December 2003 - cypherpunks-legacy

Test files for encryption
by Steve O 17 Dec '03

17 Dec '03

Can someone point me to any standard files that are used when testing encryption strength. Iie i'm looking for a gourp of files that may have been used by an agency or Internet group in the past that when encrypted were tested for byte frequency etc. as well as cryptoanalytic atacks. thanks in advance. steveo privsoft(a)ix.netcom.com

1 0

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 03:30:46 EST, you write: << > >You could also timestamp the software so that it only runs for a given > >length of time. This will encourage people to upgrade regularly. ;-) > >> If anyone thinks it is anything but trivial to track down a call for time/date and a comparison of the two.. and then overwrite the area with some nop's to make sure the address jumps come out the same.. your sadly mistaken =-}

1 0

C2Net Party: January 24th
by sameer 17 Dec '03

17 Dec '03

http://www.c2.net/party/ C2NET is having a party January 24th at 654 Mission St. San Francisco assorted snacks, a cash bar and live music by WEIRD BLINKING LIGHTS with dj accompaniment by DJ FLINT and DJ PINNIPED will be present for your enjoyment Festivities begin at 8PM We hope to see you there --- Directions: >From the West or North: Take Oak Street East. Turn left on Laguna. Turn right on Fell. Fell crosses Market and becomes 10th Street. Merge left within one block of Market. Turn left on Mission. >From the East: Take Hwy 80 West across the Bay Bridge. Take the first exit on the left (Harrison Street exit) Turn left on Harrison. Turn right on 3rd Street. Turn right on Mission. >From the South: Take Hwy 280 North. Follow 280 to its end at 4th & King Streets. Follow King Street to its end at 3rd Street. Turn left on 3rd. Turn right on Mission. >From BART: Take BART to the Montgomery station Walk south on New Montgomery Street Turn right on Mission. Parking: There is a commercial parking lot across the street on Mission and another one on the corner of 3rd and Mission.

1 0

Re: Executing Encrypted Code
by Hal Finney 17 Dec '03

17 Dec '03

From: Ben Byer <root(a)bushing.plastic.crosslink.net> > [Quoting Peter Hendrickson:] > > The software vendor would be wise to check that the public key was > > legal. It would be a simple matter for the manufacturer to publicize > > all public keys that had been installed on chips. > > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Probably an easier way would be for the chip manufacturer to issue a key certificate (signature) on the chip keys. Then it is a trivial matter for any software manufacturer to verify that a proferred chip key is legit; just check the cert. > > One approach is for the manufacturer to authenticate software submitted > > by approved vendors. The vendors are then tasked with encrypting it > > for the correct processor. > > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. Hey, it's a free world, right? Some people only run authenticated code from big companies; other people turn off the authentication bit in the CPU and can run any old thing they stumble across on the net. Everybody's happy. The first group doesn't have to worry about viruses, or at least they have somebody to sue if they see one, and the second group gets to run all the freeware and PD code they can today. > Right; the only reason I could see people using this would be for > economical reasons. Yes, I think this is a point often missed in these discussions. People say, why would I want a CPU which will limit the software I can run, something which will let a software maker give me a version of his program which will only run on my CPU and which I have no ability to share with others? What's in it for me? The answer presumably is that the software manufacturer will sell software with such limits for much less than he will sell unlimited software. That's because software piracy is such a major problem, and this way he can be protected against piracy from this copy of his program. So people with these CPU's can buy their software a lot cheaper. Now if you only use pirated software anyway, which you get for free, then obviously this is not much of an incentive. It is only for people who pay for their software. But that is a significant market. Of course the big downside is that the track record of tamper resistant hardware has not been too strong lately! If a system like this gets into widespread use and somebody finds out that shooting X-rays at the chip exposes its secret key, you've got a big problem. Hal

2 1

Key Escrow Rule
by John Young 17 Dec '03

17 Dec '03

The Federal Register of December 13, 1996 has published "Licensing of Key Escrow Encryption Equipment and Software" This parallels the draft regulations for encryption export provided by Steptoe & Johnson on December 11 but sets provisions specifically for key escrow products. We've put it at: http://jya.com/ke121396.htm (39 kb) Here are excerpts from the opening: ----------------------------------------------------------------------- This interim final rule amends the Export Administration Regulations (EAR) by imposing national security controls on Key escrow information security (encryption) equipment and software transferred from the U.S. Munitions List to the Commerce Control List following a commodity jurisdiction determination by the Department of State. This interim final rule also amends the EAR to exclude key escrow items from the de minimis provisions for items exported from abroad and to exclude key escrow encryption software from mass market eligibility. Further, key escrow encryption software is subject to the EAR even when made publicly available. ... Once transferred, key escrow encryption items will be controlled for national security reasons. A license will be required from the Department of Commerce to all destinations, except Canada. This is an initial step in liberalizing the treatment of encryption exports. The Bureau of Export Administration is preparing regulations to further implement the Administration's encryption policies, which will be published in the Federal Register in the near future. ...

1 0

BXA Crypto Meeting
by John Young 17 Dec '03

17 Dec '03

Federal Register: December 12, 1996 ----------------------------------------------------------------------- Bureau of Export Administration Information Systems, Technical Advisory Committee; Notice of Partially Closed Meeting A meeting of the Information Systems Technical Advisory Committee will be held January 7 & 8, Room 1617M-2, in the Herbert C. Hoover Building, 14th Street between Constitution and Pennsylvania Avenues, NW., Washington, DC. This Committee advises the Office of the Assistant Secretary for Export Administration with respect to technical questions that affect the level of export controls applicable to information systems equipment and technology. January 7 General Session 9:00 a.m.-12:00 p.m. 1. Opening remarks by the Chairmen. 2. Presentation on Office of Exporter Services outreach program. 3. Update on status of Export Administration Regulations. 4. Public discussion on encryption issues. 5. Other comments or presentations by the public. Closed Session 6. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. January 8 Closed Session 7. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. The General Session of the meeting is open to the public and a limited number of seats will be available. To the extent time permits, members of the public may present oral statements to the Committee. Written statements may be submitted at any time before or after the meeting. However, to facilitate distribution of public presentation materials to the Committee members, the Committee suggests that public presentation materials or comments be forwarded at least one week before the meeting to the address listed below: Ms. Lee Ann Carpenter, TAC Unit/OAS/EA, Room 3886C, Bureau of Export Administration, U.S. Department of Commerce, Washington, DC 20230 Dated: December 6, 1996.

1 0

Life with Dale
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:From: Dale Thorn <dthorn(a)gte.net> :I spent part of my growing up years in Leroy West Virginia, pop. :about 15, give or take. I know about hillbillies, and I know about :guns. :If you had the impression I am a whiner, or that that defines me as a :person, you're about as clueful as the other old farts who attack :people they don't know anything about. Name one thing Dale has not experienced.

5 12

Solidarity with Peruvian Guerrilla!
by aaron＠burn.ucsd.edu 17 Dec '03

17 Dec '03

** See list of useful Web sites at end of this post! ** Companer@s, I am writing this while I am tired and should be asleep, since I think that this matter is too urgent to delay. I apologize for any careless formulations. By now, you all know that the Peruvian guerrilla group MRTA (Movimiento Revolucionario Tupac Amaru) has occupied the mansion of the Japanese ambassador in Lima and is holding several hundred prisoners. Unless you are in an unusual part of the world, you also have seen how the bourgeois media are discussing the matter as a problem of how to deal with 'terrorists.' For the working people and all the oppressed and exploited of the world, and for socialists, communists, and anarchists, the seizure of the ambassador's residence along with about 400 bourgeois dinner guests is a great accomplishment. It is a blow against the terrorism of the Peruvian state and its imperialist patrons! Those captured in the raid include many members of the Peruvian and international ruling elite, including the head of Peru's secret police! It will be politically very difficult for the Peruvian state to launch a military attack as a means of resolving the crisis, since that would create quite a few 'illustrious corpses' and lead to a falling out among bourgeois sectors.. (And it would be difficult to get the world's poor majority to join the bourgeoisie in mourning its dead!) It seems that there is already a falling out between Fujimori and the Japanese over Fujimori's refusal, so far, to negotiate. It is very important that the situation in Lima not be resolved in a way that can be seen as a victory for the bourgeoisie. It is our task to publicize who the real criminals are in Peru and to help wring concessions from the Peruvian dictatorship. In particular, we should demand the release of all political prisoners and prisoners of war from Peru's hideous torture-chamber prisons. In this context, let's not get involved in sectarian battles among the various factions of Peru's anti-government left. Whatever differences the groups have, and these are very serious, we must keep in mind that the Peruvian state and its imperialist backers (in Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political prisoners must be released, whether of MRTA, the PCP (Shining Path) or neither. Thanks to the widespread publicity given to the events in Lima, many more people will be interested in what we have to say about Peru than normally would. Let's organize demonstrations at Peruvian Embassies, Consulates, airline offices, etc. Let's raise our voices in whatever forum may be available to defend the heroic guerrillas and to denounce the real terrorists. --In solidarity, --Aaron <aaron(a)burn.ucsd.edu> P.S. Plans are being made for a demonstration at the Peruvian Consulate in San Francisco, California -- probably on Monday, December 23. If you live in the area, please send me an e-mail message. Otherwise, do what you can in your area! SOME USEFUL WEB SITES: Web site on the current crisis: <http://burn.ucsd.edu/~ats/mrta.htm> What Are The Goals Of Your Embassy Occupation? -- Interview With Norma Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In Peru: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> Partial list of hostages: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> MRTA's web site in Europe: <http://www.cybercity.dk/users/ccc17427/> Lima's best bourgeois newspaper (in Spanish): http://ekeko.rcp.net.pe/LaRepublica/

