold privacy, maintain security, and support commerce on the Internet -- these export restrictions on cryptography must be lifted," Goldberg explained. Fittingly, when Goldberg finally unscrambled the challenge message, it read: "This is why you should use a longer key." Goldberg used UC Berkeley's Network of Workstations (known as the NOW) to harness the computational resources of about 250 idle machines. This allowed him to test 100 billion possible "keys" per hour -- analogous to safecracking by trying every possible combination at high speed. This amount of computing power is available with little overhead cost to students and employees at many large educational institutions and corporations. Goldberg is a founding member of the ISAAC computer security research group at UC Berkeley. In the Fall of 1995, the ISAAC group made headlines by revealing a major security flaw in Netscape's web browser.

1 0

Crypto verification needed for Pretty Safe Mail
by Anonymous 17 Dec '03

17 Dec '03

There have been questions raised on the newsgroups regarding Pretty Safe Mail, arguably the best implementation of a PGP product for the Macintosh. In response, the product manager at Highware has requested that a trusted third party verify the security of Pretty Safe Mail. However, a NON-U.S. cryptologer is needed. I'm including the post below. Please forward to any people you know who may qualify. Pretty Safe Mail is a GREAT product. If it can be shown to be safe and effective, it will do wonders to spread the use of strong crypto. ===== From: axel(a)highware.com (Axel de Landtsheer) Newsgroups: comp.security.pgp.discuss Subject: Re: Concerned about Pretty Safe Mail for Mac > I'm concerned about the product "Pretty Safe Mail" for the Macintosh, >by a company called Highware. I was wondering whether anyone here had >tried evaluating it at all. > > It is a complete PGP implementation (not a front-end). They claim >to have licensed some of PRZ's code from PGP. However, as far as I >can tell, they are not making any of the source code available. The source code for PSM is indeed not available. We are however eager to have the code checked by any trusted source. These sources cannot be US companies because of the new US regulations which state that US companies must not give such support to overseas companies. Us being a Belgian company, this makes things a little more difficult. Does anybody have a suggestion for such a trusted source outside the US? > As someone on the comp.security.pgp newsgroups pointed out, writing >a wonderful user interface on a PGP trojan horse that either crippled >the session key generator or used the session key to leak random >portions of secret key primes would be a perfect tactic for a >government wishing to penetrate PGP security. With such a great >interface, compared to the original PGP, it can't help but become >widely used. PSM is not a Trojan Horse. Does any trusted source want to check that? > I realize that without the source code, it's a major hassle, but >has anyone looked at Pretty Safe Mail (previously called Safemail) >at all for suspicious behavior? For example: > > 1) non-random session key generation? > 2) non-random key pair generation? > 3) unnecessary disk access to secret keys? > 4) anything else? Many people are worried about the random-key generation because they do not need to bang away on the keyboard for five minutes when they create a key pair. Apparently, this seems to loosen their nerves (I heard some people created about 10 key pairs a day - just a joke). In short, we use all events that happen on the Mac (clicks, typing, opening of windows, display of icons, ...) together with the time they happen, and encrypt these to fill a table which is the starting point for the random-number generator. Why make people type away on the keyboard if you have enough random events to start from? Again, we want to have this checked by a trusted source asap... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Axel de Landtsheer | Highware, Inc. | 109 av. H. Jaspar, 1060 Brussels, Belgium Product Manager | voice: +32 2 537-6810 fax: +32 2 537-5155 axel(a)highware.com | http://www.highware.com, ftp://ftp.highware.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To obtain my PGP key, send me a message with subject "Send PGP key"

