December 2003 - cypherpunks-legacy

Mondex
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timmy C. Maypole's aberrant sexual life has negatively impacted his mental integrity. \|/ @ @ -oOO-(_)-OOo- Timmy C. Maypole

1 0

British export restrictions?
by John Lehmann 17 Dec '03

17 Dec '03

Anyone know how the British govt. falls on crypto export legislation? -- John Lehmann

1 0

Hash functions
by Mixmaster 17 Dec '03

17 Dec '03

Timothy C[reep] Maya is the living proof that anal sex causes pregnancy. () \--o .-\__. ( \_ '-.-'

1 0

Mondex
by Mixmaster 17 Dec '03

17 Dec '03

Timmy C. Maypole's aberrant sexual life has negatively impacted his mental integrity. \|/ @ @ -oOO-(_)-OOo- Timmy C. Maypole

1 0

Re: "alt.cypherpunks" people?
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > > > On Wed, 5 Feb 1997, Dr.Dimitri Vulis KOTM wrote: > > > Anil Das <das(a)sgi.com> writes: > > > > > Adam Back wrote: > > > > > > > > What do people think of starting an alt.cypherpunks USENET newsgroup? > > > > > > > > > > I have only one objection. I will never post to an Usenet group > > > under my real email address for fear of ending up in spammer > > > databases. > > > > > > -- > > > Anil Das > > > > > > > Learn to use an anonymous remailer. > > > > Unfortunately, if everyone is posting from "nobody@thevoid" or such, we'd > lose the "personalities" that make up the community. Why not use a "nym" > account to post - one that is configured to discard all incoming email? > > -r.w. Post as "nobody(a)nowhere.net", but mention e-mail address for replies in the body of the article (or the signature). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Getting into MIT is impossible
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Sandy the asshole continues to forward crypto-irrelevant fluff to the censored list as long as it's posted by his boyfriends: "P.J. Westerhof" <p.j.wester(a)NGI.NL> writes: > At 18:12 4-02-97 -0800, you wrote: > >Erland van Lidth de Jeude is a MIT grad. He played the big badass in "Stir > >Crazy." Computer science major, BTW. > > > He is quite a singer too (at least he was some years ago on Dutch TV). > Perhaps that made the difference. ;-) > > Gr. > Peter > > > _________________________________________________________ > > P.J. Westerhof LL.D > e-mail P.J.WESTER(a)NGI.NL | Computerlaw > voice +31-347-375400 | Legal informatics > fax/data +31-347-375400 | IT - consultancy > Web: www.ngi.nl/cr/ | Soaring > _________________________________________________________ > > --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: mail-to-news fun
by Andy Dustman 17 Dec '03

17 Dec '03

On Wed, 5 Feb 1997 stewarts(a)ix.netcom.com wrote: > Alt.anonymous.messages is an interesting alternative, but one of the > ideals of posting news from a remailer is to allow people to > broadcast politically incorrect speech anonymously, avoiding censorship > and retribution as much as possible. This means letting people > call Lee Kwan Yew a fascist, complain that OJ's a space alien, > identify the person Hillary paid to off Vince Foster, > or proclaim that Hubbard's Ahmaddiyya Witnesses are the One True > Religion -- Or post the One Page RSA+RC4 to the China newsgroups. Hey, I agree. I allowed unlimited USENET posting from dustbin back in October. I almost had to shut the whole remailer down and the only reason I didn't was that I was able to hide it as a middleman. That's partly because dickwads were (for example) posting spams about Tim May on cypherpunks, and some people were complaining to my ISP. > On several other hands, though, even if you limit news posting, > trolls can abuse a remailer by sending email to large mailing lists. > It'd certainly never happen to Cypherpunks :-), but some other > mailing lists might attract trolls, and it's not easy to > identify them in advance (though I suppose adding a disclaimer > and cutmarks any time you post to something other than a > known remailer is a partial solution.) I'm working (slowly, as I have time) on some new remailer software which blocks by default and notifies the recipient that he can claim his anonymous mail as soon as he "signs" the usage agreement (magic cookie exchange). -- Andy Dustman / Computational Center for Molecular Structure and Design / UGA You can have my PGP public key by sending mail with subject "send file key". You can have my PGP secret key when you pry it out of my cold, dead neurons. http://charon.chem.uga.edu/~andy mailto:andy@CCMSD.chem.uga.edu <}+++<