2 2

Dale defends free society from the NSApunks (was Re: Encryption ?
by nobody＠replay.com 17 Dec '03

17 Dec '03

I thought this was so funny I've saved it. Perhaps we could vote on the quality of Dale's ideas and arrive at an estimate of the proportion of NSA supporters on the list. THE AKOND OF SWAT :Date: Thu, 19 Dec 1996 07:36:03 -0800 :From: Dale Thorn <dthorn(a)gte.net> :To: SHARK <otaner(a)boun.edu.tr> :Cc: cypherpunks(a)toad.com :Subject: Re: Encryption ? : :SHARK wrote: :> :> I am a Mathematic student at Bosphorus University in Turkey. :> I am interested in both computer applications and mathematical base of :> encryption.Where can I find this kind of staff on internet. :> Is it necessary to have high level of mathematical background in order to :> deal with encryption?? :> :> By the way Is there any member of this list from Turkey? : :There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. : :That is the main reason they accuse people of being snakeoil vendors, :to discourage people from inquiring about really new ideas, like some :of my ideas for example. : :Just so you know....

3 2

some clarification of jurisdiction in Berstein (long)
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- the question: ::I've seen two other reports (one from NBC) that say the ruling ::only covers the one federal district. ::Any lawyers want to clarify? The caveat: the following is a personal opinion and is not, in any way, to be considered either legal opinion or legal advice. Hire an attorney who specializes in these issues before you do anything rash which might qualify you for three hots and a cot. Basically, jurisdiction is all a question of who wants to honor whose decision until a higher level either affirms or rejects the lower court ruling (or sends it back w/o a full ruling but requiring a review of some part of the decision by the lower court). Generally speaking, the decision is valid for the Northern District of California, but a Federal district judge anywhere in the U.S. can make a concurring decision based on citing Judge Patel's decision that source code is protected under Amendment 1. In other words, the cite is valid anywhere, and can be used as the basis of a decision. Likewise, another district judge somewhere in the U.S. can issue a contrary ruling, still citing Judge Patel's ruling, but disagreeing with its tenants; or even ignore the decision and forge new ground. The basic rule of thumb is each federal judge is 'Judge Roy Bean, Law West of the Pecos' in his own courtroom, and able to virtually ignore even USSC rulings by claiming the action is not the same for some silly reason. He may be reversed on appeal... As for Judge Roy Bean, there have been a number who might qualify for the type in the Ninth Circuit who come to mind: Manny Real in LA, Hadder in LA, Foley in Vegas, and one in El Paso (whose name escapes me --maybe Peck), who was assassinated, probably by the drug trade, about 20 years ago. These are mavericks with a high percentage of cases reversed on appeal. Two of the four are of questionably diminished mental abilities, one was of questionable ethics, and one is just plain nuts --or at least off the wall (IMHO). I have not read the full Bernstein decision as yet, but I understand there are a fair number of unresolved issues such as binary objects. This again can spawn additional test cases, either by someone challenging the issue as Bernstein challenged the source code, which I consider was the correct decision as anyone can read source --understanding source code may be more difficult than reading a bad Russian translation of the nuances in Alice in Wonderland for some... (your mileage may vary...) Leaving government appeals out of the equation, if there are two or more district courts within an appeals circuit, whose fundamental opinion: 'source code is protected under Amendment 1 rights' do not agree, the obvious step is for the Ninth Circuit Court of Appeals, either by a 3 judge panel, or a full court review, to take jurisdiction and decide which of the two opinions suits their fancy. If a 3 judge panel does not give the decision expected, there is also a possible review by a full court on the motion of either party. Now, suppose the Ninth Circuit affirms Judge Patel. At that point every district court within the jurisdiction of the Ninth Circuit uses the Bernstein case as a given, an affirmed precedent; the rulings will reflect that unless some clever clown adds a twist and the judge falls for it. Again, setting aside appeals, there are multiple circuit appeal regions. None of these are bound by the Ninth Circuit decision, but it is a citation of importance. Now, if there are significantly different opinions in the appeal circuits, then the Supreme Court will decide whether they will accept the decisions for review, deciding which decision is valid; or the USSC can ignore it. Personally, I would publish anything regardless. I've had more than one go around with the simpletons. The first time the goons in gray trenchcoats shake you out of the rack in the early morning, there is a real adrenalin rush; after that it's: "Oh, shit, you guys again, who wants some coffee?" Whatever you do: keep your mouth shut; even teh previous thought is risky the assholes might charge you with attempted bribary of a Federal official. I have been quiet for 20 years; as you get older you get a lot more cranky, and less concerned with your welfare. You know: "strike another blow for Liberty, FUCK the CDA" and so on. Be a martyr; give your all for the cause. Eventually you end up in Springfield, Missouri, home for Federal Criminally Insane political victims. Larry Flynt (Hustler) managed to get away from the Feds who can hold an "insane" individual in their custody indefinitely: certifying him insane with one hand, while the other hand gives him a chemical lobotomy. Larry Flynt was sent to Springfield by a Federal Judge in LA for contempt of court --wearing an American flag as a diaper in his wheelchair (paraplegic). Unless you're a little crazy, I don't think I would start publishing source code yet. Oh, I expect it would be difficult for the Feds to get convictions with a strong precedent decision. But, keep in mind, federal judges are appointed on the basis of an ad in the local bar rag: 'wanted: middle aged person with failing law practice and good political connections.' A Federal judge is appointed for life; after age 65 they are able to choose cases which interest them; most of them seem to die on the bench (some would dispute they were ever alive on the bench). It's been said, "what do you call a lawyer with an IQ of 40?" "Your, Honour." If you wish to lay down the bait trail in the Northern California district, by all means, go ahead, but you might find yourself charged in a criminal action, and the government presenting a case that your charges are 'different' than the Bernstein case: Bernstein just wanted to publish an academic paper, you are charged with violation of the munitions act and maybe treason and espionage. And, always remember your opponent is a drug-crazed 800 lb gorilla with a mission: conviction. This case is the big one: Bernstein was the plaintiff, in a civil action. You will be the _defendant_, in a criminal action. I would not put a scenario like this past the DOJ scum; maybe multiple times to try and obtain results which match their corroded mental image of peace, prosperity, and union harmony. The DOJ is not interested in either justice or the Bill of Rights. Federal attorneys are striving for high conviction rates, like Vietnam body counts --and are enforcing the policies of the administration, not the courts, the constitution, or the people. If you managed to get here through the convoluted logic, I would be careful of how you loosen the floodgates. At this point we have made a statement which is a serious breach of their armor. We obviously need additional test cases to clarify the position, and the decision must ultimately be decided by the USSC. I would caution for another reason: if the Feds choose a preferred defendant who is flagrant, obnoxious, and on flaky ground; _they_ may have a good precedent, not us. Academic challenges are certainly among the best --a bit easier to make the point for education than for pornography. The next step IMHO, should be a challenge that object code is just a shipping container for the source code. == I'll get a life when it is proven and substantiated to be better than what I am currently experiencing. --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMrp6r704kQrCC2kFAQHx/gP6AoTCk7gEIjylULrXJcTS+QnOtV8Ic5s1 R0iPC0q3/67z9kROekOGOGkD1SRD8umnrO5rb7NRgJDBpdSzt1Hlp+FWZlH1HgZQ HmR0FZ6QUy1JKC9QJrw0oNTCaful/u4UHTAQLi4R8sTSx1RM/uWfR4Lw4kMKSQ11 Xa6hPWcvNZE= =Of3t -----END PGP SIGNATURE-----

