December 2003 - cypherpunks-legacy

Re: cpunk-like meeting report
by Major Variola (ret) 15 Dec '03

15 Dec '03

At 09:57 PM 12/14/03 -0800, Morlock Elloi wrote: >> Be sure and check the archive before posting. It is still small. > >Cookies, "members only" archive access. Bad deal. Will not happen. Very few >consumers here. But look how many IP addresses he got from members checking it out!

1 0

self adjusting dummy traffic generation?
by Nomen Nescio 15 Dec '03

15 Dec '03

Would it be possible to have a self adjusting dummy traffic generator feature in remailers? Operator decides that he wants to process x number of incoming and y number of outgoing messages each time period t. Then the software adjusts the number of dummy messages to this value using some statistical calculations of past t2 hours. If incoming traffic increases then the amount of dummy messages are decreasing and so on. Does this feature exist today?

1 0

Re: cpunk-like meeting report
by Eugen Leitl 15 Dec '03

15 Dec '03

On Sun, Dec 14, 2003 at 06:36:12PM -0800, Tim May wrote: > No, we don't need a "cpunx-news" list. This is what Google and the > ability to see hundreds of various lists and sites is for. This is a bogus statement. As long as I can't use a single keyword to make Google's news alerts topical, and _full text_ a search engine is rather useless. > "News" lists tend strongly to be just dumping grounds for crap from > other lists. The point is that you don't have to subscribe to 20-odd email lists, which have about 5% relevance each. Life's too short for that. People are the best filters, and with a handful of sustained contributors the list becomes a valuable resource. > I failed the entrance exam for "Interesting People," which is fine, for > obvious reasons. Case in point: most of IP list traffic is garbage from a cypherpunk point of view. Let one list subscriber read it, and filter relevant bits to the newsticker. If it's a steaming pile of crap for Tim May it doesn't mean it's useless for everybody else. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Idea: Simplified TEMPEST-shielded unit (speculative proposal)
by Thomas Shaddack 15 Dec '03

15 Dec '03

TEMPEST shielding is fairly esoteric (at least for non-EM-specialists) field. But potentially could be made easier by simplifying the problem. If we won't want to shield the user interface (eg. we want just a cryptographic processor), we may put the device into a solid metal case without holes, battery-powered, with the seams in the case covered with eg. adhesive copper tape. The input and output can be mediated by fibers, whose ports can be the only holes, fraction of millimeter in diameter, carefully shielded, in the otherwise seamless well-grounded box. There are potential cooling problems, as there are no ventilation holes in the enclosure; this can be alleviated by using one side of the box as a large passive cooler, eventually with an externally mounted fan with separate power supply. If magnetic shielding is required as well, the box could be made of permalloy or other material with similar magnetic properties. I am not sure how to shield a display. Maybe taking an LCD, bolting it on the shielded box, and cover it with a fine wire mesh and possibly metalized glass? Using LCD with high response time of the individual pixels also dramatically reduces the value of eventual optical emissions. I also have doubts about the keyboard. Several ideas that could help: We may use optical scanning of the key matrix, with the light fed into and read from the matrix by optical fibers, coming out from a well-shielded enclosure, similar to the I/O lines of the first example. We may use a "normal" keyboard, but modified to use reliably random scanning pattern; that won't reduce the EM emissions of the keyboard, but effectively encrypts them, dramatically reducing their intelligence value. It's then necessary to take precautions about the data cable between the keyboard itself and the computer, where the data go through in plaintext; it's possible to encrypt it, or to use a fiber. As really good shielding of complicated cases is difficult to achieve, the primary objective of this approach is to put everything into simple metallic boxes with as few and as small ports as possible, which should be comparatively easy to manufacture, replacing the special contacting of removable panels with disposable adhesive copper tape (the only reason to go inside is replacing batteries, and the tape together with other measures may serve as tamperproofing), and replacement of all potentially radiating external data connections with fiber optic. I should disclaim I have nothing that could vaguely resemble any deeper knowledge of high frequencies; therefore I lay out the idea here and wonder if anyone can see holes in it (and where they are).

3 2

Don't worry...it's just one of Saddam's doubles
by Tyler Durden 15 Dec '03

15 Dec '03

Spread the word. The adminstration got desparate. In a few weeks they'll announce this isn't the real Saddam, but that rounding up all of the clones is necessary progress in the fight to get the real Saddam. -TD _________________________________________________________________ Get holiday tips for festive fun. http://special.msn.com/network/happyholidays.armx

4 4

Wardial for Bush! 1-800-531-6789 -- call AGAIN AND AGAIN!
by Tim Meehan 15 Dec '03

15 Dec '03

>From: Wardialers For Bush <war4bush(a)somewhat.com> >Subject: [Wardialers for Bush] Set a record! Call 1-800-531-6789 AS OFTEN AS YOU CAN! > >Resident George W. Bush wants your support! > >Even though ****every nuisance call to this phone number costs him money****, he >wants you to call NOW, AGAIN AND AGAIN! > >1-800-531-6789 > >If you don't get through, call again! > >1-800-531-6789 > >Keep calling. Say you were told to call by Ken Mehlman! Ask for your free >prize! > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789

1 0

Cypherpunks List Info
by cpunk＠lne.com 14 Dec '03

14 Dec '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Re: PKI root signing ceremony, etc.
by Dave Howe 14 Dec '03

14 Dec '03

Rich Salz wrote: >> *shrug* it doesn't retroactively enforce the safety net - but that's >> ok, most MS products don't either :) > The whole point is to enhance common practice, not stay at the lowest > common denominator. If someone has *already* issued a certificate - and ignored the CA flag - is it part of the software's duty to somehow point this out to you? But regardless, as this only applies to imported keys you would never actually see it in Real Life (tm) >> Key management and auditing is pretty much external to the actual >> software regardless of which solution you use I would have thought. > You'd be wrong. :) I did just download and use XCA for a little bit. > It's practically impossible to audit. Every key in the database is > protected with the same password. um, this is a **CA** - you have *one* key in the database, your CA key. It is bad practice to generate the keys on the CA machine and transport them to the server they will be used on - instead, the Cert request should be generated on the end-use machine, and the *request* transported to the CA, signed, and the certificate returned. That way, the private key never leaves the machine it was generated for and used on, and is protected by its own password. > The system ask for the password > as soon as it starts up. If I leave the program running while > I leave my computer, I'm screwed. Then don't leave it running. If you got out of your car but left the engine running, and somebody stole the car, would you blame the design of the car? > The key-holder isn't asked to > confirm each signing -- there's no *ceremony* -- and they never > enter the password after the program starts. For any kind of root > these are all very bad. This is just fine for a root - the root acquires 'n' signing requests, opens the program, signs or rejects the requests as appropriate, then closes the program. It is not the duty of the CA to generate keys or enter certificate information - that is the requestor's problem, which he can do with the tools appropriate to his machine (openssl on almost anything, the built in keygen in IIS and several other webservers, and so forth. I am actually disappointed in XCA (compared to the earlier but awkward to set up OpenCA project) in that no browser-accessable request interface is provided. of course XCA is compatable with importing requests made from OpenCA, and exporting them back into an openCA "pickup" dir..... but really it would be nice to be compatable with the interface most key requestors are used to. > XCA is pretty nice for a Level-2 or small Level-1 CA. The template > management, etc., is pretty good. (Having them tied to the key > database, and having the keys be unlocked while making cert requests, > are both real bad ideas, however.) There is no mystical value in having to type a key lots of times. I was just pointing out what other options are out there (I would have pointed out EBCrypt as well, which appears better suited to your current ritual, but its website seems to have vanished)

1 0

RFIDs at tech summit
by J.A. Terranson 14 Dec '03

14 Dec '03

Bug devices track officials at summit By Audrey Hudson THE WASHINGTON TIMES Officials who attended a world Internet and technology summit in Switzerland last week were unknowingly bugged, said researchers who attended the forum. Badges assigned to attendees of the World Summit on the Information Society were affixed with radio-frequency identification chips (RFIDs), said Alberto Escudero-Pascual, Stephane Koch and George Danezis in a report issued after the conference ended Friday in Geneva. The badges were handed out to more than 50 prime ministers, presidents and other high-level officials from 174 countries, including the United States. The trio's report said they were able to obtain the official badges with fraudulent identification only to be stunned when they found RFID chips . a contentious issue among privacy advocates in the United States and Europe . embedded in the tags. Researchers questioned summit officials about the use of the chips and how long information would be stored but were not given answers. The three-day WSIS forum focused on Internet governance and access, security, intellectual-property rights and privacy. The United States and other countries defeated an attempt to place the Internet under supervision of the United Nations. RFID chips track a person's movement in "real time." U.S. groups have called for a voluntary moratorium on using the chips in consumer items until the technology and its effects on privacy and civil liberties are addressed. Mr. Escudero-Pascual is a researcher in computer security and privacy at the Royal Institute of Technology in Stockholm. Miss Koch is the president of Internet Society Geneva, and Mr. Danezis studies privacy-enhancing technologies and computer security at Cambridge University. "During the course of our investigation, we were able to register for the summit and obtain an official pass by just showing a fake plastic identity card and being photographed via a Web cam with no other document or registration number required to obtain the pass," the researchers said. The researchers chose names for the fake identification cards from a list printed on the summit's Web site of attendees. The hidden chips communicate information via radio frequency when close to sensors that can be placed anywhere "from vending machines to the entrance of a specific meeting room, allowing the remote identification and tracking of participants, or groups of participants, attending the event," the report said. The photograph of the person and other personal details are not stored on the chip but in a centralized database that monitors the movement. Researchers said they are concerned that database will be used for future events, including the next summit to be hosted by Tunisian authorities. "During the registration process, we requested information about the future use of the picture and other information that was taken, and the built-in functionalities of the seemingly innocent plastic badge. No public information or privacy policy was available upon our demands that could indicate the purpose, processing or retention periods for the data collected. The registration personnel were obviously not properly informed and trained," the report said. The lack of security procedures violates the Swiss Federal Law on Data Protection of June 1992, the European Union Data Protection Directive, and United Nations' guidelines concerning computerized personal-data files adopted by the General Assembly in 1990, the researchers said. "The big problem is that system also fails to guarantee the promised high levels of security while introducing the possibility of constant surveillance of the representatives of civil society, many of whom are critical of certain governments and regimes," the report said. "Sharing this data with any third party would be putting civil-society participants at risk, but this threat is made concrete in the context of WSIS by considering the potential impact of sharing the data collected with the Tunisian government in charge of organizing the event in 2005," it said. The organization Reporters Without Borders was banned from attending the summit and launched a pirate radio broadcast to protest the ban and detail press-freedom violations by some countries attending the meetings, including Tunisia. "Our organization defends freedom of expression on the Internet on a daily basis. Our voice should therefore be heard during this event, despite this outrageous ban," said Robert Menard, secretary general of Reporters Without Borders. Tunisia is among several countries Reporters Without Borders has accused of censoring the Internet, intercepting e-mails and jailing cyber-dissidents.

1 0

Re: Patriot Ants (was: Re: Zombie Patriots and other musings)
by Nostradumbass＠SAFe-mail.net 14 Dec '03

14 Dec '03

From: Thomas Shaddack <shaddack(a)ns.arachne.cz> > On Sat, 13 Dec 2003, John Kelsey wrote: > > > Of course, there's a more fundamental problem with surrendering to the lone > > warriors. Imagine that there's such a wave of pro-life terrorism that we > > finally agree to ban abortion. You're a fanatically committed pro-choice > > activist. What's your next move? > > Two moves possible. > > The violent, far less effective and possibly somehow counterproductive > one: attacking the ones who enforce the measurement, by letal or nonlethal > means, to act as deterrent. I think you should the word possibly when referring to effectiveness of outcomes. One can never knows until one tries. Every monment in history is unique and the effectiveness of the use of a particular strategy can never be ascertained beforehand. Mine is based on at least two inspirations... "How we burned in the prison camps later thinking: What would things have been like if every security operative, when he went out at night to make an arrest, had been uncertain whether he would return alive?" --Alexander Solzhenitzyn, Gulag Archipelago and Our government... teaches the whole people by its example. If the government becomes the lawbreaker, it breeds contempt for law; it invites every man to become a law unto himself; it invites anarchy. -- Louis D. Brandeis As Americans I'm sure we have been tutored by some of the best. Time to put into practice what we have learned. > > The nonviolent one: developing and deploying the technology necessary for > underground clinics to provide higher quality service, and for their > clients to find, order and pay for the services without being likely to > trace down by the Whateveriscurrentlythelaw Enforcement. Causing bad press > for them, keeping public awareness that alternatives to the law-compliance > exist. Learning from countries with similar bans in action, both from the > present and from history, how the alternatives developed there, and > building on this knowledge. > > Direct attack is not always the best route, however tempting. A house can > be brought down from the outside by a bomb, or from the inside by white > ants. The trouble with this method is that is generally requires a large percentage of the population to actively or passively support a position. This almost always occurs after a situation has become intolerable to the masses. I have no intention in placing my ability to enjoy what I consider my basic rights into the hands of a million Joe Sixpacks and await their enlightenment. "The only freedom which counts is the freedom to do what some other people think to be wrong. There is no point in demanding freedom to do that which all will applaud. All the so-called liberties or rights are things which have to be asserted against others who claim that if such things are to be allowed their own rights are infringed or their own liberties threatened. This is always true, even when we speak of the freedom to worship, of the right of free speech or association, or of public assembly. If we are to allow freedoms at all there will constantly be complaints that either the liberty itself or the way in which it is exercised is being abused, and, if it is a genuine freedom, these complaints will often be justified. There is no way of having a free society in which there is not abuse. Abuse is the very hallmark of liberty." -- Quintin H. Hailsham, The Dilemma of Democracy Get ready for a lot of abuse...