1 0

Re: mail-to-news fun
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> Well, I'd really rather not do that. I already have to deal with >> abuse from nym.alias.net and mix(a)anon.lcs.mit.edu users. >All that being said, it might not be worth the effort to allow posting, >since you're not actually doing the posting anyway. I've thought about >allowing posting again with a very restrictive newsgroup list >(only alt.anonymous.messages). If I were going to restart a remailer, and to offer news posting, I'd probably limit it to posting to moderated newsgroups only, so a human can trash things that look like SPAM or abuse; the abuse that caused me to kill my remailer wasn't something a simple filter would catch. (I'd also prefix each posting with a header about this message having been received from an anonymous source, not verified, not guaranteed to be worth the electrons it's printed on, probably not written by anybody whose name's at the bottom, etc.... People don't read mail headers or disclaimers at the bottom, and putting disclaimers like that into message text for email exposes the message to traffic analysis.) Alt.anonymous.messages is an interesting alternative, but one of the ideals of posting news from a remailer is to allow people to broadcast politically incorrect speech anonymously, avoiding censorship and retribution as much as possible. This means letting people call Lee Kwan Yew a fascist, complain that OJ's a space alien, identify the person Hillary paid to off Vince Foster, or proclaim that Hubbard's Ahmaddiyya Witnesses are the One True Religion -- Or post the One Page RSA+RC4 to the China newsgroups. On the other hand, I don't want to support postings titled "ALL FAGS MUST DIE" with a forged signature and email at the bottom, and I especially don't want to post that from my remailer without indicating that anything posted by a remailer might be forged. That's why I shut down my previous remailer - the forger only posted one forged message; the person whose name got forged got flamed severely by dozens of people who objected to "her" posts. Blocking the gay newsgroups cuts down on that kind of trolling, but also cuts out the "Help, I might be gay and my parents will kill me" traffic that remailers are supposed to help with. On several other hands, though, even if you limit news posting, trolls can abuse a remailer by sending email to large mailing lists. It'd certainly never happen to Cypherpunks :-), but some other mailing lists might attract trolls, and it's not easy to identify them in advance (though I suppose adding a disclaimer and cutmarks any time you post to something other than a known remailer is a partial solution.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Cypherpunks FOIA request
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:22 AM 2/5/97 -0800, Peter Hendrickson wrote: >At 12:40 AM 2/5/1997, Greg Broiles wrote: >> To date, I have received three responses: one from the SF office of the FBI, >> indicating that they have no records responsive to my request; one from the >> NSA, indicating that they are processing my request, and one from the Secret >> Service, asking for a copy of my signature. (I've got no clue why they want >> that; unless I screwed up, I believe my initial request was signed.) > >Have these organizations been known to lie? What penalties does >the organization or its employees face when they do so? Have these >penalties ever been applied? Yes, various law enforcement agencies and intelligence agencies have been willing to lie to the American public (and the world at large) from time to time :) Pragmatically, the only penalty that the organization(s) and individuals face is political, e.g., cuts in funding or loss of employment due to public humiliation/embarrassment. >Also, which exceptions in the FOIA law would allow them to respond >dishonestly? They are allowed to respond that "no records exist" even if records do exist, where: (1) The records relate to an active criminal investigation, the subject of the investigation is unaware of the investigation, and the disclosure of the existence of records would likely disrupt law enforcement activity; (5 USC 552 (c)(1)) (2) The records relate to a confidential informant, and the disclosure of the existence of the records would tend to reveal the identity of the informant (e.g., I suspect Joe Blow is an informant, so I make a FOIA request for information gained from confidential informant Joe Blow; even if I receive only blacked-out pages, the fact that the records exist tells me something about Joe) (5 USC 552 (c)(2)) (3) The records are classified, held by the FBI, and pertain to intelligence, counterintelligence, or international terrorism. (5 USC 552 (c)(3)) They may also withhold information in other circumstances, but are not otherwise allowed to say that "no records exist". (There's something surreal about presuming careful attention to tiny legal details from organizations which perpetrated debacles like COINTELPRO, Waco, Ruby Ridge, perjury/manufacturing evidence in the FBI lab, etc. But sometimes something interesting is released, e.g., <http://www.epic.org/privacy/wiretap/Scowcroft.gif>.) -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvky//37pMWUJFlhAQE5tgf/QstFYJxNcJuRIQjF14a+3luyJgFe8MCp UpMfykNKHmnbq+ChZCsmgXUCt49s0VFQYeMdNH1HWaaOcTtRr3uqNFqmyLBQxSne PboMtzvl0Z6NKcP/DV1BwHxHJZbYVGPoPXDYd7xHvIsU0xRbHVOQgidgMJQmjf4E 4S/T3tovD+e1ahoSCBkZslLs/13pMstmDxz5tPd2mHwsFfLiklSaRUcKmtdkGPTc da3VFFOjYlYB4ps4dkd7Vv6zgl4ZQJLMXZyoBsYrAax4k3eLuheVj/inZIqZFHvO LqJPdCM34QurFXIOQmlo7sQnOvWPgc2ASdctV46lHTSJA6USIhbt9A== =KAj+ -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Remember the Blackout
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 5 Feb 1997 19:12:47 -0500 (EST) To: Multiple Recipients of e$pam <e$pam(a)intertrader.com> From: e$pam(a)intertrader.com (e$pam) Reply-To: e$(a)thumper.vmeng.com X-Comment: To unsubscribe, send any email to e$pam-off(a)intertrader.com Precedence: Bulk Subject: Remember the Blackout X-orig-from: dwiner(a)well.com (DaveNet email) X-e$pam-source: owner-davenetworld(a)wired.com Forwarded by Robert Hettinga ----------------------------------------------------------------------- X-Sender: dwiner(a)mail.well.com Mime-Version: 1.0 Date: Wed, 5 Feb 1997 13:23:02 -0800 To: jonl(a)microsoft.com (Jon Lazarus), hopmann(a)holonet.net (Alex Hopmann), anna(a)LivePicture.com (Anna Godfrey), scotty1024(a)aol.com (Scott Turner), 577-7433(a)mcimail.com (Bobby Orbach), mwhutch(a)aol.com (Michael Hutchinson -- AOL Webmaster), rsiegelman(a)kpcb.com (Russ Siegelman), davenetworld(a)wired.com, pdeziel(a)adobe.com (Pam Deziel), siegel(a)barebones.com (Rich Siegel), slove(a)netscape.com (Scott Love) From: dwiner(a)well.com (DaveNet email) Subject: Remember the Blackout Sender: owner-davenetworld(a)wired.com Precedence: bulk --------------------------------------- Amusing Rants from Dave Winer's Desktop Released on 2/5/97; 1:23:01 PM PST --------------------------------------- A short piece, in the middle of much website work, to remind everyone that Saturday February 8 is the first anniversary of an important event in our new medium -- the web blackout of 1996. It's already history. In some circles it's not fashionable to remember that the United States government attempted to censor free speech on the Internet. I believe it would be cynical to overlook it. We defeated the law, even though we re-elected many of the politicians who tried to outlaw free speech in the name of protecting children. I'm building a website that will go live on Saturday to commemorate the protest, and to serve as a monument to the spirit of free speech. To remind us that this is a worldwide community, and no political system has the power to enforce its standards of decency on the medium. The battle to retain our rights is ongoing. Important organizations such as the Electronic Frontier Foundation and the American Civil Liberties Union deserve and require our support. It's easy to lose sight of the principles that we believe in, to be distracted by questions of corporate survival, of fear or greed. These are interesting issues, no doubt. But this is a creative and expressive medium and to protect its potential, unqualified free speech is essential. I played a small role in the web blackout last year. This year I hope to facilitate, to organize more sites and help to spread the word that free speech is not an option, not something that can be traded or limited and that no compromises are possible. <http://www.scripting.com/davenet/misc/blackout/> If you run a democracy-related site, large or small, please visit the page before Saturday and register. If you know someone who does, please pass this on. And if you value free speech, please visit the site on Saturday or later. It'll be a fascinating trip thru Internet history, if nothing else! Remember the blackout. Remember why it was necessary. Don't let people use children as an excuse to deprive people of their power to express themselves. Dave Winer ------------------------------------------- News & Updates: <http://www.scripting.com/> -------------------------------------------------- The e$ lists are brought to you by: Intertrader Ltd - Java e$ Software Developers in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$pam? Help pay for it! See <http://www.atanda.com/rah.html> Or, for e$pam sponsorship, see <http://thumper.vmeng.com/pub/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> HTMLurgist: Cynthia Zwerling <mailto:czrider@@webstuff.apple.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

[CRYPTO] PGP
by Anonymous 17 Dec '03

17 Dec '03

Timmy C[reep] May has been beaten up numerous times by fellow prostitutes for driving blow job prices down. (((> /< ( / ((({{{{{:< \ \<