1 0

FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Fri, 20 Dec 1996 07:32:52 -0500 (EST) >From: "Fred B. Ringel" <fredr(a)rivertown.net> >To: pgp-fone(a)rivertown.net >cc: pgp-users list <pgp-users(a)rivertown.net> >Subject: Mailing List Archive >Hi all- > > Finally got around to doing something I had meant to do. I have set >up an HTML-ized version of the PGPfone Mailing List archives. It is >reachable off the PGP Fone Registry, but the exact URL is : > > http://pgp.rivertown.net/pgp-fone/archives > >Now any newcomers to the list will find it easier to catch up, or if you >need to look something up, the archives are indexed by date, author, >and subject/thread. Hope you find it useful. Until I figure out how to >update it automatically over an NFS mounted system, I will manually update >them at least once a week. > > I'm sending this to PGP-Users too so anyone interested in the >PGPfone list can get a taste of what is going on there. The PGPFone list is >up to almost 100 subscribers and growing (tell your friends!!) > > Fred >/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ >Fred B. Ringel -- Rivertown.Net Internet Access >Systems Administrator -- http://www.rivertown.net >and General Fixer Upper -- Voice/Fax/Support: +1.914.478.2885 > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:42 AM 12/20/1996, Bill Frantz wrote: >At 11:16 PM -0800 12/19/96, Peter Hendrickson wrote: >> Or, you could turn in the broken processor and have the manufacturer >> certify that it was turned in to the software vendors and that >> a new version of the software should be generated. > I meant processor backup of course. When my processor breaks at 2AM and I > need to get the report out by 8AM, I'm going to call the software support > line and get help. If your processor dies you are SOL whether or not you have software. If it's worthwhile having a backup processor around, then you just have to spend a little more to have backup software, too. > Or the friendly hardware manufacturer is going to come > right out and certify my processor is dead. Come on and get real. With > most software vendors I can't even submit a bug report. If the reissuance of software is not possible (which I don't believe), it's an acceptable risk. Processors die far far less often than disks, and disks are getting pretty reliable. If the software companies can't get it together to reissue software, then it would certainly be easy to sell processor insurance to people who wanted it. This would allow them to replace their ~$10,000 software library. (You can buy theft insurance for roughly the same payoffs, so it's a feasible business. Theft is harder to verify and in my judgement occurs much more frequently than processor failure.) > Note that I am not saying there is a technical problem here. I do see big > problems with infrastructure and marketing. The last time software > companies tried to market copy protection, it failed in the market place. > I predict that encyphered instruction streams will too, and for the same > reasons. If the old copy protection just worked, it would have been widely accepted. Old copy protection had many problems. It didn't stop piracy. Sometimes it crashed your machine. Some schemes worked on some Intel machines but not on others. Backups were a problem. Etcetara. Peter Hendrickson ph(a)netcom.com

3 2

Solidarity with Peruvian Guerrilla! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, MRTA is a bunch of terrorists, irrespective of whether the issues they are trying to deal with are legitimate. They have threatened to kill people if they don't get their way. This alone is enough for me to not support them. They also have taken their internal bitch outside their unhappy home and involved other nationalities. If they were my neighbors I would call the cops and if allowed on the jury I would give them the max. What I would suggest is that the Japanese take as many of the MRTA out as they possibly can. I support the Japanese. Screw the MRTA and the Peruvian government, little Hitlers are little Hitlers. Banzai! Jim Choate CyberTects Forwarded message: > From cypherpunks-errors(a)toad.com Fri Dec 20 14:21:00 1996 > Message-Id: <v02130501aee03559777a(a)[136.152.11.117]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 20 Dec 1996 06:16:20 -0800 > To: aaron(a)burn.ucsd.edu (All recipients) > From: aaron(a)burn.ucsd.edu (Aaron) > Subject: Solidarity with Peruvian Guerrilla! > Cc: nyt(a)blythe.org (nyxfer), seac+nafta(a)ecosys.drdr.virginia.edu, > bc05319(a)binghamton.edu (TAZ), BAYLEFT(a)cmsa.Berkeley.EDU, > red-skinheads-l(a)eart.com, anarchy-list(a)cwi.nl, spg-l(a)xs4all.nl, > LABOR-L(a)YORKU.CA, a-infos(a)lglobal.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > ** See list of useful Web sites at end of this post! ** > > Companer@s, > > I am writing this while I am tired and should be asleep, since I think that > this matter is too urgent to delay. I apologize for any careless > formulations. > > By now, you all know that the Peruvian guerrilla group MRTA (Movimiento > Revolucionario Tupac Amaru) has occupied the mansion of the Japanese > ambassador in Lima and is holding several hundred prisoners. Unless you are > in an unusual part of the world, you also have seen how the bourgeois media > are discussing the matter as a problem of how to deal with 'terrorists.' > > For the working people and all the oppressed and exploited of the world, > and for socialists, communists, and anarchists, the seizure of the > ambassador's residence along with about 400 bourgeois dinner guests is a > great accomplishment. It is a blow against the terrorism of the Peruvian > state and its imperialist patrons! Those captured in the raid include many > members of the Peruvian and international ruling elite, including the head > of Peru's secret police! It will be politically very difficult for the > Peruvian state to launch a military attack as a means of resolving the > crisis, since that would create quite a few 'illustrious corpses' and lead > to a falling out among bourgeois sectors.. (And it would be difficult to > get the world's poor majority to join the bourgeoisie in mourning its > dead!) It seems that there is already a falling out between Fujimori and > the Japanese over Fujimori's refusal, so far, to negotiate. > > It is very important that the situation in Lima not be resolved in a way > that can be seen as a victory for the bourgeoisie. It is our task to > publicize who the real criminals are in Peru and to help wring concessions > from the Peruvian dictatorship. In particular, we should demand the release > of all political prisoners and prisoners of war from Peru's hideous > torture-chamber prisons. In this context, let's not get involved in > sectarian battles among the various factions of Peru's anti-government > left. Whatever differences the groups have, and these are very serious, we > must keep in mind that the Peruvian state and its imperialist backers (in > Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political > prisoners must be released, whether of MRTA, the PCP (Shining Path) or > neither. > > Thanks to the widespread publicity given to the events in Lima, many more > people will be interested in what we have to say about Peru than normally > would. Let's organize demonstrations at Peruvian Embassies, Consulates, > airline offices, etc. Let's raise our voices in whatever forum may be > available to defend the heroic guerrillas and to denounce the real > terrorists. > > --In solidarity, > --Aaron <aaron(a)burn.ucsd.edu> > > P.S. Plans are being made for a demonstration at the Peruvian Consulate in > San Francisco, California -- probably on Monday, December 23. If you live > in the area, please send me an e-mail message. Otherwise, do what you can > in your area! > > SOME USEFUL WEB SITES: > > Web site on the current crisis: > <http://burn.ucsd.edu/~ats/mrta.htm> > > What Are The Goals Of Your Embassy Occupation? -- Interview With Norma > Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In > Peru: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> > > Partial list of hostages: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> > > MRTA's web site in Europe: > <http://www.cybercity.dk/users/ccc17427/> > > Lima's best bourgeois newspaper (in Spanish): > http://ekeko.rcp.net.pe/LaRepublica/ > >