1 0

Re: Zombie Patriots and other musings
by Major Variola (ret) 14 Dec '03

14 Dec '03

At 10:12 PM 12/11/03 -0500, An Metet wrote: > >Given small numbers and absence of any other grouping factor there needs to be an "obvious" place for ZPs to refer to. Any obvious place that becomes even remotely attractive to ZPs will be immediately raided. Because ZPs have potential to be actually dangerous to the gang in power, as opposed to everything else I've seen so far. > >So we're back to square one - effective anonymous publishing is prerequisite for the regime change and executing post-natal abortions. And it has been for centuries. You need to think about the "lone warrior" scenario that the Gang worries about. McVeighs and Rudolphs. They were influenced by memes which were not immediately suppressed. Look at Al Q, Inc: you don't need explicit instructions from the Boss to motivate folks to do things. You see who is the enemy, you see opportunity. You don't need permission. There is also the "copycat" phenom ---remember how school shootings reccurred after the first big one? So the memes can get out. As Tim has mentioned here, the talkers can't be the doers. And watch out for COINTELPRO. >When I say "effective" I don't mean posting a message to Usenet via WiFI-ing into some sucker's open AP. No one gives a fuck for Usenet postings, blacknet etc Well, some do, but its not relevent for ZPs. >. - and ZPs are unlikely to educate themselves and search for them. Effective means untouchable web site with untouchable DNS entry. Fuck the web. The web is 0wn3d by the feds and run by largely spineless fedsucking sheep. The web is for talkers, not doers. >Effective means something doable by average determined person. Like tuning to Radio London from occupied Europe in WW2. I don't listen to shortwave, but I understand some of it can be fairly strong. I could easily see some lunatic fringe suggesting that deathbed xians blowing up medical clinics as a holy thing. (And I understand that shortwave is popular among lunatic xians.) As the US descends into statism, perhaps some agitators will pick better targets, like the oppressors. Perhaps some will simply begin to act, the news reports it, and others will clue in and repeat.

4 3

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from schoen@loyalty.org)
by Eugen Leitl 13 Dec '03

13 Dec '03

----- Forwarded message from Seth David Schoen <schoen(a)loyalty.org> -----

4 6

Anti-globalization
by Tyler Durden 13 Dec '03

13 Dec '03

The anti-globalization protests are a good example of something misunderstood by Libertarian old-farts. On some levels, these protests have a libertarian character...anti-globalization is not really about eliminating free trade per se, but eliminating "free trade", which is really just the selective and forceful application of free-trade ideas by the US and its cronies, in support of the "American Century" or, in other words, the "Iraq is better off now then under Saddam" approach to international relations. The current political clime is slowly being pushed in the vague direction of lefitst statism-lite, but only because of a philosophical vaccum and because the US has successfully portrayed itself as the embodiment of free-market, Lassaiz Faire capitalism. However, I don't see the strong support for Soviet or Maoist-style state control these days...these are vaguely romantic notions once in a while, but they don't have any deep ideological support like they might have in the 60s. -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: Re: Decline of the Cypherpunks list...Part 19 >Date: Mon, 8 Dec 2003 11:07:06 -0800 > >On Dec 8, 2003, at 12:11 AM, Bill Stewart wrote: > >>At 07:55 PM 12/7/2003 -0800, Tim May wrote: >>>The Libertarian Party started at about this time, in 1972, and nearly all >>>of the volunteers, spear carriers, etc. were in their 20s. This is very >>>well known. >>> >>>(And today most of the LP volunteers and spear carriers are in their 40s >>>and 50s. A correlation here.) >> >>Yes, and one of the LP's problems is that we've largely turned into old >>farts there also.... > >Indeed. > >I can imagine a bunch of possible reasons for this development. In no >particular order: > >* In the 1950s and 60s, the effects of Rand and Heinlein were pervasive. >Many college kids in the 60s were reading "Atlas Shrugged." (I won't get >into how badly it's written, except to say I devoured it in 2 days in 1968, >when I was 16, and quoted from it to all who would listen in the next >couple of years. But I haven't been able to read it _since_. I can't get >past about page 10 before throwing it down. It's strong propaganda, but >badly written.) > >* The mood of the 50s and 60s was actually one of nearly boundless >possibilities for the future, at least in America. Not because of >socialists in Congress and JFK, but because of a booming economy, >technology, and all the usual things of the time. The generation which >entered the work economy in the 1960s through the early 1980s is the >wealthiest generation in history...especially those who did so in Silicon >Valley or similar areas. > >(My implication being that things were different for the generation which >came of age much later, with more of a sense of limited horizons, dead-end >jobs at Starbucks making lattes for Yuppies, etc. Maybe if I were 25, >working for $9 an hour at Starbucks, I'd shave my head and look like a >refugee from the Apple "1984" commercial too.) > >* A lot of these folks, the ones who came of age in the 60s and 70s, were >enthusiastic libertarians. Some of them joined the Libertarian Party, most >of them dislike government drug laws and redistribution of their income, >and so on. > >* A lot of the younger folks I see interviewed describe "income inequality" >and "discrimination" and "globalization" as the serious problems the world >and America face. They may favor drug legalization, as libertarians do, but >they certainly aren't sympathetic to most laissez-faire, "survival of the >fittest" libertarianism. > > >A couple of folks here have followed-up in this latest thread with claims >that the old farts, especially me, quash discussion of new theories, new >outlooks. > >Hey, this is an anarchy. I have absolutely no power whatsoever to quash >_anything_ related to this list! > >When we were a young list, but when I was still an old fart by most >standards (I was 40 in 1992), we didn't need any permission or approval to >post what we wished. And some of the folks then were even older than me >(Sandy Sandfort, Arthur Abraham, maybe Jude Milhon...). > >And new subscribers and young people who join the list today are perfectly >free to make good contributions. I recall few such newcomers, however. (One >of them was Dave Molnar, now a grad student in CS/something at Berkeley, >interested in many of the issues we are interested in. He was not >"censored" by the old farts when he had something interesting to say.) > >Bottom line is that this crap about how the old farts are suppressing the >young guns is bullshit. If someone has something to say, they should say >it. They may not get a positive response to calls for passing new laws to >raise taxes "on the wealthy," or to break up Microsoft, or to tell people >what kind of software they can write, but that's because the underlying >philosophy of the list is what it is: call it libertarian, call it >anarcho-capitalist, call it whatever, but don't call it "there ought to be >a law" sentiment. > > >--Tim May >"He who fights with monsters might take care lest he thereby become a >monster. And if you gaze for long into an abyss, the abyss gazes also into >you." -- Nietzsche _________________________________________________________________ Our best dial-up offer is back. Get MSN Dial-up Internet Service for 6 months @ $9.95/month now! http://join.msn.com/?page=dept/dialup

9 10

Fuck Them Dead
by Nomen Nescio 13 Dec '03

13 Dec '03

Off the Pigs!

1 0

Fuck em to death
by Nomen Nescio 13 Dec '03

13 Dec '03

Death to the Oinks!

1 0

Fuck Them All Dead
by Nomen Nescio 13 Dec '03

13 Dec '03

Off All the Pigs!

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from schoen@loyalty.org)
by J.A. Terranson 12 Dec '03

12 Dec '03

So, what we need to complete the picture is a good old-fashioned top-posted CASCADE!!! On Fri, 12 Dec 2003 rtusers-lists-fsck-com(a)jal.org wrote: > Date: Fri, 12 Dec 2003 22:22:58 -0500 > From: rtusers-lists-fsck-com(a)jal.org > To: Tim May <timcmay(a)got.net> > Cc: J.A. Terranson <measl(a)mfn.org>, cypherpunks(a)lne.com > Subject: Re: [linux-elitists] Monday 15 Dec: first all-Open Source > System-on-Chip (fwd from schoen(a)loyalty.org) > > On Fri, 12 Dec 2003, Tim May wrote: > > > On Dec 12, 2003, at 5:58 PM, J.A. Terranson wrote: > > > > >On Fri, 12 Dec 2003, Tim May wrote: > > > > > >>On Dec 12, 2003, at 12:16 AM, Eugen Leitl wrote: > > >> > > >>>----- Forwarded message from Seth David Schoen <schoen(a)loyalty.org> > > >>>----- > > >>> > > >>>From: Seth David Schoen <schoen(a)loyalty.org> > > >>>Date: Thu, 11 Dec 2003 23:32:31 -0800 > > >>>To: Jason Spence <jspence(a)lightconsulting.com> > > >>>Cc: linux-elitists(a)zgp.org > > >>> > > >> > > >>Please STOP forwarding traffic from other lists to the CP list. > > > > > >Why don't you just filter it Tim: the rest of are capable of making > > >our own > > >reading decisions. > > > > > > > > > And so why don't you just filter _my_ comments, twit? > > > > It's bad enough that that Eugene Leitl has made himself the new Choate, > > now you have made yourself the new Detweiler. > > > > --Tim May > > Hey! I'm the forth person to meta-comment about the list in this thread. > Do I win a prize? Are we sufficiently indistiguishable from Usenet? Is > there life on Saturn? I hear Detweiler is changing the litter for Andrew > Loeb! > > (With apologies to poor Zippy,) > > -j > > > > -- Yours, J.A. Terranson sysadmin(a)mfn.org Father, you are a great and mighty God. Help our governments to remember the lessons of our history and to appreciate the purpose of your son Jesus. Teach our representatives not to be so arrogant as to speak in one way, but doing another, for surely this not the way of truth. Help us to understand that your will is not death but life, not the darkness of hatred but the light of friendship in Christ. In the name of Jesus we pray. Amen. Merle Harton, Jr.

1 0

Re: ALTA/DMT privacy [was: Re: (No Subject)]
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

-------- Original Message -------- From: "James A. Donald" <jamesd(a)echeque.com> Apparently from: owner-cypherpunks(a)minder.net To: cypherpunks(a)lne.com Subject: Re: ALTA/DMT privacy [was: Re: (No Subject)] Date: Wed, 10 Dec 2003 14:13:59 -0800 > -- > On 10 Dec 2003 at 15:19, Nostradumbass(a)SAFe-mail.net wrote: > > If you > > fund you accounts using money orders, you may be safe > > (depending on whether you've employed others to purchase the > > money orders or your physical identity is being captured at > > the money order agent during the transaction). > > Some people offer a cash to e-gold service. Though this is mostly discovered through direct communications, for obvious reasons. > > Deposit a bundle of notes in their account, they will sell you > e-gold. You use the low order bits of the amount as an ID. Others have used the serial number of one of the bills submitted (e.g., the one highlighted with a yellow marker). > > > ALTA/DMT does have a certain degree of un-linkability in that > > once accounts are deleted all db references in the system to > > that account are also deleted from all ALTA/DMT dbs. > > Trust us. Would we lie to you? This info was obtained from discussions with the developers, experiments with the system and examination of the code.

4 5

Re: Anti-globalization
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

From: Neil Johnson <njohnsn(a)njohnsn.com> > What I object to are corporations who utilize their power (money) to influence > governments to make laws that benefit them at the expense of others. > > - The DMCA > - Tariffs AND Free Trade Agreements > - H1-B visas > > Even Ayn Rand weaves this into "Atlas Shrugged" where the competitors of > Reardon Steel get the government to try and force him to give them his > formula for his high-strength steel because it's putting them out business > and "unfair". "Corporations shall not be considered to be 'persons' protected by the Constitution of the United States or the Constitution of the Commonwealth of Pennsylvania within the Second Class Township of Porter, Clarion County, Pennsylvania." Only a small handful of very large corporations abuse these rights to deceive people, hide crimes, or make politicians violate the will of their own voters. The millions of ethical corporations will thus be freed from the tyranny of the few while democratic government will be returned to its citizens. http://www.commondreams.org/views02/1219-06.htm

1 0

Re: Zombie Patriots and other musings
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

-------- Original Message -------- From: Anonymous <cripto(a)ecn.org> Apparently from: owner-cypherpunks(a)minder.net To: cypherpunks(a)lne.com Subject: Re: Zombie Patriots and other musings Date: Fri, 12 Dec 2003 05:32:48 +0100 (CET) > The devil is in details. > > Given small numbers and absence of any other grouping factor there needs to be an "obvious" place for ZPs to refer to. Any obvious place that becomes even remotely attractive to ZPs will be immediately raided. Because ZPs have potential to be actually dangerous to the gang in power, as opposed to everything else I've seen so far. > Like I said, we're back to square one - all effective means are firmly shut down. Most cpunk talk about secret/stego messaging is mental masturbation that does not relate to the real thing. We want sex. I think this is a new use for SPAM. Because its a political message it may even be protected under the new Congressional legislation. :-)

1 0

RE: Zombie Patriots and other musings [was: Re: (No Subject)]
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