1 0

Re: Deloitte-Touche?
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Marshall Clow <mclow(a)owl.csusm.edu> writes: > Several people wrote: > >I wrote: > >>ObCrypto policy: > >> Was anyone else besides me amazed by the guy > >>from Deloitte-Touche at the Internet Privacy Coalition luncheon > >>last week? I mean, he all but advocated violent overthrow of > >>the government. [...] > > > >For the benefit of those of us who were not at this luncheon (probably > >not even in the same country), could you please say more about this, > >Marshall? What was the subject? What _did_ the DT speaker say, exactly? > > > After a while, I stopped taking notes, because I was so astounded at > what he was saying. > (Maybe someone with more complete notes could post a better summary) > > But, here a brief overview of the luncheon: > > Last Wednesday, January 29th, the Internet Privacy Coalition had > a "policy lunch" in San Francisco. It was in one of the hotels hosting > the RSA conference, and at the same time that the conference was > breaking for lunch, so it was easy for attendees to "switch lunches". > > The speakers (as I remember, apologies to any I miss) were: > Whit Diffie > John Gilmore > Kenneth Bass (counsel in Karn vs. Dept of State) > Herb Lin (who ran the NRC staff for the crypto study) > Marc Rotenberg > William Hugh Murray (Deloitte & Touche) > and a couple others that I missed, as I left early. > > Mr. Murray gave a long, impassioned speech. > > He said that the government is going to crack down on > domestic possession and use of crypto, that they > were looking to increase their wiretapping capabilities > 100-fold, and so on. > > He was very emphatic about not trusting anything > that the government says, and that once they got > their "foot in the door", that they would seek to > expand their abilities to regulate, etc, etc. > > He advocated deployment of strong crypto. He > insisted that there was no way the government > could stop the export of strong crypto. He exhorted > people to refuse to obey the ITAR/EAR regulations, > and to lobby their congresscritters to get the > PRO-CODE bill passed. > > > It wasn't really what he said that amazed me, because > I had heard most of it (in bits and pieces) before. It > was presenting it all in a package, in an emotional > manner, by an elderly, conseratively dressed > accountant who was representing a large > corporation whose job it is to help people obey the > government. > > [ My father was an accountant. He worked for > Deloitte-Touche, in fact. I don't expect accountants > to be passionate about government regs, and > especially not to advocate disobediance. Maybe > that's why this affected me so strongly. ] > > -- Marshall > > Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> > > Warning: Objects in calendar are closer than they appear. > > I think Bill Murray might take offense at being called an accountant. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

At 09:09 PM 2/4/97 -0800, jim bell wrote: >At 08:15 PM 1/28/97 -0800, Steve Schear wrote: >>>The poor can not hope to match the tyrants bid as they only have 10% of the >>>wealth, the household knows that thier participation in an attempt on the >>>tyrant will get them killed. Even if the attempt was successful. >>>The people from the outside who would benefit from the bounty benefit more >>>by taking the tyrants offer and then trying again, i.e. tiger teams. >> >>I think a hole in your thinking is to assume that the assasins have no >>motive other than financial gain. I would submit that there are those that >>have the skills, training and a political agenda coherent with the >>wagerers, lacking only the financial incentive to make the risks >>acceptable. These wetworkers won't consider accepting the bribe of the >>rich/powerful ... > >However, fortunately I don't think it would make any difference in the >overall effects. While AP would eliminate the taxation which is commonly >thought of as the main way a "rich person" loses assets, in practice it >would also shut down the well-hidden systems that allow some people to get >rich (or, merely live off somebody else) "unfairly." Government agents >come to mind, of course. > The money doesn't necessarily come from taxation, the owner of a business takes a cut of whatever money is made even if that person is unproductive. The tyrant would be the owner of the industry. If you are right then governments would effectively lose the ability to tax, with or without representation, as most people do not agree on everything, like how their money is spent. However, even now, as pointed out in some recent posts, our tax money is used to foreward the goals of a few, these few want to eliminate guns, crypto, free speech, ect. Although we are in oppostition, our money is still used to foreward the goals. Not unlike what I heard about the U.S.S.R. in vietnam. The following is according to my source. When the Soviet Ambassitor to the U.N. was sick, thats when the aid to vietnam could begin, as the U.S.S.R was not there to veto it. Now the U.S.S.R. was forced to aid both sides, those that were in agreement with them politically, and the U.N., of which they were a member. End of source data. Even those who oppose the taxes would be forced to pay as it would be the army that would be collecting. Then they could take the remaining monies that they had to target the leaders, who would use the tax revinues to protect themselves. If more money was needed, nore taxes would be collected. If it were a private corporation, the wages of the workers would be reduced on occassion to pay for the different security systems of the owner. Additionally, under our current system, the assassin would have his day in court, perhaps he could escape the government, making the cost-benefit analysis skewed in favor of crime. Under a system as proposed, the assassin would be forced do deal with a more powerful curse. Insurance companies would be reconfigured to anonymously see to the death of whatever caused the death of thier clients. They would make money because if the death could be ruled accidental, they would not have to pay. If the person died of a heart attack, and the food taster didn't, (the food taster would probably be the cooks son by the way), then the bond that the tyrant had with the company would be void. The company would cash the check. If the tyrant wanted to insure h[is/er] survival, (s)he would take out several of these bonds, with different companies, each with a signature amount to give to the executors to check their loyalty. If the company paying 1295065 dollars didn't pay up, the executors would tell the world. The idea is, where a layer can be subverted, duplicate the layer so that at least one element is bound to work.

1 0

Re: More on Cellular Encryption Docs
by Sean Roach 17 Dec '03

17 Dec '03

At 12:39 AM 2/5/97 -0800, Bill Stewart wrote: >>>>Here's more on the controlled documents for cellular encryption >>>>from TIA/EIA we described in a 26 January post to cpunks: >... >>>Of course, ITAR as recently modified says it's ok to send this >>>stuff overseas to foreigners, as long as it's on paper. >>>There may be separate restrictions on sending it, or on copying, >>>but they're based on copyright or contractual non-disclosure. >> >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >These are text, perhaps with occasional illustrations, so the current >interim export rules say it's ok. > >For optically-scannable printed data, the government's announcement says >it reserves (somehow) its right (acquired in unspecified manner :-) >to re-evaluate the exportability at a later time. I think they >haven't settled on whether they'd be more embarassed by banning it >(which bans export of printed material, risking serious Constitutional >challenges) or by not banning it (having people laugh at them while >exporting source code or even binaries in OCR-A on loose-leaf paper >with page numbers and checksums.) ... Let's not tempt them with something that the common person on the street would consider computer media, I.E. punched cards and dataglyphs. Remember the old fonts that used to be everywhere? The ones with the thickened letters at key places? Look at a check some time, that is the type of font at the bottom, its designed to be readable by both man and machine. Print out the source code in one of those fonts and mail that. This is not as data intensive as the other way, but at least it can be argued that it can be read by an unaided person. That way, on the other end, the text can be scanned in directly, using a modified form of check clearing software, and converted into electronic media, sans errors.