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 7:43 AM 12/20/1996, Hal Finney wrote: >> The manufacturer is going to publish a list of ALL of the public keys? >> We're talking one key per chip, right? Isn't that an AWFUL lot of >> keys, like, in the millions range? > Probably an easier way would be for the chip manufacturer to issue a > key certificate (signature) on the chip keys. Then it is a trivial > matter for any software manufacturer to verify that a proferred chip > key is legit; just check the cert. Now why didn't I think of that! >>> One approach is for the manufacturer to authenticate software submitted >>> by approved vendors. The vendors are then tasked with encrypting it >>> for the correct processor. >> I'm not sure the "approved" bit would go over too well... one idea >> would be to license the compiler writers, who would build the >> encryption into compilers. It's still not horribly great, but >> better. > Hey, it's a free world, right? Some people only run authenticated > code from big companies; other people turn off the authentication > bit in the CPU and can run any old thing they stumble across on the net. > Everybody's happy. Maybe not everybody. My scheme would not let you turn off the authentication bit. That means that if somebody does find way to get at the secret key, they still can't run the code without doing something expensive with particular processors. Basically, this won't be worth the trouble. > The first group doesn't have to worry about viruses, > or at least they have somebody to sue if they see one, and the second > group gets to run all the freeware and PD code they can today. The second group would have to buy a different processor altogether, the way I proposed it. But, that does not seem unreasonable. One could even imagine systems which have a "free" processor and a decrypting processor. While they would have to have completely different instruction sets, they could be pin compatible. >> Right; the only reason I could see people using this would be for >> economical reasons. > Yes, I think this is a point often missed in these discussions. People > say, why would I want a CPU which will limit the software I can run, > something which will let a software maker give me a version of his > program which will only run on my CPU and which I have no ability to > share with others? What's in it for me? > The answer presumably is that the software manufacturer will sell software > with such limits for much less than he will sell unlimited software. That's > because software piracy is such a major problem, and this way he can be > protected against piracy from this copy of his program. So people with > these CPU's can buy their software a lot cheaper. I agree with all of this. Some people might be happier if they think of this as just another kind of agreement that people can make. Right now the software development agreement is weak because piracy is so easy. We rely a little bit on the law and a whole lot on the integrity of customers. Really, that isn't ideal. It would be nice if people could make strong agreements to write software. My judgement is that software piracy is less of a problem in the U.S. than it is elsewhere. My impression is that there are many other countries in the world where the whole "I should help pay for the development of this software because I am using it" idea just doesn't really show up on the screen. This processor would make it possible to sell software to the whole world without really worrying too much about how well each government enforces its laws or how ethical the people in foreign countries are. > Of course the big downside is that the track record of tamper resistant > hardware has not been too strong lately! If a system like this gets into > widespread use and somebody finds out that shooting X-rays at the chip > exposes its secret key, you've got a big problem. Processors are really only good for 3 years or so. The vendor is only betting that attacks won't become widespread in that time period. That is not a perfectly safe bet, but it isn't bad. The attacks can exist, but so long as they are expensive or hard to generalize to all processors, the software vendors are safe. Peter Hendrickson ph(a)netcom.com

1 0

The CyberSitter Diaper Change, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

[From this morning's Netly News. Check out the HTML version of the article at netlynews.com for links to the threatening letters, etc. --Declan] The Netly News http://netlynews.com/ December 20, 1996 The CyberSitter Diaper Change By Declan McCullagh (declan(a)well.com) Brian Milburn is angry. The president of Solid Oak Software, makers of the CyberSitter Net-filtering software, has seen his company's product come under heavy fire this year. Its offense? Critics say that CyberSitter has reached far beyond its mandate of porn-blocking and instead has censored innocuous, even invaluable web sites. I admit I'm one of its critics. In a CyberWire Dispatch that Brock Meeks and I published in July, we revealed that the censorware bans such places as the International Gay and Lesbian Human Rights Commission and the online home of the National Organization for Women. Our Dispatch showed the world -- or at least our readers -- that the makers of CyberSitter have a clear political agenda. The article prompted follow-ups in CyberTimes and the National Law Journal and an editorial in the Washington Post with an exchange of letters to the editor between a NOW executive and a representative of Focus on the Family, a conservative group that markets CyberSitter. To Milburn's mind, our act of revealing the truth about his company's product was, literally, criminal. In August, he told us that he had asked the U.S. Department of Justice to launch a criminal investigation into the publication of our article. He was particularly upset with one paragraph that included a fragment of his database demonstrating that CyberSitter expressly bans info about gay society and culture. He wrote: "Your willful reverse engineering and subsequent publishing of copyrighted source code is a clear violation of US Copyright law. While we would easily prevail in a civil court in seeking damages... we will seek felony criminal prosecution under 17 USCS sect 503(a) of the Copyright Act, and are preparing documentation to submit with the criminal complaint to FBI [sic]." Milburn was upset because CyberSitter's database is scrambled to prevent kiddies from grabbing addresses of porn sites from it. It's lightweight encryption, sure, but just enough to frustrate Junior. The scrambled database also allows Solid Oak to add and delete banned sites without the user's knowledge -- something that we believe is a dangerous practice. Now, I should point out here that neither I nor Brock did the actual decrypting; we had received a copy of the descrambled filter list from a confidential source. In any event, Dispatch's attorneys replied to Milburn, saying that the article was "protected by the full force of the First Amendment to the United States Constitution" and fell squarely within the copyright act's "fair use" provisions. We never heard back from him or the FBI. But that nastygram from Milburn wasn't his last. As criticism of CyberSitter becomes more intense, he's stepped up his counterattacks, threatening legal action, blocking critics' sites, or both. Take Bennett Haselton, a college student who cobbled together a site called Peacefire in August. This fall he started an anti-CyberSitter page that listed some of the more controversial actions of the software. Milburn complained. On December 6 he wrote to Haselton's Internet provider, Media3 Technologies, and tried to persuade them to give Peacefire the boot. His e-mail said: "One of your subscribers has made it his mission in life to defame our product as he appearantly [sic] has a problem with parents wishing to filter their children's access to the internet." Another charge was that Haselton had linked to a copy of our Dispatch. Solid Oak then added Peacefire and Media3 to its list of blocked sites. To Marc Kanter, Solid Oak's marketing director, it was necessary. "The site directly has links to areas that have our source code decoded on it.... There's no reason that our users should be able to go to sites that effectually inactivate our program," he said. Milburn also accused Haselton of reverse-engineering CyberSitter to get the text of its database -- that is, of being the confidential source for the CyberWire Dispatch. "Reverse engineering had to have been done in order to get the information, and we believe Mr. Haselton was the one who did it," Milburn wrote. Note to Millburn: Haselton wasn't our source. Then there's the case of Glen Roberts. His web page giving instructions on how to disable CyberSitter is now banned -- as is his Internet service provider. That's because CyberSitter differs from its competitors CyberPatrol and SurfWatch, which can restrict access by URL; instead, CyberSitter has to block access to the entire ripco.com domain. So what's my problem, really? If people don't want to use CyberSitter or other nanny apps, they don't have to. It's voluntary. It's effective. It protects children, and it sure is better than the Communications Decency Act. I have one major objection to all of the software filters currently on the market: Consumers have no way of knowing what's being blocked. Without knowing what's on the filter list, parents can't know what Junior will or won't be seeing. When reporters who try to reveal that information are faced with potential criminal investigations, the press's ability to shed light on these companies is threatened. Such programs also give parents near-complete control over what their children can and can't read. Traditionally, kids have been able to browse the stacks of a library away from parental supervision. But when the library is online, access can be completely controlled by censorware. Pity the closeted gay son of homophobic parents, prevented by CyberSitter from accessing soc.support.youth.lesbian-gay-bi. Finally, it's a kind of intellectual bait-and-switch. The "smut blockers" grab power by playing to porn, then they wield it to advance a right-wing, conservative agenda. Family values activists would never have been able to pass a law that blocks as many sites as CyberSitter does. Besides censoring alt.censorship, it also blocks dozens of ISPs and university sites such as well.com, zoom.com, anon.penet.fi, best.com, webpower.com, ftp.std.com, cts.com, gwis2.seas.gwu.edu, hss.cmu.edu, c2.org, echonyc.com and accounting.com. Now, sadly, some libraries are using it. Solid Oak claims 900,000 registered users. ###

1 0

Re: Ebonics
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> wrote: >In order to remain compliant with the new California law requiring >increased use of "Ebonics," the new academic name for "Black English" (and >known by honkey mofos as "ghetto jive"). Apparently the coloreds have had >enough of "standard English" and its repression of their culture. To meet >the requirements of this new law, 10% of my posts from now on will be >written as best I can manage in the Ebonic language. ("Ebonics" elided) There's got to be a better way than Ebonizing manually. First there was the Canadianizer, eh, hoser? Then there was Zippy (www.metahtml.com/demos/zippy/) which is terrific for Willy/Freeh/Reno speeches. We really need an Ebonizer (TM)! BTW, Tim's not kidding about the Oakland, CA school system. Check your regular news source.

3 2

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 18:51:28 EST, you write: << How about the extra hard drive space you have to purchase because you can't just keep one copy on a server anymore? >> Well... considering most apps for client server (on the client machine) arent _huge_ (memory is so damn cheap anyway) Why on earth(forgive me if I am truly missing a point here) would you put all the copies on the server?