From: John Kelsey <kelsey.j(a)ix.netcom.com> > At 02:07 PM 12/11/03 -0500, Trei, Peter wrote: > >It's worth noting that despite over a decade of this rhetoric, > >not a single terminally ill American has done this, so far as I > >am aware. > > Well, I think for most terminal illnesses, by the time it's obvious you're > really not going to live much longer, you're pretty damned sick. About half of my friends who died of a terminal illness were apparently quite healthy when told they had joined the "nearly departed". >And until > then, you'd probably like to make some personal use of what days or weeks > you have left doing something like talking to your kids, praying, composing > that last piece of music, etc., rather than blowing random strangers up to > make some political point. Isn't it depressing than some have been living their lives in a way that such an 11th hour changes of heart are necessary or desired? (Wouldn't it be a hell of a depressing > statement about yourself, if you really believed that the most valuable use > of the last hours of your life of which you were capable would involve > strapping some dynamite to yourself and taking out a busload of random > strangers?) Who mentioned random? Who mentioned dynamite? What I'm suggesting is no more random than soldiers killing other soldiers in war. "The purpose is to get the other poor dumb bastard to die for their ideology." Besides, there is no need for these operations to be a suicide. The lack of fear gives one a decided edge in dangerous situations which may actually increase survival rates. > > Along with that, most people care about either the afterlife form of > immortality, or at least the reputation/legacy form of immortality. Even > if you don't worry about lakes of fire and red guys with pitchforks, you > might prefer not to have your family and friends humiliated and ashamed at > the mention of your name. ("Oh my God! That was *your* son? How do you > live with that?") That's their problem. From my prespective its like Hollywood: as long as you still being talked about you're 'alive'. It doen't matter what they are saying. Better to be infamous down through history than unknown. ND

1 0

RE: Stego worm
by Tyler Durden 12 Dec '03

12 Dec '03

Mr Shaddack... That's some interesting thinking there. The interesting thing is that no one might ever even notice the presence of this benevolent worm. It could go pretty much unchecked for a while. As for Variola's comment, you might be right. I just assumed there's some kind of relationship between LSB and those spatial freuencies wherein image information might be stored. Actually, I would still think there's a relationship, in which case an Echelon-like approach based on ffts and "noise templates" might be going on (hence the usefulness of jamming). Anyone got a TLA Operative Handbook? ANy mention in there of what kind of photos are best for Stego? How about cloud photos? (particularly where there are clouds of many different shapes and sizes present in the photo simultaneously.) -TD >From: Thomas Shaddack <shaddack(a)ns.arachne.cz> >To: cypherpunks <cypherpunks(a)lne.com> >Subject: Stego worm >Date: Fri, 12 Dec 2003 01:10:24 +0100 (CET) > >It's unknown to which extent the Adversary can detect presence of >steganography in images being sent over the Net. > >But whatever capabilities they have, they can be jammed. > >Imagine a worm that spreads from machine to machine, and on the infected >machine it finds all suitable JPEG files, generates some random data as >source and encrypts them with random key, and stegoes them into the files. > >In few days or even hours, a sizeable portion of images on the Net >contains potentially detectable stegoed encrypted data. > >Any Chinese want to get immortalized in Internet history? _________________________________________________________________ Shop online for kids toys by age group, price range, and toy category at MSN Shopping. No waiting for a clerk to help you! http://shopping.msn.com

2 1

RE: Zombie Patriots and other musings [was: Re: (No Subject)]
by John Kelsey 12 Dec '03

12 Dec '03

At 02:07 PM 12/11/03 -0500, Trei, Peter wrote: >It's worth noting that despite over a decade of this rhetoric, >not a single terminally ill American has done this, so far as I >am aware. Well, I think for most terminal illnesses, by the time it's obvious you're really not going to live much longer, you're pretty damned sick. And until then, you'd probably like to make some personal use of what days or weeks you have left doing something like talking to your kids, praying, composing that last piece of music, etc., rather than blowing random strangers up to make some political point. (Wouldn't it be a hell of a depressing statement about yourself, if you really believed that the most valuable use of the last hours of your life of which you were capable would involve strapping some dynamite to yourself and taking out a busload of random strangers?) Along with that, most people care about either the afterlife form of immortality, or at least the reputation/legacy form of immortality. Even if you don't worry about lakes of fire and red guys with pitchforks, you might prefer not to have your family and friends humiliated and ashamed at the mention of your name. ("Oh my God! That was *your* son? How do you live with that?") >The *only* even vaguely simlar cases I'm aware of are in >India and Sri Lanka, where young Hindu widows (who, in >traditional Hindu society have very dim prospects for >a happy life) are recruited as suicide bombers by the >Tamil Tigers. I think Rajiv Ghandi's assassin was >such a woman. So there, the women are still healthy enough to do something, and doing the suicide bombing thing won't leave behind a legacy of relatives who change their names to avoid being associated with you. >Peter Trei --John Kelsey, kelsey.j(a)ix.netcom.com PGP: FA48 3237 9AD5 30AC EEDD BBC8 2A80 6948 4CAA F259

1 0

Re: Zombie Patriots and other musings
by Nomen Nescio 12 Dec '03

12 Dec '03

Another excellent group of potential recruits are prisoners. Especially if you can create a new religious movement teaching them to stop the interracial, intergang fighting and concentrate on their true enemy, the Man. Teach that killing cops, soldiers, any type of government agent, is a holy act. Robbing banks is a holy act. Killing the guards in the prisons, killing the excutives of polluting industries -- all holy acts. Leaflets could be dropped from radio controlled balloons during "yard time" preaching the Word.

1 1

Re: Idea: Using GPG signatures for SSL certificates
by Anonymous 12 Dec '03

12 Dec '03

Thomas Shadduck writes: > The problem that makes me feel uneasy about SSL is the vulnerability of > the certification authorities when they get compromised, everything > they signed gets compromised too. Technically this is true, but the only thing that the CA signs is other keys. So it merely means that the CA can create certificates on behalf of anyone the compromisers choose. It doesnt "compromise" any existing key or previously issued certificate or even any newly created key. In any case, you dont need a CA to use SSL. (Or more accurately, you dont need anyone elses CA to use SSL just create your own CA and issue yourself a certificate. This can be done without a lot of effort using openssl, for example.) > However, the system could be for some applications potentially get > hardened to certain degree, using the web-of-trust approach. What exactly does this buy you? The SSL certification authority system has as its only (but useful) redeeming value that one can connect to www.somecompany.com and have some level of confidence that the SSL certificate presented by that site was actually issued to www.somecompany.com and was issued by a "reputable" certification authority -- one that presumably will not hand out a certificate stamped www.somecompany.com to creditcardscammer(a)blackhat.net. If the certificate presented is not from one of the recognized "reputable" CAs built into your web browser, SSL itself will still work but your web browser will pop up a box saying that the CA is not in its list of "reputable" CAs (and BTW "would you like to connect anyway? yesno"). I dont understand the mindless worship of the "web of trust". PGP (/GPG) is a useful tool, but the "web of trust" is simply a way of "certifying" a key in a non-centralized, non-hierarchical way. -- Frondeur

2 1

RE: Stego worm
by Major Variola (ret) 12 Dec '03

12 Dec '03

At 08:09 PM 12/11/03 -0500, Tyler Durden wrote: > >As for Variola's comment, you might be right. I just assumed there's some >kind of relationship between LSB and those spatial freuencies wherein image >information might be stored. Actually, I would still think there's a >relationship, in which case an Echelon-like approach based on ffts and >"noise templates" might be going on (hence the usefulness of jamming). I'm not saying that you could never use FT to detect weaker kinds of stego. But if information is encoded as say the parity of 3 LSBits from different regions of the image, good luck. >Anyone got a TLA Operative Handbook? ANy mention in there of what kind of >photos are best for Stego? How about cloud photos? (particularly where there >are clouds of many different shapes and sizes present in the photo >simultaneously.) The most important thing is not to put too much cargo in your carrier. Think in terms of signal to noise if you wish. Obviously a picture with truly uniform color fields ---like a digital cartoon-- won't be useful. But scanning a piece of paper does not have this problem, for say 8 bits per grayscale pixel. Because each analog scan of the same piece of paper gives different bits. TD, you surely have the background to look into this stuff (and stego detection) if you want. BTW Stego ~aka watermarking. And stego can be done in music, movies, ascii text, etc. Or you could work from first principles, if you are able to mentally switch between steganographer and stego-detecter. (This same playing-chess-with-yourself is vital to security analysis, crypto, etc.)

1 0

Fwd: Speaking of Reason
by Freematt357＠aol.com 12 Dec '03

12 Dec '03

In a message dated 12/11/2003 5:25:34 PM Eastern Standard Time, rah(a)shipwright.com writes: > Better be careful when you say that, or Brin'll fire up his screaming > monkey routine at you... I've already had my turn at bat with Brin. He was upset several years ago when I made a few comments about his essay "The Cheerful libertarian", he asked that I send him the subscriber list to Freematt's Alerts so he could contact them directly- He thought that my commentary would adversely effect his ability to sell books- Anyway I told him to shove his request up his ass, at which point he said he'd get my subscriber list by other means. He's a good writer, but IMHO a total nutcase asshole. Regards, Matt- [demime 0.97c removed an attachment of type message/rfc822]

1 0

RE: Has this photo been de-stegoed?
by Trei, Peter 12 Dec '03

12 Dec '03

I'm trying to think of a reason why a recipient of a image containing stego'd information would want to keep it around after reading the contained info, with the stego bits overwritten. Why not just (securely) get rid of it? There are tons of sources of unique ephemeral images, such as webcams. Peter Trei

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from schoen@loyalty.org)
by Eugen Leitl 12 Dec '03

12 Dec '03

----- Forwarded message from Seth David Schoen <schoen(a)loyalty.org> -----

1 0

Re: [linux-elitists] Monday 15 Dec: first all-Open Source System-on-Chip (fwd from jspence@lightconsulting.com)
by Eugen Leitl 12 Dec '03

12 Dec '03

----- Forwarded message from Jason Spence <jspence(a)lightconsulting.com> -----

1 0

PhoneBook: Making your PC 'Police-Ready'
by Nostradumbass＠SAFe-mail.net 12 Dec '03

12 Dec '03

[Wherein the author of Freemail reveals his latest project idea. Comments to the author are appreciated.] PhoneBook is a suite of Linux software that allows you to protect your privacy by creating encrypted filesystems, in such a way as to defend you from both technical and legal attacks. http://www.freenet.org.nz/phonebook/

1 0

Re: Zombie Patriots and other musings
by Anonymous 11 Dec '03

11 Dec '03

The devil is in details. Given small numbers and absence of any other grouping factor there needs to be an "obvious" place for ZPs to refer to. Any obvious place that becomes even remotely attractive to ZPs will be immediately raided. Because ZPs have potential to be actually dangerous to the gang in power, as opposed to everything else I've seen so far. So we're back to square one - effective anonymous publishing is prerequisite for the regime change and executing post-natal abortions. And it has been for centuries. When I say "effective" I don't mean posting a message to Usenet via WiFI-ing into some sucker's open AP. No one gives a fuck for Usenet postings, blacknet etc. - and ZPs are unlikely to educate themselves and search for them. Effective means untouchable web site with untouchable DNS entry. Effective means something doable by average determined person. Like tuning to Radio London from occupied Europe in WW2. Like I said, we're back to square one - all effective means are firmly shut down. Most cpunk talk about secret/stego messaging is mental masturbation that does not relate to the real thing. We want sex.

1 0

Re: Stego worm
by Thomas Shaddack 11 Dec '03

11 Dec '03

On Fri, 12 Dec 2003, Peter Fairbrother wrote: > > Any Chinese want to get immortalized in Internet history? > > And deleted with a bullet, for which they'd have to pay. That's insane. > > The creations of the majority of presently active virii/ worms are not > attributable to individuals. :) That's true. However, you can be immortalized even if your identity isn't known; you can be known under a nym "unknown creator of the StegoWorm". Besides, even Unknown Soldiers sometimes get statues. :) > But:! you will stop all the people who are now using stego .. all two of > them .. their stego will be corrupted Only the ones who use it to store documents in images on read-write media. The files in transit and on read-only wouldn't be corrupted. Speaking of storing data... the best for stego are big not-too-compressed or uncompressed files. Occassionally playing in a garage band or having a DV camera could be a good cover for having disks full of the only copies of WAV and video files, where no "virgin" versions are available for comparison for bit-level changes. Decreasing prices of DV camcorders could be helpful here.

1 0

Good Quote!
by Neil Johnson 11 Dec '03

11 Dec '03

"They keep talking about drafting a Constitution for Iraq. Why don't we just give them ours? It was written by a lot of really smart guys, it's worked for over 200 years, and Hell, we're not using it anymore." -Jay Leno -- Neil Johnson http://www.njohnsn.com PGP key available on request.

1 0

Idea: Using GPG signatures for SSL certificates
by Thomas Shaddack 11 Dec '03

11 Dec '03

The problem that makes me feel uneasy about SSL is the vulnerability of the certification authorities; when they get compromised, everything they signed gets compromised too. However, the system could be for some applications potentially get hardened to certain degree, using the web-of-trust approach. The server presents its certificate to the client. The client then can optionally request the GPG signature of the certificate from the server either by always trying if it is there or only if its presence is indicated in the certificate data fields, and verify it by the specified GPG public key (which then can be firmly embedded in the web of trust). The server's key may be stored on the server itself together with the certificate signature file, or the signature file may indicate the keyserver it should be fetched from. Being signed by several trusted keys is crucial for this purpose, as otherwise it would be trivial to compromise the GPG pubkey together with the signature and the SSL certificate, if the adversary gets access to the server and manages to compromise the CA (risk especially with in-house CAs, or when Agencies get involved). The clients should cache the server's authentication information, and report any changes, like SSH does. The location of the signature may vary; it can be stored in a default place on the server (https://secure.server.com/cert-gpgsignature.asc) or the location can be specified in a X509 field. Is it a good idea? Could it fly? If not, why?