1 0

MA Electronic Records and Signature Act
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 5 Feb 1997 19:08:30 -0500 (EST) To: Multiple Recipients of e$pam <e$pam(a)intertrader.com> From: e$pam(a)intertrader.com (e$pam) Reply-To: e$(a)thumper.vmeng.com X-Comment: To unsubscribe, send any email to e$pam-off(a)intertrader.com Precedence: Bulk Subject: MA Electronic Records and Signature Act X-orig-from: EskWIRED <eskwired(a)shore.net> X-e$pam-source: bounce-dcsb(a)ai.mit.edu Forwarded by Robert Hettinga ----------------------------------------------------------------------- Date: Wed, 5 Feb 1997 17:27:30 -0500 (EST) From: EskWIRED <eskwired(a)shore.net> To: dcsb(a)ai.mit.edu Subject: MA Electronic Records and Signature Act MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: EskWIRED <eskwired(a)shore.net> A discussion draft of the MA Electronic Records and Signatures Act is now available on the web at http://www.magnet.state.ma.us/itd/legal/mersa.htm. The draft appears to be very preliminary--entire sections are marked [under development]. It is notable for its brevity, especially compared to the Utah Statute. Noticeably absent is any language dealing with licensure of certification authorities (bravo!). A link is provided for submission of public comments to Ray Campbell and Dan Greenwood. ========================================================= ---------EskWIRED(a)shore.net------------ ========================================================= ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu -------------------------------------------------- The e$ lists are brought to you by: Intertrader Ltd - Java e$ Software Developers in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$pam? Help pay for it! See <http://www.atanda.com/rah.html> Or, for e$pam sponsorship, see <http://thumper.vmeng.com/pub/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> HTMLurgist: Cynthia Zwerling <mailto:czrider@@webstuff.apple.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

http://www.cnn.com Congressman demonstrates ease of cell phone snooping

1 0

Re: Getting into MIT is impossible
by jim bell 17 Dec '03

17 Dec '03

At 04:50 PM 2/5/97 +0100, P.J. Westerhof wrote: >At 18:12 4-02-97 -0800, you wrote: >>Erland van Lidth de Jeude is a MIT grad. He played the big badass in "Stir >>Crazy." Computer science major, BTW. >> >He is quite a singer too (at least he was some years ago on Dutch TV). >Perhaps that made the difference. ;-) He was on the fourth floor of the west parallel of East Campus, in about 1977 as I recall. I was on the third floor. He was a wrestler; I heard he didn't have to work all that hard, he could just sit on the opponent and he'd win. Jim Bell jimbell(a)pacifier.com

1 0

Re: Letter Re: Kahn Supporting GAK
by jim bell 17 Dec '03

17 Dec '03

At 05:16 AM 2/5/97 +0000, Robert Rothenburg 'Walking-Owl' wrote: >My letter to Long Island Newsday regarding David Kahn's pro-GAK >editorial was published today. You can read it at > > http://www.newsday.com/mainnews/rnmi052u.htm > >What's odd (?) is how they editied it. I directed my comments toward >Mr. Kahn's views, which they changed to "Newsday" (odd, since I've >never seen them print an editorial one way or another on GAK; does >this mean they are taking a stand? -- Kahn is an editor at Newsday). > >I wrote "The greatest flaw in the argument is it's very reason, >'criminals... are increasingly using encryption to conceal their plans >and activities'" which they changed to "It reports...". I never >considered an op-ed piece as "reporting", even if it states a fact. But which "criminals," exactly, are "increasingly using encryption to conceal their plans and activities"? Let's not concede this unless it's really true. It would be far more accurate to say that it's likely that many people who are politically hostile to their government are using encryption in anticipation of persecution by the government, persecution that could easily come in the form of criminal charges. Jim Bell jimbell(a)pacifier.com

1 0

mail list / sequence number & signature
by Corey Minter 17 Dec '03

17 Dec '03

Have the list maintainers ever considered either or both of the following... (Sorry in advance if this has been brought up sometime in the past.) o adding a digital signature from "owner-cypherpunks(a)toad.com", so someone can't mass mail the mailing list and make it appear that the message came from toad.com. I just tried to figure out if the id in the header is in any order but I couldn't tell. I have already deleted many messages so some numbers are missing anyway. o adding a sequence number to every message which comes through toad.com, so recipients can easily notice if mail is be accidentially or intentionally filtered by their service provider or any other forces. At the same time, you could add the current numbers for flame vs. non-flame. This would help end all the bandwidth wasted on people speculating about the numbers. say there are X total messages, Y non-flames, and Z flames then the appearance to subscriber (either in the subject or some header field) could be... list type | all non-flame flame ---- | --- --------- ----- non-flame | X (non-flame Y) Y (all X) flame | X (flame Z) Z (all X) -- Of course... these are my opinions, not my employer's. ______________________________________________________________________ Corey Minter | cminter(a)mipos2.intel.com | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

Good point: but I've seen a few refs from LEAs about "Drug Dealer X who we can't talk about" or "Child Pornographer Y who we can't talk about" (in lieu of cases being digested by the court system) so I didn't harp on that point. A point I did leave out was that if they already knew these people were criminals and were building cases against them, monitoring them enough to know they used crypto, then do they really need to bother with listening in to the exact message? I wanted to emphasize the phallacy of the sacrifical lamb of rights in the name of the god of security. Also, they mungled the letter enough, so it's better for LI Newsday (which caters to a reading level of the average 12-year-old) submissions to be kept short and sweet. I'm quite surprised that mine is the only letter they printed. Certainly they would have gotten more than one submission on a controversial subject? --Rob On 5 Feb 97 at 18:22, jim bell wrote: > But which "criminals," exactly, are "increasingly using encryption to > conceal their plans and activities"? Let's not concede this unless it's > really true. > > It would be far more accurate to say that it's likely that many people who > are politically hostile to their government are using encryption in > anticipation of persecution by the government, persecution that could easily > come in the form of criminal charges. > > > Jim Bell > jimbell(a)pacifier.com > > ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

pgpmail 4.5
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

you wrote: There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b can someone clear this up?

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

http://www.cnn.com Congressman demonstrates ease of cell phone snooping

2 1

Re: Getting into MIT is impossible
by jim bell 17 Dec '03

17 Dec '03

At 04:50 PM 2/5/97 +0100, P.J. Westerhof wrote: >At 18:12 4-02-97 -0800, you wrote: >>Erland van Lidth de Jeude is a MIT grad. He played the big badass in "Stir >>Crazy." Computer science major, BTW. >> >He is quite a singer too (at least he was some years ago on Dutch TV). >Perhaps that made the difference. ;-) He was on the fourth floor of the west parallel of East Campus, in about 1977 as I recall. I was on the third floor. He was a wrestler; I heard he didn't have to work all that hard, he could just sit on the opponent and he'd win. Jim Bell jimbell(a)pacifier.com