1 0

Yiddish humor
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

How do you call a "cypher punk" without AIDS? Gay gezund. How do you call a "cypher punk" with AIDS? Gay in drer. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Van Eck articles
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Looking for: > >"Protective Measures Against Compromising Electromagnetic Radiation Emitted by >Video Display Terminals" by Professor Erhard Moller, Aachen University, 1990 >(no source citation) I have a copy of the original German version of this, I can snail mail a copy if anyone wants to translate it. It has lots of graphs and diagrams which probably won't scan very well, and it will need translation before most of the people on the list can make any use of it. I know there are English versions floating around, but I've never seen one. BTW the work was done in the early '80's, not 1990. Peter.

1 0

nyetscape 3.x bug
by Psionic Damage 17 Dec '03

17 Dec '03

Has anybody noticed that netscape 3.x has a bug that brings the last page that I was on onto the next page that I go to, do I need to delete a history file or something, or does anybody have the answer to resolving this problem. Sincerely, PsiD pSIONIC dAMAGE Zer0 Faith Inc. www.geocities.com/SiliconValley/Heights/2608 H/P/A/V/C ANTIVIRUS/COUNTERSECURITY "ONLY THE ELITE SURVIVE!"

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:19 PM 12/20/1996, Andrew Loewenstern wrote: >Hal Finney writes: >> The answer presumably is that the software manufacturer will >> sell software with such limits for much less than he will sell >> unlimited software. That's because software piracy is such >> a major problem, and this way he can be protected against >> piracy from this copy of his program. So people with these >> CPU's can buy their software a lot cheaper. > I believe this is a pipedream. As it stands now, virtually all of the > software that requires special hardware dongles is ridiculously expensive, > even compared to similar offerings from other companies. Why do you think this is? I don't understand why I would buy a more expensive package that required a dongle rather than a less expensive package which does not. This is mysterious. Peter Hendrickson ph(a)netcom.com

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:29 PM 12/20/1996, Bill Frantz wrote: >At 11:52 AM -0800 12/20/96, Peter Hendrickson wrote: >> If it's worthwhile having a backup processor around, then you just have >> to spend a little more to have backup software, too. > I thought your model was cheap processors and expensive software. I.e.,. > The cost of the software is greater than the cost of the hardware. Sounds > like more than just "a little more". There's no reason why one software package would cost more than the machine. I was assuming you didn't need your whole software library to finish the report. I would expect software prices to drop because everybody using the software would be paying for it. I would also expect more kinds of software to become available. At any rate, I just don't see this as a major problem. Does anybody know how often processors break down these days? My guess is that it is less common than getting into a car accident and much less common than all the other factors that make reports late. If companies started metering software, then this problem pretty much evaporates. >> If the old copy protection just worked, it would have been widely accepted. > Again, there is a complex infrastructure which offers the customer no > obvious benefit. The obvious benefit is that when you purchase software you don't have to pay for software development for the people who don't pay. Few people find this objectionable in principle. It is not out of the question for software vendors to sell two versions of the same software. One is the piracy-free version and the other is the copy-as-much-as-you-can version. I would expect the piracy-free version to be substantially cheaper. (Of course, it is not out of the question that piracy boosts sales by advertising the product. We haven't seen a good experiment for determining this.) > I disagree that copy protection would have been widely accepted, even had > it worked smoothly. In fact, this scheme can be characterized as a scheme > to make copy protection work. Your characterization is accurate. Ignoring the particulars of this scheme, it would certainly be neat if people could sell software without it being pirated. Peter Hendrickson ph(a)netcom.com

6 5

Get All The Phrack Issues
by varange＠crl.com 17 Dec '03

17 Dec '03

For a ton of (mis)information, read Phrack. Rather than downloading an issue at a time, get it all at: http://www.crl.com/~varange/maillists/phrack.zip 0d0a text formatted. If you have a lot of paper: unzip -c phrack > /dev/lp0 Or something like: pkunzip -c phrack > prn -- Cheers!

1 0

Re: Code+Data separation
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >>Are there any modern processors which keep the code and data separated? > A Harvard architecture is a common feature of signal processing chips. A number of japanese DSP chips (especailly for image processing) in the early 90's used this approach. I believe some earlier models in the TI 34000 series did also. Not sure about the current crop. -- Steve

1 0

Re: Credentials without Identity--Race Bits
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:34 AM 12/20/96 -0800, Tim wrote: >At 1:22 AM -0800 12/20/96, Vangelis wrote: > >Umm.. tried to get on a flight without having ID lately? Doesn't work - > >against policy. Anti-terrorism policy and all.. it's for your own > >safety, of course. >At the risk of undercutting Bill's facetiousness, this was of course >precisely his point. Yeah. I've spent most of this year going around North America on airplanes a couple of times a month. Sometimes they insist on government ID, claiming (falsely) that it's a government regulation. Other times they insist on photo ID (probably correctly) claiming it's a government regulation (usually I fly electronic-ticket, which they ask for photo-ID for, and I don't mind that.) United is almost always satisfied with my employee-ID and the credit card I used to buy the ticket with, except that they don't bother telling curbside baggage-handlers that. And that's not even counting the "You must turn on your laptop" crap. And it's PRO-terrorism policy "Be afraid! Be very afraid!" It's just not something a civilized place would do. (Of course now that Ted "Accused Unabomber" Kaczynski is in jail, the Olympics are over and it's pretty obvious that TWA 800 exploded due to bad design//////////natural causes, they really _ought_ to either give our civil rights back or else find some other excuse for it, like "heavy Christmas traffic is an attractive target". But instead they've got announcements about "suspicious packages should be reported to security checkpoints immediately" and "cars parked in the Red Zone will be towed away and detonated".) At least they weren't doing most of this paranoia when I visited my sister earlier this summer, bringing a couple pounds of Silly Putty in my luggage as presents for her kids, packed near the alarm clock.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:17 PM 12/20/1996, Andrew Loewenstern wrote: > I think this whole idea of encrypted software and processors is pretty >poorly > thought out. Thank you for this encouraging remark. > How do you handle an organization with a site license for 20,000 users of a > piece of software? Do you issue 20,000 unique copies? Yes, that would be necessary. It isn't hard to tell which executable goes with which processor. The software vendor could give away a database to do it. Or, the software vendor could put all the executables up on a web site. What's the big deal? > Do you really think the lower price of the software is going to offset > the cost of an organization to manage all those processor certificates? Yes, I do. (BTW, the software might be sold for the same price, but be better in other ways.) > Site licensed software is already about as cheap as the companies are willing > to sell it. In the current business environment. One reason site licenses are sold to companies is to make piracy less encouraging. It also solves a difficult bookkeeping problem: "How many copies are we running? Are we in compliance with the law?" Actually, site licenses don't always solve this problem, but they sort of do. We don't really know what pricing and terms would look like in a piracy-free environment, we can only guess. My guess is that preventing piracy makes more software available for better prices. If metering is feasible, it would work out very well because customers no longer have to take a chance on software and can easily explore all of the options they have. > How about the extra hard drive space you have to purchase because you can't > just keep one copy on a server anymore? Let's assume 10MB of executable code per package. A gigabyte costs about $200 now. That comes out to about $2 extra expense per software package. > Think about what a nightmare it would be to update a piece of software on > 20,000 machines simultaneously!! It's hard enough to do it now!! Whoever is doing the updating just needs to be able to quickly get the right copy. That's easy because each software module is self-identifying as is each processor. You just need to be able to go out on the Net to the software vendor or internally and ask some machine for the particular copy you need. > What happens if a software company goes out of business? You are then > completely screwed when your processor dies or becomes obsolete. This is true. Most people make their software buying decision based on what it can do now and for the next few years. I believe that is rational. > Around here we still run a few pieces of ancient hardware that were pretty > pathetic back in 1988. The software on them is critical but won't run on > anything else and there is no source code available. Believe me, nobody > here would dare to make that mistake again!!! At least with our current > situation if the hardware dies we would probably be able to find a > replacement (and I'm sure there are some replacements waiting in the stock > room...). But with your encrypted processor we couldn't even do that! Yes, it would definitely be harder to keep a code museum. People who plan on doing that are encouraged to choose another platform and software set. > It seems to me that this is yet another scheme that basically does nothing > but seriously inconvenience the software user. Much like clipper, I believe > this is a dog that won't hunt!! I find it interesting that you compare this scheme to Clipper. Judging from the tone ("!!!") of your post, there is something about my scheme which you find upsetting. People usually don't get annoyed by schemes which won't work. (Even dumb unworkable schemes are a breath of fresh air on this list right now.) What I think you really don't like about my scheme is that you think it might work and you fear various mandatory GAP proposals that could follow its wide acceptance. I would be interested to hear more about these concerns. > Perhaps instead of trying to find a way to force users into paying, software > companies should concentrate on how offer more value and make their prices > seem more attractive. These are not either/or propositions. If the decrypting processor increases the revenue of software companies, it means people can make more money providing better products to their customers. > Even with piracy, the software industry is far and away the most profitable > of all!! There is no such thing as "profitable enough." Peter Hendrickson ph(a)netcom.com