1 0

Re: Zombie Patriots and other musings
by Nostradumbass＠SAFe-mail.net 11 Dec '03

11 Dec '03

From: An Metet <anmetet(a)freedom.gmsociety.org> > The devil is in details. > > Given small numbers and absence of any other grouping factor there needs to be an "obvious" place for ZPs to refer to. Any obvious place that becomes even remotely attractive to ZPs will be immediately raided. If you mean a physical location you're probably right. > Because ZPs have potential to be actually dangerous to the gang in power, as opposed to everything else I've seen so far. > > So we're back to square one - effective anonymous publishing is prerequisite for the regime change and executing post-natal abortions. And it has been for centuries. Not at. All that is required is for a few "early adopters" to point the way and then make their statments through the popular press. Look at what havoc two Joe Sixpacks caused D.C. operating out of the back of a slightly modified sedan. Imagine if they had the home addersses of lots of federal agents instead of randomly picking other Joes filling up their gas tanks. I've heard a project has been underway for some time to create and publish dossiers for federal officers. > > When I say "effective" I don't mean posting a message to Usenet via WiFI-ing into some sucker's open AP. No one gives a fuck for Usenet postings, blacknet etc. - and ZPs are unlikely to educate themselves and search for them. Effective means untouchable web site with untouchable DNS entry. Effective means something doable by average determined person. Like tuning to Radio London from occupied Europe in WW2. Create dossiers on a broad variety the hoster management. If sites are terminated or their DNS is disabled so will managemnt and/or their familes. Like a force of nature, no explanation warning or threat. I2P is coming. With six months it should offer a stable and fairly bullet proof platform for lots of nice apps. It should be easy to install and operate in most consumer net situations. > > Like I said, we're back to square one - all effective means are firmly shut down. Waaa!!! Waaa!!! What a cry baby. Pick you target, go out and shake things up.

1 0

Re: Zombie Patriots and other musings
by An Metet 11 Dec '03

11 Dec '03

The devil is in details. Given small numbers and absence of any other grouping factor there needs to be an "obvious" place for ZPs to refer to. Any obvious place that becomes even remotely attractive to ZPs will be immediately raided. Because ZPs have potential to be actually dangerous to the gang in power, as opposed to everything else I've seen so far. So we're back to square one - effective anonymous publishing is prerequisite for the regime change and executing post-natal abortions. And it has been for centuries. When I say "effective" I don't mean posting a message to Usenet via WiFI-ing into some sucker's open AP. No one gives a fuck for Usenet postings, blacknet etc. - and ZPs are unlikely to educate themselves and search for them. Effective means untouchable web site with untouchable DNS entry. Effective means something doable by average determined person. Like tuning to Radio London from occupied Europe in WW2. Like I said, we're back to square one - all effective means are firmly shut down. Most cpunk talk about secret/stego messaging is mental masturbation that does not relate to the real thing. We want sex.

1 0

Is Matel Stalinist?
by Tyler Durden 11 Dec '03

11 Dec '03

Well, I wouldn't apply the word "oppressive" across the board to the cultures of big companies, but the fact is that modern American coporate culture more often than not imitates a top-down, 'statist' culture that is so universal we rarely recognize it. For instance, high-level strategic decisions are made almost entirely in the vacuum of power. And often, that's appropriate. But many times, the actual people who do the work and know the most about the subject are completely out of the loop. Silicon Valley at its best operates in a very different way...companies are far more driven from the product/technology/service perspective, instead of imagining that balance sheets can make a Lucent into a Cisco. (And at its best, if some hot engineers along with a couple of useful management types feel strongly enough about a missed opportunity, they just split off and start doing it.) But the best of Sillicon Valley is a rare exception. Most of the time "they" make decisions and people who are the technical experts must merely quietly implement those decisions. It's interesting to imagine what would have happened to Lucent if, for instance, the employees could have voted on the acquisition of Chromatis. They would have quickly realized that they were getting a raw $3B deal on a mediocre product, AND that they already had something equivalent ready in-house. Retail is the absolute worst. FOr whatever reason (and I don't believe it has anything to do with competitiveness), big CD or Book chains never empower or reward employees on their ability to purchase books for their store that sell well. In fact, almost zero real purchasing decisions are done locally. But nobody seems to notice...we're completely used to being passive cogs in a big, fat machine-state. So in a sense, it's gone way beyond 'repression'...no need for that rat-cage around our heads anymore. -Tyler Durden >From: Declan McCullagh <declan(a)well.com> >To: "James A. Donald" <jamesd(a)echeque.com> >CC: cypherpunks(a)lne.com >Subject: Re: Decline of the Cypherpunks list...Part 19 >Date: Tue, 9 Dec 2003 09:45:33 -0600 > >On Mon, Dec 08, 2003 at 04:27:38PM -0800, James A. Donald wrote: > > Everyone agrees that big corporations are oppressive, > > bureaucratic, inefficient, etc. No one more so than the > > management advisers to big corporations. > >I'm not sure I'd agree that big corporations are oppressive. How? >I once worked at Xerox and had a splendid time. Didn't feel "oppressed" >at all. > >As for bureaucratic and inefficient, perhaps, but I've seen 50-people >organizations devolve quite well. I suppose it all depends on your >frame of reference. If you mean, "I can find perceived >inefficiencies," I'm sure you can. But if they become too inefficient, >well, over time competitors will rise to take advantage of those >inefficiencies. Xerox can be an example here as well. This is just >common sense. > >-Declan _________________________________________________________________ Take advantage of our best MSN Dial-up offer of the year six months @$9.95/month. Sign up now! http://join.msn.com/?page=dept/dialup

4 4

Re: Is Matel Stalinist?
by Tyler Durden 11 Dec '03

11 Dec '03

Tim May wrote... "Not only does it not make sense, but clearly this would cause pileups at _some_ stores (too much Spam) and shortages at _other_ stores (still not enough Spam, even with the latest "send more Spam to all stores" order. The fact that neither shortages nor pileups (that I can see) are apparent at any of the stores I visit, and that all of them use UPC and POS methods for _all_ sales of ordered products, is consistent with the reorder method described earlier." Oh I have certainly experienced those back in my retail days during college. I was working in a Waldenbooks where the auto-inventory was sent based on sales (as a scaling factor). The store I worked at was basically quite small, but with Class A sales, so during some seasons we were DUMPED with books that we simply couldn't keep up with. They were eventually thrown out or listed as "shrinkage". (But all of that was behind the scenes...the customers couldn't SEE the pileup.) But, notice how Waldenbooks has gotten WACKED by these big Borders' and B&Ns. Maybe these are smarter (or, these "giant" bookstores don't really need to consider shelf space...). Continuing... "I repeat: the "despised by anti-capitalists" Borders store has a deeper and broader inventory of books than the "cherished by Greens and locals" locall-owned bookstore. And they also use UPC and POS and reorder books dynamically." Well, don't lump me in there. My point was not that such stores COULDN'T provide the level of service that an indpendent could. My point was that the "statist" culture that we are so used to prevents many big retail chains from taking advantage of their "human capital". If Borders learned, then great. (In fact, I helped quash a local bookstore during aforementioned stint...the guy was just a shitty, arrogant businessman and deserved to be run outta town. My only regret was that I made $3.35/hour to do it.) Food is different from music or books, however. Books are much less of a commodity in that a particular neighborhood may respond very strongly to certain types of books, and ignore other kinds. Inventory systems can't really get the ball rolling on that kind of thing...they don't tell you what the locals want (but you don't have), they only tell you what they've already bought. Thus, a well-run chain would hire smart local college kids and let them order (in additionto the "basics" that come from the inventory systems). What I've yet to see is where a low-level retail kid is actually given a piece of the action: "Here kid...if you increase the sales of this Sci-Fi section by 45% then you'll get 2% of each book sold after that." I'd like to see a chain try that kind of a thing, but that seems WAY too down-up for most corporate cultures. -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: Re: Is Matel Stalinist? >Date: Thu, 11 Dec 2003 11:36:03 -0800 > >On Dec 11, 2003, at 1:56 AM, ken wrote: >> >>>Corporations have sales tracking software out the wazoo. If it sells, >>>they buy more and sell them. Sounds like they're doing precisely what >>>their owners want them to do. >> >>Yes, but, it might be that a corporation makes more money for its owners >>by centralising and systematising and reducing the local autonomy of >>business units. It's a lot easier to manage a thousand identical stores >>than a hundred unique ones. So from "Tyler Durden's"'s POV there might be >>more responsiveness from an independent store than a chain. >> >>Though like you said, that doesn't seem to apply to books. Might to food >>though. >> > >I doubt it applies to food, either. > >If my local grocery store runs low on "Spam," say, they will order more. >This is why they track items with POS terminals and UPC labels (largely >replacing the inventory people who used to be seen in the aisles counting >items and entering them into a small computer or, earlier, onto an >inventory log sheet). > >It makes no sense to "lump" or "consolidate" all of the stores into one >lump calculation and then issue order to "send more Spam in this amount to >each store." Not only does it not make sense, but clearly this would cause >pileups at _some_ stores (too much Spam) and shortages at _other_ stores >(still not enough Spam, even with the latest "send more Spam to all stores" >order. The fact that neither shortages nor pileups (that I can see) are >apparent at any of the stores I visit, and that all of them use UPC and POS >methods for _all_ sales of ordered products, is consistent with the reorder >method described earlier. > >I repeat: the "despised by anti-capitalists" Borders store has a deeper and >broader inventory of books than the "cherished by Greens and locals" >locall-owned bookstore. And they also use UPC and POS and reorder books >dynamically. > >(For another list I've been discussing lazy evaluation languages, like >Miranda and Haskell, and like Scheme can be "forced" to do, and the >similarities between demand-driven evaluation of partial results and the >obviously demand-driven inventory practices of modern businesses is >striking. There's an essay here for some political thinker, along the lines >of Phil Salin's "Wealth of Kitchens" essay drawing parallels between free >markets and object-oriented systems.) > >--Tim May _________________________________________________________________ Cell phone switch rules are taking effect find out more here. http://special.msn.com/msnbc/consumeradvocate.armx

1 0

Stego worm
by Thomas Shaddack 11 Dec '03

11 Dec '03

It's unknown to which extent the Adversary can detect presence of steganography in images being sent over the Net. But whatever capabilities they have, they can be jammed. Imagine a worm that spreads from machine to machine, and on the infected machine it finds all suitable JPEG files, generates some random data as source and encrypts them with random key, and stegoes them into the files. In few days or even hours, a sizeable portion of images on the Net contains potentially detectable stegoed encrypted data. Any Chinese want to get immortalized in Internet history?

1 0

interesting pattern
by An Metet 11 Dec '03

11 Dec '03

I have noticed this lately: When someone sends mail to user(a)thisdomain.com , shortly thereafter a query comes from the ISP that runs the outgoing SMTP and loads http://www.thisdomain.com. The query does not load any images, just the base html page. It comes from IP usually in the same cloud as outgoing SMTP. Sometimes this happens only after the first mail from that ISP to thisdomain.com, sometimes every time. Is this anti-spam (why querying the recipient?), or some data harvesting and connecting the dots?

2 1

Re: Is Matel Stalinist?
by Tyler Durden 11 Dec '03

11 Dec '03

Ken wrote... "Tyler Durden's" GET them damn quote marks offa my name, or I'm comin' over there to stomp your pasty-white British ass!!!!! Ahem. As for Tim May's replies to my original post, he seems to have misenterpreted most of the basic gist of it. My basic point was that corporate culture (as you say) basically imitates a monarchy (or other very 'statist' structures) and as a result often prevents them from utilizing their resources properly. It would be nice to think of Borders as a counter-example, and I'd LIKE to believe that utilizing their talent-on-the-floor has helped them do so well here in the US. (Though these mega-Barnes-and-Nobles may have dented their numbers in the last few years...) -TD >From: ken <bbrow07(a)students.bbk.ac.uk> >To: cypherpunks(a)lne.com >Subject: Re: Is Matel Stalinist? >Date: Thu, 11 Dec 2003 09:56:31 +0000 > >Tim May quoted Tyler Durden who wrote: > >>>Well, I wouldn't apply the word "oppressive" across the board to the >>>cultures of big companies, but the fact is that modern American coporate >>>culture more often than not imitates a top-down, 'statist' culture that >>>is so universal we rarely recognize it. > >Well, yes. Most big corporations are in effect constitutional monarchies. >Decisions are made by bureaucrats with some oversight or direction >provided by the "king" (CEO in some places, significant shareholders in >others). When it all goes totally pear-shaped owners (or more likely, the >banks) step in. > >[...] > >>The difference with government is that we do not have "polycentric" >>governments. We have a single entity, a single "corporation," which brooks >>no competition, which brooks little or no "shareholder dissent." > >Yes, but in practice a lot of big companies are just like that. Whatever >the paper ownership decisions tend to be made by a few large corporate >owners, often banks, insurance companies, pension funds and the like; >themselves run by officers and managers who share interests with the >managers who run the company they own. The situation is in some ways >analogous to "it doesn't matter who you vote for: the government always >gets in". In most large corporations the chain of responsibility back to >individual owners is so long and so flexible that there is little real >control. > >Small business is different of course. You make money or you go broke. >Very direct feedback. > >>Many here miss this point and focus on the superficial aspect that >>corporations typically have a hierarchy and that this hierarchy supposedly >>makes them like governments. Yes, in this respect. But the tens of >>thousands of corporations, the ability to form new partnerships, new >>companies, new corporations, and for some of these entities to become as >>large as past corporate giants, is what makes all the difference. > >Emotional reactions & gut feelings about this point are one of the things >that make people happier with one political camp or another. > >The state-socialism that you Americans call "liberal" tends to be >supported by people who feel that their governments are more responsive to >their needs or wants than corporations are. Conservatives US-style >libertarians are likely to feel happier with corporations than government. >The "anti-globalisation" crows and European-style left anarchists & >old-style non-Marxist socialists dislike both equally. > >If I was cynical, or a Marxist, I'd say that it has a lot to do with having >money. People whose wealth makes up a larger share of the whole than their >vote does are more likely to feel happy about corporations than they are >about representative government. > >OK, it's before noon and I've only had one cup of tea, so I'm cynical. > >[...] > >>Corporations have sales tracking software out the wazoo. If it sells, they >>buy more and sell them. Sounds like they're doing precisely what their >>owners want them to do. > >Yes, but, it might be that a corporation makes more money for its owners by >centralising and systematising and reducing the local autonomy of business >units. It's a lot easier to manage a thousand identical stores than a >hundred unique ones. So from "Tyler Durden's"'s POV there might be more >responsiveness from an independent store than a chain. > >Though like you said, that doesn't seem to apply to books. Might to food >though. _________________________________________________________________ Winterize your home with tips from MSN House & Home. http://special.msn.com/home/warmhome.armx

2 1

Re: Has this photo been de-stegoed? (and Clouds)
by Major Variola (ret) 11 Dec '03

11 Dec '03

At 02:35 PM 12/11/03 -0500, Tyler Durden wrote: >Variola wrote... > >"How do you know the signature of the unaltered carrier-medium? >E.g., have you measured the LSBit noise from my camera recently? >Under which lighting conditions?" > >Well, having done some optical signal processing (and getting a patent in >that area, come to think of it), I imagined that most photos will naturally >have some image noise in certain frequency bands... You are *way* too FT based in your thinking. There are *many* other measurements and statistics and co-relations. And the noise I was referring to is in part electronic noise, not image noise in either the spatial freq. or poisson sense. The point being that there is info that is perceptually insignificant, that you can replace with compressed encrypted bits.