1 0

Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Robert Hettinga 17 Dec '03

17 Dec '03

At 4:05 pm -0500 2/5/97, Mark Voorhees wrote: >I'm almost certain that Murray is a consultant rather than >or in addition to an accountant. He's been saying these things >for years at conferences, in papers, on mailing lists, etc. For the longest time, I've had a couple of people from dtus.com on my e$pam feed. They signed on when I started my own list out of www-buyinfo. About 6 months ago, however, mail to them started bouncing out of e$, the chat list I set up as an adjunct to e$pam. Which makes sense, because that's when they stopped chatting about e$. :-). I expect that the same thing happend to e$pam, though Rachel Wilmer, who is my e$pam listmaster would have seen it, and not I. Actually, e$ has become something of a watering hole, now with about twice as many subscribers as e$pam does. Some cypherpunks among them. Oh. While we're all talking about moderation, e$pam is a sort of filtered superset of cypherpunks. I have filtered cypherpunks posts in it, but I also have stuff from the 50-odd mail lists and 70 news groups I follow. The total feed can reach 300k a day sometimes, mostly because I include the full text of stuff like some of John Young's articles, and the text of the occasional web-page which tickles my fancy. Sort of immoderate moderation. :-). You can subscribe to it on my web page, which is in my .sig, below. I've a bunch of people working with me now on e$pam, who, among other things, are in the process of getting it set up in a searchable archive. Though, to prevent crawlers from seeing all the juicy bits (cf. Mr. Young, above), we're probably going to have some kind of certificate-access scheme when we get it all running. Rodney Thayer, who's doing IPSEC stuff, (among other things :-)), is going to run a quick-and-dirty generic certification authority to make that happen. In the meantime, if you're interested in e$, or financial crypto, or other stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" :-)), you might want to check it. Even though cypherpunks is a lot "cleaner" now, and I did encourage Sandy in his efforts initially, I suppose I'm now weighing in with (horrors!) Tim on the subject of moderation. I think that if Sandy and John want to create a moderated list (like I have done, though e$pam is more specific in content) out of what happens on cypherpunks, they could do it with exactly the traffic they have now in experimental moderation mode. The current machine load doesn't seem to be impacting the throughput to cypherpunks(moderated), modulo Sandy's moderation time, though if toad.com's being used for much else, there might be problems there. Part of the nice thing about cypherpunks 1.0 was that anything could happen there. That it was anarchy in practice. And, maybe because of my periodic altercations with Mr. May on this list (thank god for his kill-file :-)) even the anonymous Tim-slams were occasionally entertaining, in a, ahem, biologically curious sort of way. ;-). So, I guess I think we should put it back the way it was. Including, please Mr. Gilmore, "officially' resubscribing the Wee-vil Dr. V. Then those who've made it so can annouce to the world that cypherpunks is again a proper anarchy. Then we can us deal with miscreants the way we used to, by ignoring them, (and the occasional e-mailbomb...). Finally, I have an analogy for cypherpunks from nature. There are lots of plants, some of them the technically the largest living beings on earth, which, at first glance, look like a bunch of different individual plants. Aspen groves, for instance, are all linked together under the soil to the same system of roots, and are genetically the same individual. Some of these "stands" of trees cover tens of square miles, and one patch of Aspens, in Wyoming? Montana? is the world's largest living thing, massing several million(?) tons, and probably tens of thousands of years old. Fungi do this too. Toadstools (a rather, heh, fecund analog for cypherpunks) tend to create very large "individuals", with each toadstool representing the fruiting body for a huge bunch of mycyillia(sp?) underneath it. Toadstools create structures called, ahem, "fairy rings", where the central mushroom dies, only to be replaced by a ring of other mushrooms, which die, and so on, until they're covering your whole fucking lawn and messing up your lawnmower bag... (well, anyway, you get the idea.) There was the claim a few years ago that the same genetic individual slime mold covered half of Wisconsin (Minnesota?). The king of all the plants which do this, I think, is the cresote bush, which, I believe, in some pieces of the Sonorran(sp?) desert, cover hundreds of square miles. Scientists, using tree-ring dating, have worked back, through various rings of cresote bushes, using their very slow growth rates in the desert environment, to the center of the creosote bush cluster, to estimate the date of these things. I remember claims that these plants may have started from a single individual, there at the long dead (or at least regrown-over) center of the ring, more than a hundred, and maybe several hundred thousand years ago. So, let nature take its course. Most lists die when people stop posting to it. That certainly hasn't happened to cypherpunks. And, when it does, we can all migrate out into the numerous rings of lists that cypherpunks has spawned (I think I can account about putting together 10 or so myself) among them. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

3 2

pgpmail 4.5
by Huge Cajones Remailer 17 Dec '03

17 Dec '03

you wrote: There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b can someone clear this up?

1 0

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

1 0

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

mail list / sequence number & signature
by Corey Minter 17 Dec '03

17 Dec '03

Have the list maintainers ever considered either or both of the following... (Sorry in advance if this has been brought up sometime in the past.) o adding a digital signature from "owner-cypherpunks(a)toad.com", so someone can't mass mail the mailing list and make it appear that the message came from toad.com. I just tried to figure out if the id in the header is in any order but I couldn't tell. I have already deleted many messages so some numbers are missing anyway. o adding a sequence number to every message which comes through toad.com, so recipients can easily notice if mail is be accidentially or intentionally filtered by their service provider or any other forces. At the same time, you could add the current numbers for flame vs. non-flame. This would help end all the bandwidth wasted on people speculating about the numbers. say there are X total messages, Y non-flames, and Z flames then the appearance to subscriber (either in the subject or some header field) could be... list type | all non-flame flame ---- | --- --------- ----- non-flame | X (non-flame Y) Y (all X) flame | X (flame Z) Z (all X) -- Of course... these are my opinions, not my employer's. ______________________________________________________________________ Corey Minter | cminter(a)mipos2.intel.com | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Letter Re: Kahn Supporting GAK
by jim bell 17 Dec '03

17 Dec '03

At 05:16 AM 2/5/97 +0000, Robert Rothenburg 'Walking-Owl' wrote: >My letter to Long Island Newsday regarding David Kahn's pro-GAK >editorial was published today. You can read it at > > http://www.newsday.com/mainnews/rnmi052u.htm > >What's odd (?) is how they editied it. I directed my comments toward >Mr. Kahn's views, which they changed to "Newsday" (odd, since I've >never seen them print an editorial one way or another on GAK; does >this mean they are taking a stand? -- Kahn is an editor at Newsday). > >I wrote "The greatest flaw in the argument is it's very reason, >'criminals... are increasingly using encryption to conceal their plans >and activities'" which they changed to "It reports...". I never >considered an op-ed piece as "reporting", even if it states a fact. But which "criminals," exactly, are "increasingly using encryption to conceal their plans and activities"? Let's not concede this unless it's really true. It would be far more accurate to say that it's likely that many people who are politically hostile to their government are using encryption in anticipation of persecution by the government, persecution that could easily come in the form of criminal charges. Jim Bell jimbell(a)pacifier.com

1 0

Re: Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

Good point: but I've seen a few refs from LEAs about "Drug Dealer X who we can't talk about" or "Child Pornographer Y who we can't talk about" (in lieu of cases being digested by the court system) so I didn't harp on that point. A point I did leave out was that if they already knew these people were criminals and were building cases against them, monitoring them enough to know they used crypto, then do they really need to bother with listening in to the exact message? I wanted to emphasize the phallacy of the sacrifical lamb of rights in the name of the god of security. Also, they mungled the letter enough, so it's better for LI Newsday (which caters to a reading level of the average 12-year-old) submissions to be kept short and sweet. I'm quite surprised that mine is the only letter they printed. Certainly they would have gotten more than one submission on a controversial subject? --Rob On 5 Feb 97 at 18:22, jim bell wrote: > But which "criminals," exactly, are "increasingly using encryption to > conceal their plans and activities"? Let's not concede this unless it's > really true. > > It would be far more accurate to say that it's likely that many people who > are politically hostile to their government are using encryption in > anticipation of persecution by the government, persecution that could easily > come in the form of criminal charges. > > > Jim Bell > jimbell(a)pacifier.com > > ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Re: Deloitte-Touche?
by Bruce M. 17 Dec '03