1 0

re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 16:43:37 EST, you write: << I would suppose that one could hack the code to find the counter, assuming you could decompile it (or wanted to). >> Nope. Just a good debugger (Softice... Borland..etc) And not to mention there's a billion disassemblers on the net

1 0

Re: Flying on planes without ID
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 17:23:29 EST, you write: << Anyone have the current black-letter regulations? I'll have some time to kill over the holidays that might as well be used for civil disobedience. What's likely to happen to me if I refuse to show ID? Provide invalid ID, don't get caught, then publicize the fact? Provide invalid ID and get caught? Or, better: "My wallet was stolen. The only ID I have on me is my ACLU membership card and my PGP key. Can I still get on the plane?" >> Well, something of the sort happened to me... I didn't have my ID on me. (Delta airlines..) and they _WOULD_NOT_ let me on the plane without the proper ID. I actually had lost my ID shortly before... Then... A different time at the airport.. American airlines told me that If I didn't have ID.. Id still be let on... just that the way they process my baggage would be different ( I imagine they would physically look through it... Adam

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:25 PM 12/20/1996, Andrew Loewenstern wrote: >Peter Hendrickson writes: >> I would expect software prices to drop because everybody using >> the software would be paying for it. > I don't mean to sound rude or insult you personally, but this is utterly > absurd. If everyone is paying for the software then the company would be > making even MORE money. Only a fool would want to make less money!! If >money > wasn't important to these people they wouldn't be in the business of selling > software in the first place! > Aside from putting a gun to people's heads, the only thing that lowers >prices > is competition. Yes, I was assuming a free market. Sorry if that was not clear. Not only would software companies face competition in the decrypting-processor market, but they also face competition with other packages running on other platforms. Presumably customers would need some sort of reason to use the decrypting-processor. Some companies may choose lower price. > Only a fool would want to make less money!! I agree completely! >> It is not out of the question for software vendors to sell >> two versions of the same software. One is the piracy-free >> version and the other is the copy-as-much-as-you-can version. >> I would expect the piracy-free version to be substantially >> cheaper. > That would render the entire scheme pointless. It only takes _____ONE_____ > copy of the software to get out for the whole world to pirate it. This was discussed a few posts back. Let's say you manage to get the secret key out of the decrypting-processor. That gives you the executable which could run on any decrypting-processor. Since it is not authenticated (*) you can't run it on another decrypting-processor. You can run it in emulation someplace else, but a heavy performance price is paid. If the leading edge processors are all decrypting-processors, a very heavy performance price is paid. If the instruction set is kept secret, even writing an emulator could become hard. (* I am being inconsistent, incidentally. At one point I said that software would be authenticated once, but I now realize that to prevent multiple uses it has to be authenticated for use on a particular processor, too.) Peter Hendrickson ph(a)netcom.com

1 0

van Eck snooping
by azur＠netcom.com 17 Dec '03

17 Dec '03

I've done some experimentation in this area. It is not possible to use a VCR in a simplified manner anymore as all recent computer CRTs are no longer use a 60 Hz half-frame, interlaced, format. Reductions in radiated emissions, per FCC Part 15, since the earlt 80's have significantly raised the bar for remote monitoring (still possible though). -- Steve

1 0

Re: Credentials without Identity--Race Bits
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

aaron(a)herringn.com wrote: >Flew down to LA recently with a firearm (checked, of course). > >Looking over the ticket later, I was mildly surprised to find "GUN" in >a string of otherwise unintelligible text. This is a case of damned if you do, damned if you don't. The last time that I declared (as the legal notices at the check-in podium admonished me to do) a firearm in my luggage, my bag sported a large, chromium yellow GUN tag that also featured a graphic representation of a pistol (I guess for baggage handlers who can't read, or can't read English, and would still like to take advantage of one of the perks of their position).

2 1

New Australian export regulations
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Australia's new export control regulations have just been posted to the net, you can get them from http://www.adfa.oz.au/DOD/al/iic/excontrl/excohome.htm (they're all Word 6.0 documents, I've been reading them with a binary file browser - blech). What makes them interesting is that most of the text is word for word identical to the Canadian regulations (which is sensible, since the Canadian ones are clear and easy to follow, unlike the US "We'll let you know when you've broken the law" FUD regulations). The only thing which is different is the section numbering, the mapping from Canadian to Australian section numbers appears to be: 10xy.y.z -> xY00?.Y.Z where y -> Y == 1 -> A, 2 -> B, etc and z -> Z == A -> 1, 2 -> B, etc, so that Canadian 1151.1.c becomes Australian 5A002.a.3 (this doesn't work in all cases, if there's no .n suffix on the Australian number then the .n part from the Canadian number becomes part of the main Australian number, eg 1071.5 -> 7A005. The text may not be taken straight from the Canadian one because some of the spelling mistakes in the Canadian one aren't present in the Austrlian one, or maybe it was prepared from a later version which had been spelling checked. For crypto software, you want cat_5.doc, equivalent to section 1150 of the Canadian regulations. Anyway, here's the good bit, in sou.doc, "GENERAL TECHNOLOGY NOTE (PART 1 - MUNITIONS LIST)" >3. Controls do not apply to "technology" "in the public domain", to "basic > scientific research" or to the minimum necessary information for patent > applications. Again, this is identical to the Canadian regulations. Since the Canadian government has already ruled that a whole variety of crypto software is exportable under this exception, it means that the same stuff (and equivalent software from Australia) should also be exportable, or at least that you've got a very good case for arguing with the Australian government if they decide it's not exportable. Then in definits.doc we again have the Canadian text: >"In the public domain" (GTN NTN GSN), as it applies herein, means >"technology" or "software" which has been made available without restrictions >upon its further dissemination (copyright restrictions do not remove >"technology" or "software" from being "in the public domain"). It's nice to have this stuff laid out at last, because it finally takes the Australian crypto controls out of a gray area and defines them so that stuff like SSLeay and my own cryptlib aren't restricted. Incidentally, there's also the cute: >1. The export of "technology" which is "required" for the "development", > "production" or "use" of items controlled in the Munitions List is > controlled according to the provisions in the Munitions List entries. > This "technology" remains under control even when applicable to any > uncontrolled item. This covers virtually any software development tool, and any kind of computer hardware, as well as natural neural networks and personal digital extensions (of the kind designed for keyboard data entry). I wonder if we'll see the regulations retroactively changed when someone in Canberra realizes what they've copied from the Canadian regs :-). Peter.

1 0

WIP_out
by John Young 17 Dec '03

17 Dec '03

12-21-96. NYP: "Global Agreement Reached To Widen Law On Copyright" On-Line Material: International law would specify that copyright protection includes the right to control the on-line distribution of copyrighted materials, as well as the right to prevent others from making unauthorized copies. "Fair use" -- the tradition of allowing individuals to make a limited number of copies for noncommercial purpose, or to use brief excerpts in news reports or artistic criticism -- would still apply in cyberspace. In a compromise meant to defuse one of the harshest criticisms of the treaty, negotiators agreed to delete language that would have treated even temporary copies of material downloaded from the Internet as possible violations of international copyright law. ----- WIP_out ---------- WIPO on the Web: http://www.wipo.org

1 0

Security hole in premail
by Mixmaster 17 Dec '03

17 Dec '03

There's a pretty nasty bug in premail that allows any non-root to obtain the contents of the premail secrets file. This is a race condition that can be exploited because an indefinite amount of time can pass between the time that premail checks if the secrets file exists and when it tries to write to the file. It can be exploited as follows: attacker: $ umask 111 $ ln -s ~/premail-secrets-file /tmp/.premail-secrets.$< normal user: $ premail -login Remember to logout when done. Your premail passphrase, please: All the attacker has to do is execute "touch premail-secrets-file" between the time that the user is prompted for the passphrase and the time when the login is completed. $ ls -al premail-secrets-file -rw-rw-rw- 1 d00d nogroup 19 Dec 20 19:01 premail-secrets-file $ cat premail-secrets-file [contents of premail secrets file] This bug can be fixed in two ways. One way is to set the premail-secrets setting to some non-world-writable directory. The second way is to apply the following patch: *** premail.orig Fri Dec 20 18:46:01 1996 --- premail Fri Dec 20 18:55:54 1996 *************** *** 3574,3579 **** --- 3574,3582 ---- } for ($triesleft = 2; !$done && $triesleft; $triesleft--) { $pass = &getpass ($x); + if(!-O $ps) { + &error ("Secrets file exists and is owned by another user\n"); + } $status = &decrypt_secrets ($ps_pgp, $ps, $pass); if (!-s $ps) { unlink $ps; } $done = (!$status && -e $ps);