1 0

Dangerous Proxies to Avoid
by Nostradumbass＠SAFe-mail.net 11 Dec '03

11 Dec '03

If you use anonymous proxies it would be wise to save the list below and compare the IP's to make sure you are not surfing in shark-infested waters. I often use tools to scan for and test 'public' proxies, and other tools to chain or rotate through the best. I'm sure others of us do the same. This just underscores the need for trustworthy mixes. Single proxies (eg anonymizer.com) only hide IPs from web servers, not from 3rd party observers. They are vulnerable to black bag and legal attacks. Aparently we can safely(?) use JAP again if careful about cascade selection. But this is very slow, and slow discourages one from consistent use.... As for JAP, I used it before Privatesea came up, and i'm back down to it now that privatesea dissapeared. By using cascades that don't end at the Dresden mix, and inserting a single pseudo-public SSL proxy between JAP and the first mix, you're pretty safe. But the performance sucks. There are no other mix cascades or meshes that I know of. Lots of single proxies, but that's not safe at all. And you are often having to find and setup another when they get hammered down or start blocking the public. An updated list, current as of 5 October: 6.*.*.* : Army Information Systems Center 21.*.*.* : US Defense Information Systems Agency 6.*.*.* : Army Information Systems Center 21.*.*.* : US Defense Information Systems Agency 22.*.*.* : Defense Information Systems Agency 26.*.*.* : Defense Information Systems Agency 29.*.*.* : Defense Information Systems Agency 30.*.*.* : Defense Information Systems Agency 49.*.*.* : Joint Tactical Command 50.*.*.* : Joint Tactical Command 55.*.*.* : Army National Guard Bureau 22.*.*.* : Defense Information Systems Agency 26.*.*.* : Defense Information Systems Agency 29.*.*.* : Defense Information Systems Agency 30.*.*.* : Defense Information Systems Agency 49.*.*.* : Joint Tactical Command 50.*.*.* : Joint Tactical Command 55.*.*.* : Army National Guard Bureau 62.0-30.*.* : 64.224.*.* : 64.225.*.* : 64.226.*.* : 195.10.* : 199.121.4.* - 199.121.253.* Naval Air Systems Command, VA (NETBLK-NALC-P3) 204.34.*.* - 204.34.254.0 Navy Environmental Preventive Medicine (NET-NEPMU6-BUMED) 205.96-103.* : 207.30-120.* : 207.60-61.* : FBI Linux server used to trap scanners 209.35.*.* : 210.124*.* - Korean 212.143 * Israeli government ISP -- dont try those ranges!! 212.149.* Israeli government ISP -- dont try those ranges!! 212.179.* Israeli government ISP -- dont try those ranges!! 212.199 012.* Israeli government ISP -- dont try those ranges!! 213.8.*.* Israeli government ISP -- dont try those ranges!! 216.248.*.* VERY DANGEROUS 216.25.* VERY DANGEROUS 216.94.*.* 216.25.* : VERY DANGEROUS 216.247.* : VERY DANGEROUS 217.6.*.* : VERY DANGEROUS 155.7.*.* : American Forces Information (NET-AFISHQ-NET1) 155.8.*.* : U.S. ArmyFort Gordon (NET-GORDON-NET5) 155.9.*.* : United States Army Information Systems Command (NET-LWOOD-NET2) 155.74.*.* : PEO STAMIS (NET-CEAP2) 155.75.*.* : US Army Corps of Engineers (NET-CEAP3) 155.76.*.* : PEO STAMIS (NET-CEAP4) 155.77.*.* : PEO STAMIS (NET-CEAP5) 155.78.*.* : PEO STAMIS (NET-CEAP6) 155.79.*.* : US Army Corps of Engineers (NET-CEAP7) 155.80.*.* : PEO STAMIS (NET-CEAP 155.81.*.* : PEO STAMIS (NET-CEAP9) 155.82.*.* : PEO STAMIS (NET-CEAP10) 155.83.*.* : US Army Corps of Enginers (NET-CEAP11) 155.84.*.* : PEO STAMIS (NET-CEAP12) 155.85.*.* : PEO STAMIS (NET-CEAP13) 155.86.*.* : US Army Corps of Engineers (NET-CEAP14) 155.87.*.* : PEO STAMIS (NET-CEAP15) 155.88.*.* : PEO STAMIS (NET-CEAP16) 155.178.*.* : Federal Aviation Administration (NET-FAA) 155.213.*.* : USAISC Fort Benning (NET-FTBENNNET3 155.214.*.* : Director of Information Management (NET-CARSON-TCACC ) 155.215.*.* : USAISC-FT DRUM (NET-DRUM-TCACCIS) 155.216.*.* : TCACCIS Project Management Office (NET-FTDIX-TCACCI) 155.217.*.* : Directorate of Information Management (NET- EUSTIS-EMH1) 155.218.*.* : USAISC (NET-WVA-EMH2) 155.219.*.* : DOIM/USAISC Fort Sill (NET-SILL-TCACCIS) 155.220.*.* : USAISC-DOIM (NET-FTKNOX-NET4) 155.221.*.* : USAISC-Ft Ord (NET-FTORD-NET2) 128.47.*.* : Army Communications Electronics Command (NET-TACTNET) 128.50.*.* : Department of Defense (NET-COINS) 128.51.*.* : Department of Defense (NET-COINSTNET) 128.56.*.* : U.S. Naval Academy (NET-USNA-NET) 128.63.*.* : Army Ballistics Research Laboratory (NET-BRL-SUBNET) 128.80.*.* : Army Communications Electronics Command (CECOM) (NET-CECOMNET) 128.98.*.* to 128.98.255.255: Defence Evaluation and Research Agency (NET-DERA-UK) 128.154.*.* : NASA Wallops Flight Facility (NET-WFF-NET) 128.155.*.* : NASA Langley Research Center (NET-LARC-NET) 128.156.*.* : NASA Lewis Network Control Center (NET- LERC) 128.157.*.* : NASA Johnson Space Center (NET-JSC-NET) 128.158.*.* : NASA Ames Research Center (NET-MSFC-NET) 128.159.*.* : NASA Ames Research Center (NET-KSC-NET) 128.160.*.* : Naval Research Laboratory (NET- SSCNET) 128.161.*.* : NASA Ames Research Center (NET-NSN-NET) 128.183.*.* : NASA Goddard Space Flight Center (NET-GSFC) 128.216.*.* : MacDill Air Force Base (NET-CC-PRNET) 128.217.*.* : NASA Kennedy Space Center (NET-NASA-KSC-OIS) 128.236.*.* : U.S. Air Force Academy (NET-USAFA-NET 132.3.*.* to 132.225.*.* Atomic Energy of Canada Limited (NET-AECL-RCNET) 134.11.*.* The Pentagon (NET-PENTNET) 134.12.*.* NASA Ames Research Center (NET-RIACS-B-NET) 134.164.*.* Army Engineer Waterways Experiment Station (NET-USAEWESNET) 134.165.*.* Headquarters Air Force Space Command (NET-SPACENET1) 134.229.*.* Navy Regional Data Automation Center (NET- REGION-PEN1) 134.230.*.* Navy Regional Data Automation Center (NET- CONCGY-PENS2) 134.232.*.* - 134.232.255.255 U.S. Army, Eu 134.5.*.* Lockheed Aeronautical Systems Company (NET-LASC) 134.51.*.* Boeing Military Aircraft Facility (NET-BOE-MIL) 134.52.*.* Boeing Corporation (NET-BOE-GIS) 134.78.*.* Army Information Systems Command-ATCOM (NET-AVTROS-NET) 136.149.*.* Air Force Military Personnel Center (NET-AFMPC-LAN) 139.142.*.* : 139.142.153.23 : Front end portal of a security network filtering hundreds of client subscription IPs. If you find a vulnerable pub,IIS, SQL, or *nix -- LEAVE IT ALONE FBI's honeypot HoneyNet Project http://project.honeynet.org/ Know your Ennemy : HoneyNets http://project.honeynet.org/papers/honeynet/ SANS IDS FAQ : What is Honeypot ? http://www.sans.org/newlook/resourc...Q/honeypot3.htm Honey Pots and Intrusion Detection http://www.sans.org/infosecFAQ/intrusion/honeypots.htm The Deception Toolkit http://www.all.net/dtk/index.html An Explanation of Computer Forensic http://www.computerforensics.net/forensics.htm Computer Forensics An Overview http://www.sans.org/infosecFAQ/incident/forensics.htm The Forensic Challenge http://project.honeynet.org/challenge/ Forensic Computer Analysis - An Introduction http://www.ddj.com/articles/2000/0009/0009f/0009f.htm The Coroner Toolkit http://www.fish.com/tct/ 207.60.*.* : (FBI's honeypot) The Internet Access Company (NETBLK-TIAC-BLK) 207.60.2.128 - 207.60.2.255 Abacus Technology (NETBLK-TIAC-ABACUSTC) 64.224.* : (FBI's honeypot) 64.225.* : (FBI's honeypot) 64.226.* : (FBI's honeypot) 195.10.* : (FBI's honeypot) 205.96-103.* : (FBI's honeypot) 207.30-120.* : (FBI's honeypot) 207.60-61.* : (FBI's honeypot) 209.35.* : (FBI's honeypot) 216.25.* : (FBI's honeypot) INTERLAND --- hosts DoD 216.247.* : (FBI's honeypot) 212.159.40.211 : (FBI's honeypot) 212.159.41.173 : (FBI's honeypot) 212.159.0.2 : (FBI's honeypot) 212.159.1.1 : (FBI's honeypot) 212.159.1.4 : (FBI's honeypot) 212.159.1.5 : (FBI's honeypot) 212.56.107.22 : (FBI's honeypot) 212.159.0.2 : (FBI's honeypot) 212.159.33.56 : (FBI's honeypot) 212.56.107.22 : (FBI's honeypot) 139.142.*.* : 139.142.153.23 : Front end portal of a security network filtering hundreds of client subscription IPs. If you find a vulnerable pub, IIS, SQL, or *nix -- LEAVE IT ALONE 207.60.0.0 - 207.60.255.0 The Internet Access Company (NETBLK-TIAC-BLK) 207.60.2.128 - 207.60.2.255 Abacus Technology (NETBLK-TIAC-ABACUSTC) 207.60.3.0 - 207.60.3.127 Mass Electric Construction Co. (NETBLK-TIAC-MECC56-2) 207.60.3.128 - 207.60.3.255 Peabody Proberties Inc (NETBLK-TIAC-PEABISDN1) 207.60.4.0 - 207.60.4.127 Northern Electronics (NETBLK-TIAC-NORTHERELEC) 207.60.4.128 - 207.60.4.255 Posternak, Blankstein & Lund (NETBLK-TIAC-PBL56) 207.60.5.64 - 207.60.5.127 Woodard & Curran (NETBLK-TIAC-WCPORT) 207.60.5.192 - 207.60.5.255 On Line Services (NETBLK-TIAC-ONLINES-1) 207.60.6.0 - 207.60.6.63 The 400 Group (NETBLK-TIAC-400T1) 207.60.6.64 - 207.60.6.127 RD Hunter and Company (NETBLK-TIAC-RDHUNTER2) 207.60.6.128 - 207.60.6.191 Louis Berger and Associates (NETBLK-TIAC-BERISDN) 207.60.6.192 - 207.60.6.255 Ross-Simons (NETBLK-TIAC-ROSIMONS) 207.60.7.0 - 207.60.7.63 Eastern Cambridge Savings Bank (NETBLK-TIAC-ECSB) 207.60.7.64 - 207.60.7.127 Greater Lawrence Community Action Committee (NETBLK-TIAC-GLCAC12 207.60.7.128 - 207.60.7.191 Data Electronic Devices, Inc (NETBLK-TIAC-DEDI) 207.60.8.0 - 207.60.8.255 Sippican (NETBLK-TIAC-SIPPICAN) 207.60.9.0 - 207.60.9.31 Alps Sportswear Mfg Co (NETBLK-TIAC-ALPISDN) 207.60.9.32 - 207.60.9.63 Escher Group Ltd (NETBLK-TIAC-ESCHERT1-2) 207.60.9.64 - 207.60.9.95 West Suburban Elder (NETBLK-TIAC-WESTISDN) 207.60.9.96 - 207.60.9.127 Central Bank (NETBLK-TIAC-CENTRALT) 207.60.9.128 - 207.60.9.159 Danick Systems (NETBLK-TIAC-DCS12 207.60.9.160 - 207.60.9.191 Alps Sportswear Mfg CO (NETBLK-TIAC-ALPSISDN) 207.60.9.192 - 207.60.9.223 BSCC (NETBLK-TIAC-BSCC) 207.60.13.16 - 207.60.13.23 Patrons Insurance Group (NETBLK-TIAC-PATRON99) 207.60.13.40 - 207.60.13.47 Athera Technologies (NETBLK-TIAC-ATHERA1) 207.60.13.48 - 207.60.13.55 Service Edge Partners Inc (NETBLK-TIAC-SERVISDN-2) 207.60.13.56 - 207.60.13.63 Massachusetts Credit Union League (NETBLK-TIAC-MCUL384) 207.60.13.64 - 207.60.13.71 SierraCom (NETBLK-TIAC-SIER384K) 207.60.13.72 - 207.60.13.79 AI/ FOCS (NETBLK-TIAC-AIFOC384) 207.60.13.80 - 207.60.13.87 Extreme soft (NETBLK-TIAC-DOWNIE) 207.60.13.96 - 207.60.13.103 Eaton Seo Corp (NETBLK-TIAC-EATON) 207.60.13.112 - 207.60.13.119 C. White (NETBLK-TIAC-PETROL) 207.60.13.120 - 207.60.13.127 Athera (NETBLK-TIAC-ATHERA-2) 207.60.13.128 - 207.60.13.135 Entropic Systems, INC (NETBLK-TIAC-ENTRO12 207.60.13.136 - 207.60.13.143 Wood Product Manufactureds Associates (NETBLK-TIAC-WOOD56) 207.60.13.160 - 207.60.13.167 Jamestown Distribution (NETBLK-TIAC-JAMES56) 207.60.13.168 - 207.60.13.175 C&M Computers (NETBLK-TIAC-CRAMB-2 ) 207.60.13.176 - 207.60.13.183 ABC Used Auto Parts (NETBLK-TIAC-ABC56K) 207.60.13.184 - 207.60.13.191 Tomas Weldon (NETBLK-TIAC-TWELDON) 207.60.13.192 - 207.60.13.199 Tage Inns (NETBLK-TIAC-TAGE) 207.60.13.200 - 207.60.13.207 Control Module Inc (NETBLK-TIAC-CMOD56K) 207.60.13.208 - 207.60.13.215 Hyper Crawler Information Systems (NETBLK-TIAC-HCRAWLER) 207.60.13.216 - 207.60.13.223 Eastern Bearings (NETBLK-TIAC-EB56K) 207.60.13.224 - 207.60.13.231 North Shore Data Services (NETBLK-TIAC-NSDS) 207.60.13.232 - 207.60.13.239 Mas New Hampshire (NETBLK-TIAC-MASISDN) 207.60.14.0 - 207.60.14.255 J. A. Webster (NETBLK-TIAC-JAWFRT1-2) 207.60.15.0 - 207.60.15.127 Trilogic (NETBLK-TIAC-LOGIC384) 207.60.16.0 - 207.60.16.255 Area 54 (NETBLK-TIAC-AREA54) 207.60.18.0 - 207.60.18.63 Vested Development Inc (NETBLK-TIAC-VESTEDT-2) 207.60.18.64 - 207.60.18.127 Conventures (NETBLK-TIAC-CON56-2) 207.60.21.0 - 207.60.21.255 Don Law Company (NETBLK-TIAC-DONLAWT1-2) 207.60.22.0 - 207.60.22.255 Advanced Microsensors (NETBLK-TIAC-AMS384) 207.60.28.0 - 207.60.28.63 Applied Business Center (NETBLK-TIAC-APP56K-2) 207.60.28.64 - 207.60.28.127 Color and Design Exchange (NETBLK-TIAC-COLOR-2) 207.60.36.8 - 207.60.36.15 Shaun McCusker (NETBLK-TIAC-FINLAY) 207.60.36.16 - 207.60.36.23 Town of Framingham (NETBLK-TIAC-INFOSERV) 207.60.36.24 - 207.60.36.31 AB Software (NETBLK-TIAC-ABSADSL) 207.60.36.32 - 207.60.36.39 Seabass Dreams Too Much, Inc (NETBLK-TIAC-SEABASS) 207.60.36.40 - 207.60.36.47 Next Ticketing (NETBLK-TIAC-NT256T1-2) 207.60.36.48 - 207.60.36.55 Dulsi (NETBLK-TIAC-DULSI) 207.60.36.56 - 207.60.36.63 The Internet Access Company (NETBLK-TIAC-PTIMJ) 207.60.36.64 - 207.60.36.71 Maguire Group (NETBLK-TIAC-MAGISDN) 207.60.36.72 - 207.60.36.79 Cogenex (NETBLK-TIAC-COGENEX-2) 207.60.36.88 - 207.60.36.95 AKNDC (NETBLK-TIAC-AKNDC) 207.60.36.96 - 207.60.36.103 McGovern election commitee (NETBLK-TIAC-MCGOVDED) 207.60.36.104 - 207.60.36.111 Digital Equipment Corp (NETBLK-TIAC-DECISDN) 207.60.36.112 - 207.60.36.119 PTR - Precision Technologies (NETBLK-TIAC-PTREB) 207.60.36.120 - 207.60.36.127 Extech (NETBLK-TIAC-EXTECH-2) 207.60.36.128 - 207.60.36.135 Manfreddi Architects (NETBLK-TIAC-MANELKUS-2) 207.60.36.144 - 207.60.36.151 Parent Naffah (NETBLK-TIAC-PARENT) 207.60.36.152 - 207.60.36.159 Darling Dolls Inc (NETBLK-TIAC-EMARTEL) 207.60.36.160 - 207.60.36.167 Wright Communications (NETBLK-TIAC-WRIGHT56) 207.60.36.168 - 207.60.36.175 Principle Software (NETBLK-TIAC-PRINCIPL) 207.60.36.176 - 207.60.36.183 Chris Pet Store (NETBLK-TIAC-CPETDIAL) 207.60.36.184 - 207.60.36.191 Fifteen Lilies (NETBLK-TIAC-GREYROSE) 207.60.36.192 - 207.60.36.199 All-Com Technologies (NETBLK-TIAC-ALLCOM1-2) 207.60.37.0 - 207.60.37.31 Cardio Thoracic Surgical Associates, P. A. (NETBLK-TIAC-HEARTDOC) 207.60.37.32 - 207.60.37.63 Preferred Fixtures Inc (NETBLK-TIAC-PREFMFG-2) 207.60.37.64 - 207.60.37.95 Apple and Eve Distributors (NETBLK-TIAC-AEDED99) 207.60.37.96 - 207.60.37.127 Nelson Copy Supply (NETBLK-TIAC-NCOP56K) 207.60.37.128 - 207.60.37.159 Boston Optical Fiber (NETBLK-TIAC-BOSISDN) 207.60.37.192 - 207.60.37.223 Fantasia&Company (NETBLK-TIAC-FANTCOMP) 207.60.41.0 - 207.60.41.255 Infoactive (NETBLK-TIAC-INFOACT-2) 207.60.48.0 - 207.60.48.255 Curry College (NETBLK-TIAC-CURRY) 207.60.62.32 - 207.60.62.63 Alternate Power Source (NETBLK-TIAC-APSIS) 207.60.62.64 - 207.60.62.95 Keystone Howley-White (NETBLK-TIAC-KEYSTONE-2) 207.60.62.128 - 207.60.62.159 Bridgehead Associates LTD (NETBLK-TIAC-BRIDG384) 207.60.62.160 - 207.60.62.191 County Supply (NETBLK-TIAC-CS384) 207.60.62.192 - 207.60.62.223 NH Board of Nursing (NETBLK-TIAC-NHBNDED99) 207.60.64.0 - 207.60.64.63 Diversified Wireless Technologies (NETBLK-TIAC-LAUCHAM) 207.60.64.64 - 207.60.64.127 Phytera (NETBLK-TIAC-PHYTERA1) 207.60.66.0 - 207.60.66.15 The Network Connection (NETBLK-TIAC-TNC56) 207.60.66.16 - 207.60.66.31 Young Refrigeration (NETBLK-TIAC-YRDED135) 207.60.66.32 - 207.60.66.47 Vision Appraisal Technology (NETBLK-TIAC-VISIONT1) 207.60.66.48 - 207.60.66.63 EffNet Inc (NETBLK-TIAC-EFFNETT1) 207.60.66.64 - 207.60.66.79 Entropic Systems Inc (NETBLK-TIAC-ENTRO128-3) 207.60.66.80 - 207.60.66.95 Finley Properties (NETBLK-TIAC-FPDED135) 207.60.66.96 - 207.60.66.111 Nancy Plowman Associates (NETBLK-TIAC-NPAISDN) 207.60.66.112 - 207.60.66.127 Northeast Financial Strategies (NETBLK-TIAC-NFSISDN) 207.60.66.128 - 207.60.66.143 Textnology Corp (NETBLK-TIAC-TEXTC0RP) 207.60.66.144 - 207.60.66.159 Groton Neochem LLC (NETBLK-TIAC-NEOCHEM) 207.60.66.160 - 207.60.66.175 Tab Computers (NETBLK-TIAC-TCSI3) 207.60.66.176 - 207.60.66.191 Patrons Insurance (NETBLK-TIAC-PATRON99-2) 207.60.66.192 - 207.60.66.207 Chair City Web (NETBLK-TIAC-CHAIR56K) 207.60.66.208 - 207.60.66.223 Radex, Inc. (NETBLK-TIAC-RADEXINC ) 207.60.66.224 - 207.60.66.239 Robert Austein (NETBLK-TIAC-HACTRN) 207.60.66.240 - 207.60.66.255 Hologic Inc. (NETBLK-TIAC-HOLOGIC3) 207.60.71.64 - 207.60.71.127 K-Tech International Inc. (NETBLK-TIAC-KTECH) 207.60.71.128 - 207.60.71.191 Pan Communications (NETBLK-TIAC-PANCOM-2) 207.60.71.192 - 207.60.71.255 New England College of Finance (NETBLK-TIAC-NECF56K) 207.60.75.128 - 207.60.75.255 Absolve Technology (NETBLK-TIAC-ABSOLVE-2) 207.60.78.0 - 207.60.78.127 Extech (NETBLK-TIAC-EXTECH) 207.60.78.128 - 207.60.78.255 The Insight Group (NETBLK-TIAC-MFIA) 207.60.83.0 - 207.60.83.255 JLM Technologies (NETBLK-TIAC-JLMISDN) 207.60.84.0 - 207.60.84.255 Strategic Solutions (NETBLK-TIAC-STRATSOL-2) 207.60.94.0 - 207.60.94.15 McWorks (NETBLK-TIAC-MCWORKSS) 207.60.94.32 - 207.60.94.47 Rooney RealEstate (NETBLK-TIAC-ROONEY56) 207.60.94.48 - 207.60.94.63 Joseph Limo Service (NETBLK-TIAC-JOLIMO56) 207.60.94.64 - 207.60.94.79 The Portico Group (NETBLK-TIAC-PORT56K) 207.60.94.80 - 207.60.94.95 Event Travel Management Inc (NETBLK-TIAC-EVENT384) 207.60.94.96 - 207.60.94.111 Intellitech International (NETBLK-TIAC-IIDED99) 207.60.94.128 - 207.60.94.143 Orion Partners (NETBLK-TIAC-ORION56) 207.60.94.144 - 207.60.94.159 Rainbow Software Solution (NETBLK-TIAC-RAIN99) 207.60.94.160 - 207.60.94.175 Grason Stadler Inc (NETBLK-TIAC-GRASON56) 207.60.94.192 - 207.60.94.207 Donnegan System (NETBLK-TIAC-DYST384-2) 207.60.95.1 - 207.60.95.255 The Iprax Corp. (NETBLK-TIAC-IPRAX56K) 207.60.102.0 - 207.60.102.63 Coporate IT (NETBLK-TIAC-CIT) 207.60.102.64 - 207.60.102.127 Putnam Technologies (NETBLK-TIAC-PUTTECH) 207.60.102.128 - 207.60.102.191 Sycamore Networks, Inc (NETBLK-TIAC-SYCAISDN) 207.60.102.192 - 207.60.102.255 Bostek (NETBLK-TIAC-BOSTEK) 207.60.103.128 - 207.60.103.255 Louis Berger and Associates (NETBLK-TIAC-BERGISDN) 207.60.104.128 - 207.60.104.191 Hanson Data Systems (NETBLK-TIAC-HHANSON) 207.60.106.128 - 207.60.106.255 Giganet Inc. (NETBLK-TIAC-GIGANET-3) 207.60.107.0 - 207.60.107.255 Roll Systems (NETBLK-TIAC-ROLLISDN) 207.60.108.8 - 207.60.108.15 InternetQA (NETBLK-TIAC-EBENNETT) 207.60.111.0 - 207.60.111.31 Reading Cooperative Bank (NETBLK-TIAC-READ56K) 207.60.111.32 - 207.60.111.63 Edco collaborative (NETBLK-TIAC-EDCOT1) 207.60.111.64 - 207.60.111.95 DTC Communications Inc (NETBLK-TIAC-DTCCOM2) 207.60.111.96 - 207.60.111.127 Mike Line (NETBLK-TIAC-MLINE ) 207.60.111.128 - 207.60.111.159 The Steppingstone Foundation (NETBLK-TIAC-STEP56) 207.60.111.160 - 207.60.111.191 Caton Connector (NETBLK-TIAC-CATON118K) 207.60.111.192 - 207.60.111.223 Refron, Inc (NETBLK-TIAC-REFRON1 ) 207.60.111.224 - 207.60.111.255 Dolabany Comm Group (NETBLK-TIAC-DCGDED99) 207.60.112.0 - 207.60.112.255 207.60.116.0 - 207.60.116.255 207.60.122.16 - 207.60.122.23 207.60.122.24 - 207.60.122.31 207.60.122.32 - 207.60.122.39 207.60.122.40 - 207.60.122.47 207.60.122.48 - 207.60.122.55 207.60.122.56 - 207.60.122.63 207.60.122.64 - 207.60.122.71 207.60.122.72 - 207.60.122.79 207.60.122.80 - 207.60.122.87 207.60.122.88 - 207.60.122.95 207.60.122.96 - 207.60.122.103 207.60.122.104 - 207.60.122.111 207.60.127.0 207.60.128.0 - 207.60.128.255 207.60.129.0 - 207.60.129.255 207.60.129.64 - 207.60.129.127 207.60.129.128 - 207.60.129.191 207.60.129.192 - 207.60.129.255 207.30.* - 207.120.* 207.60.* - 207.61.* 205.96.* - 205.103.* 209.35.* 216.25.* 216.247.* VERY DANGEROUS 64.224.* 64.225.* 64.226.* 195.10.* 62.0.0.1 - 62.30.255.255 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.159.33.56 212.159.40.211 212.159.41.173 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.56.107.22 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.159.33.56 212.159.40.211 212.159.41.173 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.56.107.22 The IP listed below is a fake front end portal of a security network filtering hundreds of client subscription IPs. If you find a vulnerable pub, IIS, SQL, or *nix -- LEAVE IT ALONE. AVOID THIS RANGE: 139.142.