17 Dec '03

On Wed, 5 Feb 1997, Marshall Clow wrote: > Mr. Murray gave a long, impassioned speech. > > He was very emphatic about not trusting anything > that the government says, and that once they got > their "foot in the door", that they would seek to > expand their abilities to regulate, etc, etc. > > He advocated deployment of strong crypto. He > insisted that there was no way the government > could stop the export of strong crypto. He exhorted > people to refuse to obey the ITAR/EAR regulations, > and to lobby their congresscritters to get the > PRO-CODE bill passed. > > It wasn't really what he said that amazed me, because > I had heard most of it (in bits and pieces) before. It > was presenting it all in a package, in an emotional > manner, by an elderly, conseratively dressed > accountant who was representing a large > corporation whose job it is to help people obey the > government. I was in attendance at an ISSA conference earlier this year where Mr. Murray gave the "keynote" speech on Electronic Commerce. While he did strongly advocate the adoption of strong crypto and various methods of security, he never stepped into the more radical mode of encouraging people to break the law. That was a different audience though. As he is also an ex-25 year IBM veteran it amazes me that he would make such a public outcry against govt. regulations (okay, so it's a stereotype). Deloitte & Touche must really have a big stake in the pro-crypto market or else he actually cares a lot. ____________________________________________________ [ Bruce M. - bkmarsh(a)feist.com - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "We don't want to get our butts kicked by a bunch of long-haired 26-year-olds with earrings." -- General John Sheehan on their reasons for InfoWar involvement

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 04:35 PM 2/5/97 -0800, Sean Roach wrote: >At 09:09 PM 2/4/97 -0800, jim bell wrote: >>However, fortunately I don't think it would make any difference in the >>overall effects. While AP would eliminate the taxation which is commonly >>thought of as the main way a "rich person" loses assets, in practice it >>would also shut down the well-hidden systems that allow some people to get >>rich (or, merely live off somebody else) "unfairly." Government agents >>come to mind, of course. >> >The money doesn't necessarily come from taxation, the owner of a business >takes a cut of whatever money is made even if that person is unproductive. >The tyrant would be the owner of the industry. The kind of effects I'm thinking of are primarily the "military spending" situations, where: 1. Large numbers of potentially competent and useful people get put into useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. (Those people who still think military spending is really necessary obviously haven't read AP.) 2. Large amounts of money are spent on military hardware, money which goes to fund people who would otherwise develop useful products in the non-government private sector. 3. The patent system decreases competition, increases profits and prices in the marketplace due to government actions to allow and enforce monopolies. 4. Government employees are paid more for their activities than they would receive in the private sector. Ironically, in this case an "apples-to-apples" comparison is misleading: It would be wrong to compare a middle level government manager to his counterpart in private industry, because to postulate there is such a government-job assumes that the private-sector would do it post-AP. >If you are right then governments would effectively lose the ability to tax, >with or without representation, as most people do not agree on everything, >like how their money is spent. However, even now, as pointed out in some >recent posts, our tax money is used to foreward the goals of a few, these >few want to eliminate guns, crypto, free speech, ect. Although we are in >oppostition, our money is still used to foreward the goals. Yes, the main effect of AP is the elimination of the ability to tax. Now, nothing would prevents individuals from continuing to fund an organization called a "government" so that it could do those (non-coercive) things that individual wants to see done. But I think it'll be amazing how many of those heretofore-funded-by-govt projects (previously promoted as being wanted by a large fraction of the citizenry) that evaporate when the public is given the option to continue to fund them voluntarily. Let's suppose, hypothetically and for vast simplification, the government engages in two activities, "A" and "B." Further suppose government taxes from two groups, let's call them "Alphas" and "Betas." It is traditionally thought that Alphas like spending on "A", but hate spending on "B". Likewise, it is figured that Betas like spending on "B", don't like spending on "A". Post-AP, one might innocently suspect that maybe the "Alphas" would simply fund only "A", while Betas" would donate money for activity "B". Assuming the amount of funding for those activities was equal, you might think that things could go on as they already do. But no. The reality is that "Alphas" merely like spending on "A" _more_ than they do "B", and they will tolerate their own money being used for both only because the "Betas" are similarly forced. Add volunteerism to the whole mix, and not only would these two groups only fund just what they really wanted, they would soon discover they don't even want the level of spending they previously argued for, pre-AP. In practice, those services people like will continue, but it is highly unlikely that they will be supply by organizations which evolve from those currently called "governments." Jim Bell jimbell(a)pacifier.com

1 0

Re: John's: In anarchy -everyone responsible
by jim bell 17 Dec '03

17 Dec '03

At 02:41 PM 2/5/97 +0000, Attila T. Hun wrote: > >+Put simply, "anarchy is not the lack of order. It is the lack of >+_orders_." > > disagree. pure anarchy is not the lack of "orders" --pure anarchy > implies that everyone is imbued with that perfect sense of > responsibility. >From which hat do you pull this rabbit? > >+> anarchy is only possible in an ideal world where _everyone_ >+> assumes not only responsibility for themselves, but for the common >+> good. no malice, no greed, no need for assassination politics.... > >+No, that's traditional thinking and that's wrong. See AP part 8. >+Freud believed (as "everyone" else believed, even myself, before AP) >+that anarchy was inherently unstable. But it ISN'T, if the tools of >+AP are used to stabilize it. And no, no altruism is necessary for AP >+to work as well; no individuals are being asked to sacrifice >+themselves for the common good. Rather, they are given the >+opportunity to work to achieve a reward offered, cumulatively, by a >+number of citizens. > > aah, but that is the difference between a _pure_ anarchy and a > _popular_ anarchy. A pure _anarchy_ is sufficiently idealistic in > that _noone_ lacks the necessary resonsibility to keep society > moving, each individual in their own niche. Why, exactly, is it "necessary" to "keep society moving"? Isn't that somewhat of a contradiction in terms? (particularly when you are discussing the subject, "anarchy." It seems you don't really understand what the word "anarchy" means. Sigh. > As long as there is > perfect responsibility in a perfect anarchy, then there is no need > for AP. Are you saying that for a world that has ALREADY achieved anarchy, and we presume "perfect responsibility," AP is not necessary to maintain this state? Well, that's a rather limited assertion; some would argue it's practically meaningless. Isn't that somewhat like saying, "A perfectly-balanced inverted pendulum needs no mechanism to keep it pointing straight up."? True, perhaps, but how do you get that "perfectly-balanced" part right? > AP is a negative, or _punative_, influence; I might liken it to the > Catholic Church which is a religion of fear, and an instrument of > political control. Actually, it's quite the opposite: AP is the absolute prohibition on and/or destruction of any "instrument of political control." Now, to a person who thinks that the natural state of the world is a condition of political control (and it wouldn't be hard to understand why a person could come to this conclusion, given the bulk of history), the ABSENSE of political control "looks like" political control. This is, obviously, akin to the optical illusion where you stare intently at a pattern of color on a page (the American flag is often used) for a minute or two, and then you suddenly glance towards a white sheet of paper on which, as I recall, immediately appears a complementary flag of green and black stripes, and black stars on a yellow field. AP destroys the mechanisms that societies use for much political control. Jim Bell jimbell(a)pacifier.com