1 0

Instruction Sets which are tough to emulate
by ph＠netcom.com 17 Dec '03

17 Dec '03

I'm guessing there are a bunch of ways to make a processor hard to emulate. For instance, you can make the registers 65 bits wide. Can anybody think of some more? Peter Hendrickson ph(a)netcom.com

2 1

Re: Ebonics
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

At 11:29 AM 12/20/96 -0800, Timothy C. May wrote: (snip) >De honks be chimin.' Code be fly! I's huffa be gots to be sizing, bitch. >PGP 3 be dope, nuffin but bad! > >I be axing you if it be outa honkeyland or outa Afrika? Dat bitch Reno be >sayin' it be 'legal be usin' dope 'warez. Day be hos. Jesus Tim. You're letting your lilly white show. -feeling-oppressed-by-every-law-in-existance-white-boy Matt

8 8

Re: Dale defends free society from the NSApunks
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:Date: Fri, 20 Dec 1996 14:10:11 -0800 :From: Rich Graves <rcgraves(a)disposable.com> :Stop bashing Dale, you ADL/CFR/NSA thought police, you. I can recognize sarcasm! You're on the list! Yes, THE list! Yours from NSA.

2 1

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 19:54:09 EST, ph(a)netcom.com (Peter Hendrickson) writes: << > I believe this is a pipedream. As it stands now, virtually all of the > software that requires special hardware dongles is ridiculously expensive, > even compared to similar offerings from other companies. >> Well.... it seems to me that if the software is going to be so expensive.. that would THEN motivate to put dongles on.. seeing as these are the hardest to crack.

1 0

RE: Life with Dale
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May [.....]what was left of her [is] rotting in a grave somewhere north of me. ....... [...] interestingly, the Cypherpunks had a big beach party between Pescadero (where Dubroff lived) and Half Moon Bay (where she flew out of) just a couple of days prior to her departure. (This was the beach party put together by Doug Barnes, last spring.) ....................................................... Coincidence? .. Blanc <g> > > > >

1 0

Re: Executing Encrypted Code
by Dalban 17 Dec '03

17 Dec '03

Scott V. McGuire wrote: > You should expect software companies to make more money and for prices to > come down. Remember, there's not just one software company. This scheme > would force some of the people who would copy software to buy it, > increasing the profits to the software companies. So, why would the price > come down? Well, because of the increased profit margin, there is now > room for the price to come down, and since there is competition among > software companies, at least one of them will lower prices for the > advantage it will give them. The others will have to follow. And therefor I write: Of course that would be in a microsoft-less world where there wasn't one company who controlled huge market shares, who dominated the industry and who didn't have both government and 'big business' in their pocket. Microsoft is the great 'teflon corportation' able to shake off controversy after controversy regarding everything from hostile marketing strategies to product dumping. Since Microsoft already maintains a virtual monopoly I don't see how making the user pay will serve justice. In your world we'd have to pay for whatever inferiour product is handed to us... not only limiting our choice and freedom but making Microsoft that much more powerful. My two bits, take it or leave it. Dalban

3 2

Re: FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>reachable off the PGP Fone Registry, but the exact URL is : > http://pgp.rivertown.net/pgp-fone/archives Actually seems to be http://pgp.rivertown.net/pgp-fone/archive/ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Reflections on the Bernstein ruling
by Greg Broiles 17 Dec '03

17 Dec '03

(Please keep in mind that I'm not a lawyer yet, and that my comments are intended only as the reflections of an amateur and are intended as discussion fodder, not legal advice.) Folks seem to be very excited about Judge Patel's ruling in the Bernstein case - and with good reason. It was, for example, a first-page above-the-fold item in both of the Bay Area's legal newspapers today. Unfortunately, most of the media reports have done a poor job of interpreting the ruling, and it's easy to draw bad conclusions from erratic news reports about the case. The decision is available online <http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/961206.decision> thanks to the folks at EFF. I thought list members might appreciate a summary of the decision and its potential effects. 1. What the ruling said In brief, Judge Patel ruled that Category XIII(b) (the category which refers to cryptographic equipment/software) is unconstitutional because it functions as a prior restraint upon speech without providing important procedural safeguards which are required when a prior restraint scheme is put into place. She ruled that the "technical data" provision of the ITAR is also unconstitutional when it refers to technical data about Category XIII(b) items because of the lack of procedural safeguards. Mopping up other points raised by the suit, Judge Patel ruled that the term "defense article" as defined in 22 CFR 120.6 should be read to elide the phrase "or technical data"; and that when interpreted that way, the terms "defense article", "defense service", and "technical data" are not unconstitutionally vague. She also ruled that the term "export" is not unconstitutionally vague, and writes (in 'dicta', which is legalese for "offhand comment", e.g., without precedential value but interesting as a hint re what's going on in the judge's mind) that placing software on an "Internet site" which can be accessed from a foreign country is an export for ITAR purposes. She also ruled that the "fundamental research in science and engineering" (120.11(8)) and "general scientific, mathematical, or engineering principles" (120.10(5)) exceptions to the definition of "technical data" are void because they are too vague. As far as I can tell, they are thus no longer available to potential ITAR defendants. 2. What the ruling didn't say Judge Patel declined to address the merits of two of Bernstein's arguments: that cryptographic software is independently worthy of First Amendment protection as a tool which enables confidential speech and privacy, and that the ITAR scheme violates the Administrative Procedure Act. She also refused to grant Bernstein a preliminary injunction which would have prohibited the US Government from prosecuting him for teaching his class this spring, because her ruling means that his proposed activities are not (for now) illegal. The opinion also narrowly fails to say whether or not Category XIII(b) is content-based or content-neutral; but reaches its conclusion by pointing out that such a determination isn't necessary, because even if XIII(b) is content-neutral, it is still unconstitutional. (* My reading of the opinion diverges from the EFF's, as reported in their 12/17 press release, on this point. I think my interpretation is correct. YMMV.) 3. What the ruling means Some messages that I've seen have suggested that her ruling means that the ITAR does not apply to crypto of any kind; or that crypto can now be exported in, variously, the Ninth Circuit, or Northern California, or Berkeley. Strictly speaking, Judge Patel's ruling is not binding precedent in any court. The doctrine of "stare decisis", which says that courts should not disturb existing precedent, suggests that other district courts in the Northern District of California will follow Judge Patel's ruling, at least until the Ninth Circuit addresses the issue (in this case or a different one). But "stare decisis" is a policy statement, not law; and, as the decision in _Karn v. Dept of State_ makes clear (by ruling that the First Amendment does not prevent applying Category XIII(b) to source code), district courts around the country are free to disagree with each other and issue contradictory or incompatible opinions. (I'm interested in any analysis which would suggest that her ruling is binding on the ND CA courts for reasons other than stare decisis; I'm not aware of other grounds, but I don't know everything, either. Comments?) Further, Judge Patel's ruling yesterday is dependent upon her earlier ruling which held that source code is speech for First Amendment purposes. That ruling has not yet been reviewed at the appellate level, and is not uncontroversial nor universally accepted. If another court disagrees with that ruling, Judge Patel's otherwise convincing reasoning in this case (which says that the lack of procedural safeguards for this prior-restraint scheme is unconstitutional) is irrelevant - because without speech, the First Amendment (and its hostility to prior restraint) isn't applicable. It's also significant because her earlier ruling said that source code is speech - and her reasoning for reaching that result does not apply to object code or executables. It's also unclear that Judge Patel's ruling is enough to make export of crypto source legal by people/organizations located even in the Northern District of CA. Venue is proper, in an ITAR case, in any jurisdiction which the defense articles have moved through. (18 USC 3237(a); _US v. Durrani_ 659 F.Supp 1177, 1182 (D. Conn, 1987); an easy analogy is to the _US v. Thomas_ "Amateur Action" case, where Tennessee venue was proper for prosecution of California defendants who sent porn into Tennessee.) So it's at least arguable that the feds could simply bring an ITAR prosecution in another district, if exported crypto flowed through that district. (But I don't think they can do so against Dan Bernstein because of "res judicata", a doctrine which says that once two parties have fully litigated an issue, they cannot come back to the same court - or a different one - and ask to relitigate the same issue.) So while the ruling has considerable historical, cultural, and symbolic significance, it's dangerous to assume that it means that export restrictions on crypto are dead. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

4 3

Dale defends free society from the NSApunks (was Re: Encryption ?
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

:There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. They don't have to discourage anything, we never talk about encryption here..... But thats the master plan, to bore them into leaving!!