* WARNING: Replicon's security team is working close with federal/state and corporate law enforcement. They will let you scan, tag, fill, or overtake the entire system. But you really have no control. They are monitoring you, accepting your every move while they profile you. Your dumbass is on Candid Camera. (The *nix box that you 'overtake' is actually a guided security emulator that runs on NT...) Let 'em record you ploppin' the newest, unrealeased version of Photoshop, Windows, Lightwave. Max, Maya, Cosmo, or others and you (as well as everyone else involved in the operation - from Scanner to Downloader) will be 'profiled' for a very unhappy future.... 6.*.*.* - Army Information Systems Center 21.*.*.* - US Defense Information Systems Agency 22.*.*.* - Defense Information Systems Agency 26.*.*.* - Defense Information Systems Agency 29.*.*.* - Defense Information Systems Agency 30.*.*.* - Defense Information Systems Agency 49.*.*.* - Joint Tactical Command 50.*.*.* - Joint Tactical Command 55.*.*.* - Army National Guard Bureau 64.224.*.* 64.225.*.* 64.226.*.* 209.35.*.* 216.247.*.* 216.25.*.* VERY DANGEROUS 217.6.*.* 155.7.0.0 American Forces Information (NET-AFISHQ-NET1) 155.8.0.0 U.S. ArmyFort Gordon (NET-GORDON-NET5) 155.9.0.0 United States Army Information Systems Command (NET-LWOOD-NET2) 155.74.0.0 PEO STAMIS (NET-CEAP2) 155.75.0.0 US Army Corps of Engineers (NET-CEAP3) 155.76.0.0 PEO STAMIS (NET-CEAP4) 155.77.0.0 PEO STAMIS (NET-CEAP5) 155.78.0.0 PEO STAMIS (NET-CEAP6) 155.79.0.0 US Army Corps of Engineers (NET-CEAP7) 155.80.0.0 PEO STAMIS (NET-CEAP 155.81.0.0 PEO STAMIS (NET-CEAP9) 155.82.0.0 PEO STAMIS (NET-CEAP10) 155.83.0.0 US Army Corps of Enginers (NET-CEAP11) 155.84.0.0 PEO STAMIS (NET-CEAP12) 155.85.0.0 PEO STAMIS (NET-CEAP13) 155.86.0.0 US Army Corps of Engineers (NET-CEAP14) 155.87.0.0 PEO STAMIS (NET-CEAP15) 155.88.0.0 PEO STAMIS (NET-CEAP16) 155.178.0.0 Federal Aviation Administration (NET-FAA) 155.213.0.0 USAISC Fort Benning (NET-FTBENNNET3 155.214.0.0 Director of Information Management (NET-CARSON-TCACC ) 155.215.0.0 USAISC-FT DRUM (NET-DRUM-TCACCIS) 155.216.0.0 TCACCIS Project Management Office (NET-FTDIX-TCACCI) 155.217.0.0 Directorate of Information Management (NET- EUSTIS-EMH1) 155.218.0.0 USAISC (NET-WVA-EMH2) 155.219.0.0 DOIM/USAISC Fort Sill (NET-SILL-TCACCIS) 155.220.0.0 USAISC-DOIM (NET-FTKNOX-NET4) 155.221.0.0 USAISC-Ft Ord (NET-FTORD-NET2) 128.47.*.* Army Communications Electronics Command (NET-TACTNET) 128.50.*.* Department of Defense (NET-COINS) 128.51.*.* Department of Defense (NET-COINSTNET) 128.56.*.* U.S. Naval Academy (NET-USNA-NET) 128.63.*.* Army Ballistics Research Laboratory (NET-BRL-SUBNET) 128.80.*.* Army Communications Electronics Command (CECOM) (NET-CECOMNET) 128.98.*.* - 128.98.255.255 Defence Evaluation and Research Agency (NET-DERA-UK) 128.154.0.0 NASA Wallops Flight Facility (NET-WFF-NET) 128.155.0.0 NASA Langley Research Center (NET-LARC-NET) 128.156.0.0 NASA Lewis Network Control Center (NET- LERC) 128.157.0.0 NASA Johnson Space Center (NET-JSC-NET) 128.158.0.0 NASA Ames Research Center (NET-MSFC-NET) 128.159.0.0 NASA Ames Research Center (NET-KSC-NET) 128.160.0.0 Naval Research Laboratory (NET- SSCNET) 128.161.0.0 NASA Ames Research Center (NET-NSN-NET) 128.183.0.0 NASA Goddard Space Flight Center (NET-GSFC) 128.216.0.0 MacDill Air Force Base (NET-CC-PRNET) 128.217.0.0 NASA Kennedy Space Center (NET-NASA-KSC-OIS) 128.236.0.0 U.S. Air Force Academy (NET-USAFA-NET) 30.*.*.* - Defense Information Systems Agency 49.*.*.* - Joint Tactical Command 50.*.*.* - Joint Tactical Command 55.*.*.* - Army National Guard Bureau 64.224.*.* 64.225.*.* 64.226.*.* 209.35.*.* 216.247.*.* 216.25.*.* 217.6.*.* 155.7.0.0 American Forces Information (NET-AFISHQ-NET1) 155.8.0.0 U.S. ArmyFort Gordon (NET-GORDON-NET5) 155.9.0.0 United States Army Information Systems Command (NET-LWOOD-NET2) 155.74.0.0 PEO STAMIS (NET-CEAP2) 155.75.0.0 US Army Corps of Engineers (NET-CEAP3) 155.76.0.0 PEO STAMIS (NET-CEAP4) 155.77.0.0 PEO STAMIS (NET-CEAP5) 155.78.0.0 PEO STAMIS (NET-CEAP6) 155.79.0.0 US Army Corps of Engineers (NET-CEAP7) 155.80.0.0 PEO STAMIS (NET-CEAP 155.81.0.0 PEO STAMIS (NET-CEAP9) 155.82.0.0 PEO STAMIS (NET-CEAP10) 155.83.0.0 US Army Corps of Enginers (NET-CEAP11) 155.84.0.0 PEO STAMIS (NET-CEAP12) 155.85.0.0 PEO STAMIS (NET-CEAP13) 155.86.0.0 US Army Corps of Engineers (NET-CEAP14) 155.87.0.0 PEO STAMIS (NET-CEAP15) 155.88.0.0 PEO STAMIS (NET-CEAP16) 155.178.0.0 Federal Aviation Administration (NET-FAA) 155.213.0.0 USAISC Fort Benning (NET-FTBENNNET3 155.214.0.0 Director of Information Management (NET-CARSON-TCACC ) 155.215.0.0 USAISC-FT DRUM (NET-DRUM-TCACCIS) 155.216.0.0 TCACCIS Project Management Office (NET-FTDIX-TCACCI) 155.217.0.0 Directorate of Information Management (NET- EUSTIS-EMH1) 155.218.0.0 USAISC (NET-WVA-EMH2) 155.219.0.0 DOIM/USAISC Fort Sill (NET-SILL-TCACCIS) 155.220.0.0 USAISC-DOIM (NET-FTKNOX-NET4) 155.221.0.0 USAISC-Ft Ord (NET-FTORD-NET2) 128.47.0.0 Army Communications Electronics Command (NET-TACTNET) 128.50.0.0 Department of Defense (NET-COINS) 128.51.0.0 Department of Defense (NET-COINSTNET) 128.56.0.0 U.S. Naval Academy (NET-USNA-NET) 128.63.0.0 Army Ballistics Research Laboratory (NET-BRL-SUBNET) 128.80.0.0 Army Communications Electronics Command (CECOM) (NET-CECOMNET) 128.98.0.0 - 128.98.255.255 Defence Evaluation and Research Agency (NET-DERA-UK) 128.154.0.0 NASA Wallops Flight Facility (NET-WFF-NET) 128.155.0.0 NASA Langley Research Center (NET-LARC-NET) 128.156.0.0 NASA Lewis Network Control Center (NET- LERC) 128.157.0.0 NASA Johnson Space Center (NET-JSC-NET) 128.158.0.0 NASA Ames Research Center (NET-MSFC-NET) 128.159.0.0 NASA Ames Research Center (NET-KSC-NET) 128.160.0.0 Naval Research Laboratory (NET- SSCNET) 128.161.0.0 NASA Ames Research Center (NET-NSN-NET) 128.183.0.0 NASA Goddard Space Flight Center (NET-GSFC) 128.216.0.0 MacDill Air Force Base (NET-CC-PRNET) 128.217.0.0 NASA Kennedy Space Center (NET-NASA-KSC-OIS) 128.236.0.0 U.S. Air Force Academy (NET-USAFA-NET) Don't scan these ranges..... 207.60.x.x and 207.61.x.x - FBI Linux servers used to trap scanners 64.224.* 64.225.* 64.226.* 195.10.* 205.96.* - 205.103.* 207.30.* - 207.120.* 207.60.* - 207.61.* 209.35.* 216.25.* <-- VERY DANGEROUS 216.247.* <-- VERY DANGEROUS 62.0.0.1 - 62.30.255.255 Avoid These Ranges: 64.224.* 64.225.* 64.226.* 195.10.* 205.96.* - 205.103.* 207.30.* - 207.120.* 207.60.* - 207.61.* 209.35.* 216.25.* 216.247.* 62.0.0.1 - 62.30.255.255 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.159.33.56 212.159.40.211 212.159.41.173 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.56.107.22 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.159.33.56 212.159.40.211 212.159.41.173 212.159.0.2 212.159.1.1 212.159.1.4 212.159.1.5 212.56.107.22 DANGEROUS IP RANGES 6.*.*.* - Army Information Systems Center 21.*.*.* - US Defense Information Systems Agency 22.*.*.* - Defense Information Systems Agency 26.*.*.* - Defense Information Systems Agency 29.*.*.* - Defense Information Systems Agency 30.*.*.* - Defense Information Systems Agency 49.*.*.* - Joint Tactical Command 50.*.*.* - Joint Tactical Command 53.*.*.* DaimlerChrysler AG 55.*.*.* - Army National Guard Bureau 62.0.0.1 - 62.30.255.255 64.224.*.* 64.225.*.* 64.226.*.* 128.47.0.0 Army Communications Electronics Command (NET-TACTNET) 128.50.0.0 Department of Defense (NET-COINS) 128.51.0.0 Department of Defense (NET-COINSTNET) 128.56.0.0 U.S. Naval Academy (NET-USNA-NET) 128.63.0.0 Army Ballistics Research Laboratory (NET-BRL-SUBNET) 128.80.0.0 Army Communications Electronics Command (CECOM) (NET-CECOMNET) 128.98.0.0 - 128.98.255.255 Defence Evaluation and Research Agency (NET-DERA-UK) 128.154.0.0 NASA Wallops Flight Facility (NET-WFF-NET) 128.155.0.0 NASA Langley Research Center (NET-LARC-NET) 128.156.0.0 NASA Lewis Network Control Center (NET- LERC) 128.157.0.0 NASA Johnson Space Center (NET-JSC-NET) 128.158.0.0 NASA Ames Research Center (NET-MSFC-NET) 128.159.0.0 NASA Ames Research Center (NET-KSC-NET) 128.160.0.0 Naval Research Laboratory (NET- SSCNET) 128.161.0.0 NASA Ames Research Center (NET-NSN-NET) 128.183.0.0 NASA Goddard Space Flight Center (NET-GSFC) 128.216.0.0 MacDill Air Force Base (NET-CC-PRNET) 128.217.0.0 NASA Kennedy Space Center (NET-NASA-KSC-OIS) 128.236.0.0 U.S. Air Force Academy (NET-USAFA-NET) 155.7.0.0 American Forces Information (NET-AFISHQ-NET1) 155.8.0.0 U.S. ArmyFort Gordon (NET-GORDON-NET5) 155.9.0.0 United States Army Information Systems Command (NET-LWOOD-NET2) 155.74.0.0 PEO STAMIS (NET-CEAP2) 155.75.0.0 US Army Corps of Engineers (NET-CEAP3) 155.76.0.0 PEO STAMIS (NET-CEAP4) 155.77.0.0 PEO STAMIS (NET-CEAP5) 155.78.0.0 PEO STAMIS (NET-CEAP6) 155.79.0.0 US Army Corps of Engineers (NET-CEAP7) 155.80.0.0 PEO STAMIS (NET-CEAP 155.81.0.0 PEO STAMIS (NET-CEAP9) 155.82.0.0 PEO STAMIS (NET-CEAP10) 155.83.0.0 US Army Corps of Enginers (NET-CEAP11) 155.84.0.0 PEO STAMIS (NET-CEAP12) 155.85.0.0 PEO STAMIS (NET-CEAP13) 155.86.0.0 US Army Corps of Engineers (NET-CEAP14) 155.87.0.0 PEO STAMIS (NET-CEAP15) 155.88.0.0 PEO STAMIS (NET-CEAP16) 155.178.0.0 Federal Aviation Administration (NET-FAA) 155.213.0.0 USAISC Fort Benning (NET-FTBENNNET3 155.214.0.0 Director of Information Management (NET-CARSON-TCACC ) 155.215.0.0 USAISC-FT DRUM (NET-DRUM-TCACCIS) 155.216.0.0 TCACCIS Project Management Office (NET-FTDIX-TCACCI) 155.217.0.0 Directorate of Information Management (NET- EUSTIS-EMH1) 155.218.0.0 USAISC (NET-WVA-EMH2) 155.219.0.0 DOIM/USAISC Fort Sill (NET-SILL-TCACCIS) 155.220.0.0 USAISC-DOIM (NET-FTKNOX-NET4) 155.221.0.0 USAISC-Ft Ord (NET-FTORD-NET2) 195.10.* 205.96.* - 205.103.* 207.30.* - 207.120.* 207.60.* - 207.61.* - FBI Linux server used to trap scanners 209.35.* 216.25.* <-- VERY DANGEROUS 216.247.* <-- VERY DANGEROUS 217.6.*.*