1 0

Re: mail-to-news fun
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:18 AM 2/6/97 -0000, you wrote: >Unfortunately, you don't really have a choice about what kind of >speech you are supporting if you run a remailer. Don't fall into the >trap of saying, "I want to give people complete freedom of anonymous >speech... EXCEPT...." As abhorrent as we may find the homophobic >hatemongers from the "freedom-knights" list, I guarantee a lot of >politicians would object more strongly to the "Help, I might be gay >and my parents will kill me" post. Once you set up a system for >content-based censorship, don't think you can stay in control of it. The problem isn't homophobic hatemongers who use their own names or nyms or no name, or even get my remailer's name associated with that - I can reply to complaints or file them in the handy bit bucket. The problem is forgers signing _other_ people's names to their hatemonger postings, causing the innocent third party to catch all the flames that the forger was trying to generate. Stewart wrote: >> On the other hand, I don't want to support postings titled >> "ALL FAGS MUST DIE" with a forged signature and email at the bottom, >> and I especially don't want to post that from my remailer without >> indicating that anything posted by a remailer might be forged. >> That's why I shut down my previous remailer - the forger only >> posted one forged message; the person whose name got forged >> got flamed severely by dozens of people who objected to "her" posts. >> Blocking the gay newsgroups cuts down on that kind of trolling, >> but also cuts out the "Help, I might be gay and my parents will kill me" >> traffic that remailers are supposed to help with. Guess I should have been more clear.... >As for forgery, I do add > X-Warning: Sender address is unverified and may not be authentic. >to every article that goest through my mail2news gateway. Does anybody read X-Warning: headers? Not all newsreaders even show all the headers. It's a good start, and that's clearly the place in the system to insert it. >Additionally, I have a fast source-blocking system set up, so anyone >in whose name articles are being forged can immediately stop it by >mailing <srcblk-request(a)nym.alias.net>. (This doesn't source-block >them from the remailers, just the non-anonymizing mail2news gateway.) That helps, at least if the spammer is doing a lot of it (or if the spam is from a broken gateway program or whatever.) But for the troll that killed my remailer, one message was enough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 04:35 PM 2/5/97 -0800, Sean Roach wrote: >At 09:09 PM 2/4/97 -0800, jim bell wrote: >>However, fortunately I don't think it would make any difference in the >>overall effects. While AP would eliminate the taxation which is commonly >>thought of as the main way a "rich person" loses assets, in practice it >>would also shut down the well-hidden systems that allow some people to get >>rich (or, merely live off somebody else) "unfairly." Government agents >>come to mind, of course. >> >The money doesn't necessarily come from taxation, the owner of a business >takes a cut of whatever money is made even if that person is unproductive. >The tyrant would be the owner of the industry. The kind of effects I'm thinking of are primarily the "military spending" situations, where: 1. Large numbers of potentially competent and useful people get put into useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. (Those people who still think military spending is really necessary obviously haven't read AP.) 2. Large amounts of money are spent on military hardware, money which goes to fund people who would otherwise develop useful products in the non-government private sector. 3. The patent system decreases competition, increases profits and prices in the marketplace due to government actions to allow and enforce monopolies. 4. Government employees are paid more for their activities than they would receive in the private sector. Ironically, in this case an "apples-to-apples" comparison is misleading: It would be wrong to compare a middle level government manager to his counterpart in private industry, because to postulate there is such a government-job assumes that the private-sector would do it post-AP. >If you are right then governments would effectively lose the ability to tax, >with or without representation, as most people do not agree on everything, >like how their money is spent. However, even now, as pointed out in some >recent posts, our tax money is used to foreward the goals of a few, these >few want to eliminate guns, crypto, free speech, ect. Although we are in >oppostition, our money is still used to foreward the goals. Yes, the main effect of AP is the elimination of the ability to tax. Now, nothing would prevents individuals from continuing to fund an organization called a "government" so that it could do those (non-coercive) things that individual wants to see done. But I think it'll be amazing how many of those heretofore-funded-by-govt projects (previously promoted as being wanted by a large fraction of the citizenry) that evaporate when the public is given the option to continue to fund them voluntarily. Let's suppose, hypothetically and for vast simplification, the government engages in two activities, "A" and "B." Further suppose government taxes from two groups, let's call them "Alphas" and "Betas." It is traditionally thought that Alphas like spending on "A", but hate spending on "B". Likewise, it is figured that Betas like spending on "B", don't like spending on "A". Post-AP, one might innocently suspect that maybe the "Alphas" would simply fund only "A", while Betas" would donate money for activity "B". Assuming the amount of funding for those activities was equal, you might think that things could go on as they already do. But no. The reality is that "Alphas" merely like spending on "A" _more_ than they do "B", and they will tolerate their own money being used for both only because the "Betas" are similarly forced. Add volunteerism to the whole mix, and not only would these two groups only fund just what they really wanted, they would soon discover they don't even want the level of spending they previously argued for, pre-AP. In practice, those services people like will continue, but it is highly unlikely that they will be supply by organizations which evolve from those currently called "governments." Jim Bell jimbell(a)pacifier.com

1 0

Re: your mail
by Declan McCullagh 17 Dec '03

17 Dec '03

Heh. On the ISP-TV show that Brock Meeks and I co-host, two weeks ago we not only described how easy it was to modify a handheld radio, we had a guest who demo'd cell-snooping on the air. -Declan On Wed, 5 Feb 1997, Bovine Remailer wrote: > http://www.cnn.com > > Congressman demonstrates > ease of cell phone snooping > > > > >

1 0

Re: mail-to-news fun
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:18 AM 2/6/97 -0000, you wrote: >Unfortunately, you don't really have a choice about what kind of >speech you are supporting if you run a remailer. Don't fall into the >trap of saying, "I want to give people complete freedom of anonymous >speech... EXCEPT...." As abhorrent as we may find the homophobic >hatemongers from the "freedom-knights" list, I guarantee a lot of >politicians would object more strongly to the "Help, I might be gay >and my parents will kill me" post. Once you set up a system for >content-based censorship, don't think you can stay in control of it. The problem isn't homophobic hatemongers who use their own names or nyms or no name, or even get my remailer's name associated with that - I can reply to complaints or file them in the handy bit bucket. The problem is forgers signing _other_ people's names to their hatemonger postings, causing the innocent third party to catch all the flames that the forger was trying to generate. Stewart wrote: >> On the other hand, I don't want to support postings titled >> "ALL FAGS MUST DIE" with a forged signature and email at the bottom, >> and I especially don't want to post that from my remailer without >> indicating that anything posted by a remailer might be forged. >> That's why I shut down my previous remailer - the forger only >> posted one forged message; the person whose name got forged >> got flamed severely by dozens of people who objected to "her" posts. >> Blocking the gay newsgroups cuts down on that kind of trolling, >> but also cuts out the "Help, I might be gay and my parents will kill me" >> traffic that remailers are supposed to help with. Guess I should have been more clear.... >As for forgery, I do add > X-Warning: Sender address is unverified and may not be authentic. >to every article that goest through my mail2news gateway. Does anybody read X-Warning: headers? Not all newsreaders even show all the headers. It's a good start, and that's clearly the place in the system to insert it. >Additionally, I have a fast source-blocking system set up, so anyone >in whose name articles are being forged can immediately stop it by >mailing <srcblk-request(a)nym.alias.net>. (This doesn't source-block >them from the remailers, just the non-anonymizing mail2news gateway.) That helps, at least if the spammer is doing a lot of it (or if the spam is from a broken gateway program or whatever.) But for the troll that killed my remailer, one message was enough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: John's: In anarchy -everyone responsible
by jim bell 17 Dec '03