2 1

Re: Ebonics
by Mark Rosen 17 Dec '03

17 Dec '03

> Yeah, Matt, in a free society I wouldn't have to "speak Ebonics." > > (Personally, I interviewed several folks while I was at Intel who could not > speak standard English. I recommended against their hiring, and they in > fact did not get invites to be interviewed at the main facilities. So much > for their jive talk habits.) > > Understand, I have nothing against the colored people speaking "Ebonics" to > each other, or to anyone who'll listen. But I don't have to deal with this > nonsense, nor do I have to hire them. > > (Until the People's Republic of Political Correctness demands that I > "justify" why not speaking standard English is a "valid job requirement," > and refuses to take my "Because I say it is" as a valid answer. Not > surprisingly, the Clintonistas have decided to enter the Proposition 209 > challenge on the side of the pro-discrimination side.) > > If I were designing a genocidal program to destroy the colored race, I > would be pushing for Ebonics, for encouraging coloreds to study "Human > Potential" and "African History" instead of math, science, and engineering, > and pushing for hiring quotas. > There are several problems with your argument: * You are making glaring generalizations regarding all members of an ethnic body; you don't seem to realize that intellect is based not on color or how you talk but on your brain (which has the same color and other basic properties in all humans, I believe) * You are completely forgetting the other "non-English" group in America; the so-called White Trash or heavy Southern accents, which are violate just as many prissy and stuck up rules of grammar as Ebonics * You don't have to speak ebonics. You also don't have to speak with a Southern twang (or whatever the politically correct name for that is) I also think that you are forgetting about the human aspect of your discrimination. For a second, put yourself in the place of a really smart black guy applying for a job at Intel. He is overqualified for the job. You turn him down. Have you ever wondered what it does to a person to be turned down not on the basis of their moral character or intellect but by their skin? For someone to be told that they are stupid and are not competent to do this job? You don't realize that you are crushing _human_ lives, people who have feelings. If you would just put yourself in their place, you would realize the hurt that your are inflicting. Out of curiousity, do you refuse from hiring people with Southern Accents? Or people who have heavy "asian" accents? I'm very surprised that a smart person like you, who believes in the power of strong cryptography, one of the greatest equalizing forces in the world, actively discriminates against other people who don't look or talk like you. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

10 14

Re: Credentials without Identity--Race Bits
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) :Why is the fascist United State of America considered a "civilized :country"? It lets in the refuse of the earth to offer them the opportunity of a better life? With little guarantee thay will repay the offer?

1 0

Re: Proof that "cypher punks" have complete degenerated...
by geeman＠best.com 17 Dec '03

17 Dec '03

At 09:08 AM 12/19/96 -0800, you wrote: >geeman(a)best.com wrote: >> It wasn't worth commenting on. >> Appending data after the ctrl-Z as stego? >> Not even worth a letter to the ed! > >> Dr.Dimitri Vulis KOTM wrote: >> > No one even commented on the latest Dr. Dobbs issue. > >After seeing the initial post, I ran out to get a copy, but they were >all gone. I find it hard to believe that appending data to a file is >considered stego, even by a commercial publication such as Dr. Dobb's. >Can anyone confirm this? > Well, there it is, indeed. I couldn't friggin believe it, since I've written for them and usually the stuff's pretty good. A program to append data after a text file's ctrl-Z EOF byte. If you _really_ want it secure, crypt it with the compiler's PRNG. ;)

1 0

Re: Credentials without Identity--Race Bits
by Three Blind Mice 17 Dec '03

17 Dec '03

On Fri, 20 Dec 1996, Vangelis wrote: > Bill Stewart wrote: > > I've heard that in less civilized parts of the world you're actually > > required to carry government-issued ID cards to walk down the street > > or fly on airplanes. > > Umm.. tried to get on a flight without having ID lately? Doesn't work - > against policy. Anti-terrorism policy and all.. it's for your own > safety, of course. But my dear Vangelis, that's exactly what Bill is talking about. --3bmice

1 0

Re: Dale defends free society from the NSApunks (was Re: Encryption ?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Graham-John Bullers <real(a)freenet.edmonton.ab.ca> writes: > Problem with sex? No, thank you, Graham. Stick you alt.2600.moderated (an even lamer forum than thew "cypher punks" mailing list, if you can imagine that). > > http://www.freenet.edmonton.ab.ca/~real/index.html > > : real(a)freenet.edmonton.ab.ca > Graham-John Bullers email > : ab756(a)freenet.toronto.on.ca --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Ebonics
by Mark Rosen 17 Dec '03

17 Dec '03

> > There are several problems with your argument: > > * You are making glaring generalizations regarding all members of an > > ethnic body; you don't seem to realize that intellect is based not on color > > or how you talk but on your brain (which has the same color and other basic > > properties in all humans, I believe) > > That would be your generalization. Nowhere did anyone ever say that _all_ > black people speak "Ebonics". I don't see why someone should hire someone if > they can't even understand what that person is saying. Besides, I would > suspect that a reasonably intelligent person would know how to speak correct > English or at least make an attempt to do so. Especially in the computer field, language is irrelevant; as long as someone can "speak" C++ or HTML, they're fine. > > * You are completely forgetting the other "non-English" group in America; > > the so-called White Trash or heavy Southern accents, which are violate just > > as many prissy and stuck up rules of grammar as Ebonics > > No mention was made of "White Trash". You're drawing an invalid conclusion. Yes, though your same discrimination rules apply to "White Trash." I want to see if your language discrimination applies only to black Ebonics or to the white Southern twang also. > > I also think that you are forgetting about the human aspect of your > > discrimination. For a second, put yourself in the place of a really smart > > black guy applying for a job at Intel. He is overqualified for the job. You > > There is a logical correlation between intelligence and being able to follow > English grammatical rules. Not really. America is an incredibly diverse place. There are parts of the country where correct English-speaking people are minorities; if you've grown up in one of these places, you'll speak the native dialect no matter how smart or stupid your are. > Crypto will allow people to actively discriminate against whomever they wish. > It will also allow those who would be discriminated against to protect > information about themselves to prevent discrimination. I don't support > discrimination based on race, but language is a completely different matter. Spoken language, which is what you're discriminating against is vastly different from typed language. Everyone types pretty much the same way but everyone speaks differently. People who speak in Ebonics or with a Southern twang often know the rules of grammar, as expressed in writing, but they do not speak "correctly" because they are not accustomed to doing so. > P.S. Spelling and grammar flames will be ignored. What?! How can you say this? According to your position, it is my right to flame you because, as a better grammarian and orthographer, I am more intelligent than you and you should know this. In fact, your viewpoint can be extrapolated to say that anyone who make a grammar or spelling mistake in any message should be thrown off the list becuase they are not intelligent.

2 1

RE: Reflections on the Bernstein ruling
by Blake Coverett 17 Dec '03

17 Dec '03

Greg Broiles wrote: > In brief, Judge Patel ruled that Category XIII(b) (the category which > refers to cryptographic equipment/software) is unconstitutional because it > functions as a prior restraint upon speech without providing important > procedural safeguards which are required when a prior restraint scheme is > put into place. She ruled that the "technical data" provision of the ITAR > is also unconstitutional when it refers to technical data about Category > XIII(b) items because of the lack of procedural safeguards. I'm not even remotely a lawyer, but I have to disagree with the second sentence above. As I read it Judge Patel believes that the technical data provisions are also unconstitutional but can not rule that way because United States v. Edler, 579 F.2d 516 (9th Cir. 1978) is the law in the 9th circuit. The relevant quote is: While this court is inclined to agree, despite revisions to the ITAR since 1984 and especially in light of Freedman and FW/PBS, Edler remains the law of this Circuit and this court is bound by its holding.[13] Moreover, Edler was reaffirmed, albeit in cursory fashion, by the Ninth Circuit in 1989. United States v. Posey, 864 F.2d 1487, 1496 (9th Cir. 1989). If the Ninth-Circuit wants to reconsider those opinions it is free to do so, but that decision is theirs to make. Happily she does go on to say that because she has ruled that Category XIII(b) is unconstitutional that the technical data provisions for items relating to XIII(b) are unenforceable. regards, -Blake

1 0