2 1

LAPD captain busted for selling bootleg DVDs
by Major Variola (ret.) 11 Dec '03

11 Dec '03

December 10, 2003 Just days after Los Angeles Police Chief William J. Bratton pledged a crackdown on motion picture piracy, department investigators on Tuesday helped arrest an LAPD captain suspected of selling bootleg DVDs. Julie D. Nelson, a decorated patrol captain and a 28-year veteran of the Los Angeles Police Department, was arrested at the Hollywood station following a sting operation in which she allegedly sold counterfeit film titles such as "The Cat in the Hat" to undercover officers. http://www.latimes.com/news/local/orange/la-me-dvd10dec10,1,6566326.story?c…

1 0

Cryptophone delivers source
by Eugen Leitl 11 Dec '03

11 Dec '03

http://www.cryptophone.de/html/downloads_en.html -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

2 1

Re: Has this photo been de-stegoed? (and Clouds)
by Tyler Durden 11 Dec '03

11 Dec '03

Variola wrote... "How do you know the signature of the unaltered carrier-medium? E.g., have you measured the LSBit noise from my camera recently? Under which lighting conditions?" Well, having done some optical signal processing (and getting a patent in that area, come to think of it), I imagined that most photos will naturally have some image noise in certain frequency bands...this noise would not have to have anything to do with your camera or whatever, but is probably a function of what's in the image. For instance, a picture of a naked girl standing in front of drywall probably has very little useful image energy in spatial frequencies represented down at the length of a pixel. In a spatial fft there's probably a lot of low frequency white noise for a while, until you get to the level of the shorter body hairs and whatnot. And then there may be spatial freuency bands between that and her height that are nearly unoccupied with image energy. >From a spatial/fft perspective I imagined that this is where stego'd information goes. I also imagined that if it were done in a very simple way, the stegoed info will be fairly obvious to someone knowledgeable and looking at the spatial fft of the image. I imagine that it will look obvious because, to an expert, it won't look like the authentic kind of noise expected there. If the information is encrypted, I consider it possible that the noise may even look too "perfect" perhaps. If that's true, then I suspect it's often possible to determine that a photo's stego has been removed. Or at least, there will be cases where stego removal will be "obvious". Come to think of it, I bet TLA operatives are given precise instructions about what kinds of photos make for undiscernable stego (I'd bet where the spatial image information is not well-concentrated into "bands"). In other words, a photo with all different-sized objects in it. Perhaps they even travel with some photos for just this purpose. Hum. I wonder if photos of "clouds" work well for this purpose. That would actually explain something I encountered recently.... -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)lne.com" <cypherpunks(a)lne.com> >Subject: Re: Has this photo been de-stegoed? (and Anonymity) >Date: Thu, 11 Dec 2003 10:26:16 -0800 > >At 06:22 PM 12/10/03 +0200, Anatoly Vorobey wrote: > >On Tue, Dec 09, 2003 at 04:20:20PM -0600, Declan McCullagh wrote: > >> We have anonymity in Web browsing (more or less, thanks to Lance & > >> co). It's not NSA-proof, but it's probably subpoena-proof. > >> > >> We have anonymity in email thanks to remailers (to the extent they're > > >> still around). > >> >... > > > >alt.anonymous.messages has a healthy amount of traffic. > >One could count some fraction of all the *.binaries.* on usenet >as anonymous communications (via stego), but then you'd have to know >how many are stego'd, and that is the game after all. > > >At 02:24 PM 12/8/03 -0500, Tyler Durden wrote: > >Is it possible to determine that the photo 'originally' (ie, when it >was > >sent to me) contained stegoed information, but that it was intercepted >in > >transit and the real message overwritten with noise or whatever? > >Yes. Trivially, If your correspondent told you, but that's out of >band. Otherwise, >If there *remains* info which was not washed out "in transit", then that > >would be an inband way. Maybe all the pictures with a red flower >in them are carriers, and this content isn't washed out. Maybe its a >more subtle crypto-watermark, independent of the stego'd message. > > >Now I know pretty much nothing about this subject, but I would suppose >that > >de-stegoing a photo must like some kind of spatial spectral fingerprint >that > >should be visible after the photo is FFT'd (is there freeware software >out > >there?). > >1. How do you know the signature of the unaltered carrier-medium? >E.g., have you measured the LSBit noise from my camera recently? >Under which lighting conditions? > >2. Don't you think I can measure the properties of my carrier and shape >the stego'd info to match? (This does get into an arms race over what >properties to measure.) > > >Now I IMAGINE that a sophisticated interceptor could substitute >'believable' > >de-stego-ing noise so that it would look like the photo never had any >stego > >in the first place. OR...is this actually 'impossible' to do perfectly? > >You don't just put your message in the LSBits or whatever. You >compress, >encrypt, and possibly redundantly code them. Then you shape the noise >to match the bits you're replacing. > > > >And then, what if the interceptor tried to put an alternate message in >there > >instead? Is there a way to tell that there was originallya different >message > >there? > >Depends on the coding. > > >My assumption first of all is that nothing was done to prepare the >photo > >against these possibilities. > >Just make sure you did the original analog recording and destroy the >original after you stego it. Best also if you never post unstego'd >messages >so the Adversary can't measure your raw carrier. > >A simple stego message was placed without real > >thought about whether it might be intercepted and altered. > >You shouldn't stego life-critical messages without proper training in >the use of your tools. >(That training may vary with personality, see _Silk and Cyanide_. Some >like "why", >some like "do this".) > >----- >"You can have democracy when you vote for the people we approve of" >King George to the Colony of Iraq _________________________________________________________________ Cell phone switch rules are taking effect find out more here. http://special.msn.com/msnbc/consumeradvocate.armx

1 0

RE: Zombie Patriots and other musings [was: Re: (No Subject)]
by Trei, Peter 11 Dec '03

11 Dec '03

From: Nostradumbass(a)SAFe-mail.net wrote: > Nothing less than a guerilla war seems necessary to restore > something akin to the original constitutional balance in the > U.S. But where to recruit these people? My suggestion: the > terminally ill. > Many TI come to the table with a 'gift', the certainty of > impending death and for some the possibility of fearlessness > for physical harm or imprisonment. Mr. Dumbass appears to be channeling the Earth Liberation Front: Quotes from: http://www.stopecoviolence.com/words.htm ------------ "If I knew I had a fatal disease, I would definitely do something like strap dynamite on myself and take out Grand Canyon Dam. Or maybe the Maxxam Building in Los Angeles after it's closed up for the night." - Darryl Chernery, Northern California Earth Firster, CBS News Sixty Minutes, March 4, 1990 "Are you terminally ill with a wasting disease? .Don't go out with a whimper; go out with a bang! Undertake an ecokamikaze mission." - Excerpt from an article that ran in the Sept. 1989 issue of the Earth First Journal, urging terminally ill activists to go on "eco-kamikaze" suicide missions ---------------- Google on "eco-kamikaze" for more. It's worth noting that despite over a decade of this rhetoric, not a single terminally ill American has done this, so far as I am aware. The *only* even vaguely simlar cases I'm aware of are in India and Sri Lanka, where young Hindu widows (who, in traditional Hindu society have very dim prospects for a happy life) are recruited as suicide bombers by the Tamil Tigers. I think Rajiv Ghandi's assassin was such a woman. Peter Trei

1 0

Re: Has this photo been de-stegoed? (and Anonymity)
by Major Variola (ret) 11 Dec '03

11 Dec '03

At 06:22 PM 12/10/03 +0200, Anatoly Vorobey wrote: >On Tue, Dec 09, 2003 at 04:20:20PM -0600, Declan McCullagh wrote: >> We have anonymity in Web browsing (more or less, thanks to Lance & >> co). It's not NSA-proof, but it's probably subpoena-proof. >> >> We have anonymity in email thanks to remailers (to the extent they're >> still around). >> ... > >alt.anonymous.messages has a healthy amount of traffic. One could count some fraction of all the *.binaries.* on usenet as anonymous communications (via stego), but then you'd have to know how many are stego'd, and that is the game after all. At 02:24 PM 12/8/03 -0500, Tyler Durden wrote: >Is it possible to determine that the photo 'originally' (ie, when it was >sent to me) contained stegoed information, but that it was intercepted in >transit and the real message overwritten with noise or whatever? Yes. Trivially, If your correspondent told you, but that's out of band. Otherwise, If there *remains* info which was not washed out "in transit", then that would be an inband way. Maybe all the pictures with a red flower in them are carriers, and this content isn't washed out. Maybe its a more subtle crypto-watermark, independent of the stego'd message. >Now I know pretty much nothing about this subject, but I would suppose that >de-stegoing a photo must like some kind of spatial spectral fingerprint that >should be visible after the photo is FFT'd (is there freeware software out >there?). 1. How do you know the signature of the unaltered carrier-medium? E.g., have you measured the LSBit noise from my camera recently? Under which lighting conditions? 2. Don't you think I can measure the properties of my carrier and shape the stego'd info to match? (This does get into an arms race over what properties to measure.) >Now I IMAGINE that a sophisticated interceptor could substitute 'believable' >de-stego-ing noise so that it would look like the photo never had any stego >in the first place. OR...is this actually 'impossible' to do perfectly? You don't just put your message in the LSBits or whatever. You compress, encrypt, and possibly redundantly code them. Then you shape the noise to match the bits you're replacing. >And then, what if the interceptor tried to put an alternate message in there >instead? Is there a way to tell that there was originallya different message >there? Depends on the coding. >My assumption first of all is that nothing was done to prepare the photo >against these possibilities. Just make sure you did the original analog recording and destroy the original after you stego it. Best also if you never post unstego'd messages so the Adversary can't measure your raw carrier. A simple stego message was placed without real >thought about whether it might be intercepted and altered. You shouldn't stego life-critical messages without proper training in the use of your tools. (That training may vary with personality, see _Silk and Cyanide_. Some like "why", some like "do this".) ----- "You can have democracy when you vote for the people we approve of" King George to the Colony of Iraq

1 0

Re: Zombie Patriots and other musings [was: Re: (No Subject)]
by Major Variola (ret) 11 Dec '03

11 Dec '03

At 03:04 AM 12/11/03 -0500, Nostradumbass(a)SAFe-mail.net wrote: >Nothing less than a guerilla war seems necessary to restore something akin to the original constitutional balance in the U.S. But where to recruit these people? My suggestion: the terminally ill. > >Many TI come to the table with a 'gift', the certainty of impending death and for some the possibility of fearlessness for physical harm or imprisonment. Of course your idea has merit, both on a personal and govt payback level. But you can get more, and fitter soldiers: Simply convince some healthy folks that an "afterlife" exists. And that by doing worthy acts you do well there. Religion is a terrorist weapon after all. ---- What would a palestinian bastard on a stick do?

1 0