17 Dec '03

At 02:41 PM 2/5/97 +0000, Attila T. Hun wrote: > >+Put simply, "anarchy is not the lack of order. It is the lack of >+_orders_." > > disagree. pure anarchy is not the lack of "orders" --pure anarchy > implies that everyone is imbued with that perfect sense of > responsibility. >From which hat do you pull this rabbit? > >+> anarchy is only possible in an ideal world where _everyone_ >+> assumes not only responsibility for themselves, but for the common >+> good. no malice, no greed, no need for assassination politics.... > >+No, that's traditional thinking and that's wrong. See AP part 8. >+Freud believed (as "everyone" else believed, even myself, before AP) >+that anarchy was inherently unstable. But it ISN'T, if the tools of >+AP are used to stabilize it. And no, no altruism is necessary for AP >+to work as well; no individuals are being asked to sacrifice >+themselves for the common good. Rather, they are given the >+opportunity to work to achieve a reward offered, cumulatively, by a >+number of citizens. > > aah, but that is the difference between a _pure_ anarchy and a > _popular_ anarchy. A pure _anarchy_ is sufficiently idealistic in > that _noone_ lacks the necessary resonsibility to keep society > moving, each individual in their own niche. Why, exactly, is it "necessary" to "keep society moving"? Isn't that somewhat of a contradiction in terms? (particularly when you are discussing the subject, "anarchy." It seems you don't really understand what the word "anarchy" means. Sigh. > As long as there is > perfect responsibility in a perfect anarchy, then there is no need > for AP. Are you saying that for a world that has ALREADY achieved anarchy, and we presume "perfect responsibility," AP is not necessary to maintain this state? Well, that's a rather limited assertion; some would argue it's practically meaningless. Isn't that somewhat like saying, "A perfectly-balanced inverted pendulum needs no mechanism to keep it pointing straight up."? True, perhaps, but how do you get that "perfectly-balanced" part right? > AP is a negative, or _punative_, influence; I might liken it to the > Catholic Church which is a religion of fear, and an instrument of > political control. Actually, it's quite the opposite: AP is the absolute prohibition on and/or destruction of any "instrument of political control." Now, to a person who thinks that the natural state of the world is a condition of political control (and it wouldn't be hard to understand why a person could come to this conclusion, given the bulk of history), the ABSENSE of political control "looks like" political control. This is, obviously, akin to the optical illusion where you stare intently at a pattern of color on a page (the American flag is often used) for a minute or two, and then you suddenly glance towards a white sheet of paper on which, as I recall, immediately appears a complementary flag of green and black stripes, and black stars on a yellow field. AP destroys the mechanisms that societies use for much political control. Jim Bell jimbell(a)pacifier.com

1 0

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

2 1

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

[NOISE] Sphere packing
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dimwit Virus K[rust]OfTheMonth styles his facial hair to look more like pubic hair. (___) (o o)_____/ @@ ` \ Dimwit Virus K[rust]OfTheMonth \ ____, / // // ^^ ^^

1 0

[PGP] Cats out of bags
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dr.Destitute Violent K[arcinogen]OTM is so in love with himself, he cries out his own name when orgasming. Then again, no one else is ever around. /\ /\ + \______/ + / . . \ < / > Dr.Destitute Violent K[arcinogen]OTM \ \--/ / ------

1 0

Tapping these resources.
by WIZZYH2H＠aol.com 17 Dec '03

17 Dec '03

I noticed that there are several programs that will let anyone send encrypted email. What about encrypted messages over a chat system like irc, chat rooms(aol, BBS) and systemwide messages (IM, whisper, private message)? The server wouldn't have to do anything except send the messages, the users software could handel all the protocols and message identification. Dialup and logon features aren't needed either, allmost all cilents will let you shell. I have been looking for, and tring to write a program to do this, but Im a rookie programmer and my attempts have yet to produce a functional send/receive utility. Where are programs like this.. are there any to be found? wizzyh2h(a)aol.com OR wizzy(a)juno.com

1 0

Re: Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:09 PM 2/5/97 -0500, Robert Hettinga wrote: >In the meantime, if you're interested in e$, or financial crypto, or other >stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" >:-)), you might want to check it. I think that Bob's e$ list should be considered a viable alternative to the other two filtered cpunks lists; I recommend it to people looking for a moderated alternative to the list. (I get e$, but use Eudora and procmail to suck out the duplicates where messages are copied from lists I already get.) He also finds a lot of the stuff that used to show up on cpunks but doesn't any more because people have wandered away. I've been meaning to write up a long message explaining why I think I'm about to drop off of the list. It's peculiar to spend a lot of time discussing things with a group of people over the course of several years and then disappear without saying why. But I'm having trouble coming up with anything more profound than "it's not interesting any more." Philosophically, I agree with Lucky - it looks to me like it's time to kill the list and move on to other things. But that's not my choice to make, and perhaps other people can still extract something useful from this. More power to them if they can. I'm starting to think that cpunks may be similar to college, in that it's a good thing for a few years, but if you stick around too long you just get bitter and cranky and frustrated because the new people keep talking about the same old problems. Don't they know we've already talked about that? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvmSHP37pMWUJFlhAQGu3Qf/WTpImfcNb4883V2h/JHKsZh1hWR+hrSH e7hgtUAujphktzteZi6NqC47QEQHRIbgT/SRHelDB4lJLPv3TtIN09ZUwK6GWb/F QfmoyPXBVfM5Pt/FqPqtPpXnehC7r71SO0jQ2qKqTrhcuSDYNmOjtCrjK/BIEJ7l mMYcxY7JKBq0H8u1BNzZaMfCkEvDytUejgsevusWGGfkwodUSTon81Kbxmy7Yg2w 3vOmESgMz2Vm2av2bHTYBy3CSy3JzB8m2OPQo+Wang6WJDfvJaDaALGuHgem8PH8 0jCjBww2vEOJ0xj62oQ/mD2heEe+TZZnDZ5ZRynID1wOOm7SOOOeAg== =+SRl -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: pgpmail 4.5
by Alex de Joode 17 Dec '03

17 Dec '03

Huge Cajones Remailer sez: : you wrote: : There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. : The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. : i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b : can someone clear this up? [usura@basement]:/pub/ftp/pub/crypto/incoming {22}$ md5 pgpmail45.exe 5ea438501d0133f0849c2fe8f9125b6b pgpmail45.exe -- -AJ-

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

bite your penis. /_/\/\ \_\ / Tim C[reep] May /_/ \ \_\/\ \ \_\/

1 0