1 0

can Sun Tzu be a cypherpunks?
by nobody＠nowhere.com 17 Dec '03

17 Dec '03

Quotations from the Art Of War by Sun Tzu A Military operation involves deception. Even though you are competent, appear to be incompetent. Though effective, appear to be ineffective. Draw them in with the prospect of gain, take them by confusion. Use humility to make them haughty. Tire them by flight. Cause division among them. Attack when they are unprepared, make your move when they do not expect it. The formation and procedure used by the military should not be divulged beforehand. Comment: He seems to be advocating security through obscurity here. The one who figures on victory at headquarters before even doing battle is the one who has the most strategic factors on his side. The one who figures on inability to prevail at headquarters before doing battle is the one who has the least strategic factors on his side. The one with many strategic factors in his favor wins, the one with few strategic factors in his favor loses--how much more so for the one with no strategic factors in his favor. Observing the matter this way, I can see who will win and who will lose. The superior militarist strikes while schemes are being laid. The next best is to attack alliances. The next best is to attack the army. Invincibility is in oneself, vulnerability is in the opponent. Therefore skilled warriors are able to be invincible, but they cannot cause opponents to be vulnerable. That is why it is said that victory can be discerned but not manufactured. Invincibility is a matter of defense, vulnerability is a matter of attack. Therefore the victories of good warriors are not noted for cleverness or bravery. Therefore their victories in battle are not flukes. Their victories are not flukes because they position themselves where they will surely win, prevailing over those who have already lost. So it is that good warriors take their stand on ground where they cannot lose, and do not overlook conditions that make an opponent prone to defeat. Therefore a victorious army first wins and then seeks battle; a defeated army first battles and then seeks victory. Those who use arms well cultivate the Way and keep the rules. Thus they can govern in such a way as to prevail over the corrupt. Comment: Would it not be wonderful if we could prevail over the corrupt? Making the armies able to take on opponents without being defeated is a matter of unorthodox and orthodox methods. Therefore those skilled at the unorthodox are infinite as heaven and earth, inexhaustible as the great rivers. When they come to an end, they begin again, like the days and months; they die and are reborn, like the four seasons. The unorthodox and the orthodox give rise to each other, like a beginningless circle--who could exhaust them? Disorder arises from order, cowardice arises from courage, weakness arises from strength. Therefore those who skillfully move opponents make formations that the opponents are sure to follow, give what opponents are sure to take. They move opponents with the prospect of gain, waiting for them in ambush. To unfailingly take what you attack, attack where there is no defense. For unfailingly secure defense, defend where there is no attack. So in the case of those who are skilled in attack, their opponents do not know where to defend. In the case of those skilled in defense, their opponents do not know where to attack. Be extremely subtle, even to the point of formlessness. Be extremely mysterious, even to the point of soundlessness. Thereby you can be the director of the opponent's fate. Comment: Are cypherpunks capable of this? To advance irresistibly, push through their gaps, to retreat elusively, outspeed them. Induce them to adopt specific formations, in order to know the ground of death and life. Comment: Sounds like known plaintext attack to me. Therefore the consummation of forming an army is to arrive at formlessness. When you have no form, undercover espionage cannot find out anything, intelligence cannot form a strategy. Comment: Sun Tzu seems to being saying that if your cipher is properly designed, you need not rely on security through obscurity. Victory over multitudes by means of formation is unknowable to the multitudes. Everyone knows the form by which I am victorious, but no one knows the form by which I ensure victory. Military formation is like water--the form of water is to avoid the high and go to the low, the form of a military force is to avoid the full and attack the empty; the flow of water is determined by the earth, the victory of a military force is determined by the opponent. So a military force has not constant formation, water has no constant shape;the ability to gain victory by changing and adapting according to the opponent is called genius. Foreknowledge cannot be gotten from ghosts and spirits, cannot be had by analogy, cannot be found out by calculation. It must be obtained from people, people know the conditions of the enemy. There are five kinds of spy: The local spy, the inside spy, the reverse spy, the dead spy, and the living spy. When the five kinds of spies are all active, no one knows their routes--this is called organizational genius, and is valuable to the leadership. Local spies are hired from among the people of a locality; Inside spies are hired from among enemy officials. Reverse spies are hired from enemy spies. Dead spies transmit false intelligence to enemy spies. Living spies come back to report. Question: Can cypherpunks use these methods to defeat those who would take our freedom?

1 0