December 2003 - cypherpunks-legacy

"Architectural considerations for cryptanalytic hardware" paper on the web
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For anyone who was interested in Dave's and my hardware project (Architectural considerations for cryptanalytic hardware), it's done (thank goodness). You're free to check it out at http://www.cs.berkeley.edu/~iang/isaac/hardware/ in either HTML or PostScript. Thanks to cypherpunks Eric Hughes and Bruce Koball, and to Altera people Clive McCarthy and Stephen Smith. - Ian "...pray for an 'A' for us..." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZE64UZRiTErSPb1AQHczwP+IF47Zg4VpecVFj+ei0AAr2h9ZVTV01nb lsUXAwWpKla2LJ+sJGrSQmpu0Sd/wkIIGeTWnbCLiR+d4pdbKN2nwfHp6evjzEnw luWWeuCFq51L0AViBGyu2r11IiAPGGIXWclb8dqqjL1YLtnJ/CCXXRbSGbJ7YdqO 6GBAMv13IgA= =5IGV -----END PGP SIGNATURE-----

1 0

[off-topic] *.alias.net disappeared?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm sorry for posting this to the list, but I've no other apparent way of getting in touch with these parties. The alias.alias.net and nym.alias.net servers have disappeared; in fact, nothing in *.alias.net is still in any DNS that I can find. Have these sites disappeared, or am I just in a very bad corner of the 'net? dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== =kZSL -----END PGP SIGNATURE----- --- David Smith, Box 324, Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith des(a)juno.com Reality is only for those lacking in true imagination

1 0

DigiCash agreement with Deutsche Bank
by minow＠apple.com 17 Dec '03

17 Dec '03

According to an article in a Swedish newspaper, Svenska Dagbladet (http://www.svd.se/svd/ettan/ettan.html) DigiCash has closed an agreement with Germany's largest bank, Deutsche Bank, that will permit commerce on the Internet using digital cash. The system will be tested first internally within Deutsche Bank to check the security of the system, followed by a limited rollout this autumn, with major distribution expected early next year. A customer of the bank can "click on the DigiCash icon and confirm the amount of German Marks required. The digital money is automatically downloaded to the customer's computer and stored on disk in various amounts." To purchase something from a homepage, the customer's computer sends "digital cash" to the seller. The seller confirms via the bank within two seconds that payment was made. Translated (quickly) and summarized by Martin Minow minow(a)apple.com

1 0

Java Hole: Web Graffiti & Covert Channels
by Chad Owen Yoshikawa 17 Dec '03

17 Dec '03

-------------------------------------------------------- Web Graffiti & High Bandwidth Covert Channels Using Java -------------------------------------------------------- While developing a chat server using Java as a frontend, we've been exploiting what we think is a new Java security hole in Java-enabled browsers such as Netscape. The hole allows for opening sockets to arbitrary ports on web servers that serve Trojan-horse applets. We've also used a known security hole (covert channels) first mentioned in work by the SIP group at Princeton to create what we call 'Web Graffiti' - the dynamic insertion of text, graphics, applets, into HTML pages. Both of these attacks are three-party attacks and require Trojan- horse applets. For a draft of a paper that is work in progress, point your browser to: http://whenever.CS.Berkeley.EDU/graffiti/ Chad Yoshikawa Brent Chun chad(a)cs.berkeley.edu bnc(a)cs.berkeley.edu

1 0

re: Dempster-Shafer...(re: Transitive
by watson＠tds.com 17 Dec '03

17 Dec '03

tcmay's approach is elegant, and it's refreshing to find a practical use for AI approaches. I think it needs one more step, though. If we learn to quantify our trust in a key, we still need to know what the threshold should be for a given application. Maybe I can get by with a 0.05 Bel for posting to cypherpunks, but maybe I want a 0.95 for a monetary transaction. Seems to need a comprehensive risk management approach,

1 0

Re: Senator Leahy's Public Key
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:16 AM 5/9/96, Eric Eden wrote: >What if you needed to set up a key server for a mass base of customers... >Obviously, authenticating them via e-mail would be difficult, verifying >them in person would be harder. Would there be any reasonable way to "Verifying them in person" would, in fact, be essentially impossible. Few sources of documentation mean much, in fact. Consider that I joined Intel in 1974 and was never once asked for any form of identification...I just showed up for work under my assumed name, Tim May, and no one was the wiser. Ask yourself this: Have you _ever_ really "verified" the identity of your girlfriend, your friends, your co-workers? (I mean this not to pose an existential riddle of no real significance, but to remind people how seldom we ever actually try to verify that people are "really" who they say they are.) ... >pretend that the labor is not the deciding factor. What would be the >best way to verify the customers keys if you couldn't visit each >customer in person? Representatives from my ISP, got.net, have attended some of my parties...and they _still_ don't know that I am _actually_ Irving J. Schlublutz, temporarily masquerading as "Tim May."\ >For example, would a photo copy of a drivers license be enough? For which purposes? DLs are notoriously easy to forge. I think $25 is the going price. (And DLs which would fool people like us are probably doable on any H-P color inkjet printer.) My point in all this being that "proofs of identity" aren't all they're cracked up to be. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: [off-topic] *.alias.net disappeared?
by loki＠infonex.com 17 Dec '03

17 Dec '03

John Perry (perry(a)jpunix.com) was running the alias.net services. Because of work commitments, he was not able to continue to run alias.net -Lance At 6:53 PM 5/8/96, David E. Smith wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I'm sorry for posting this to the list, but I've >no other apparent way of getting in touch with >these parties. > >The alias.alias.net and nym.alias.net servers >have disappeared; in fact, nothing in *.alias.net >is still in any DNS that I can find. > >Have these sites disappeared, or am I just in >a very bad corner of the 'net? > >dave > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp >rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP >elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L >jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 >xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ >x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== >=kZSL >-----END PGP SIGNATURE----- >--- David Smith, Box 324, Cape Girardeau MO USA 63702 >http://www.prairienet.org/~dsmith des(a)juno.com >Reality is only for those lacking in true imagination ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: Transitive trust and MLM
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 11:32 AM 5/8/96, Raph Levien wrote: <SNIP> > One encouraging consequence of this model is that densely connected >subgraphs can result in highly trusted keys even if p itself is quite >small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For >example, if p is a mere 50%, then in a clique of size 10, each key in >the clique is trusted with a probability of 99.9%. > This computation is (I think) known as the network reachability >problem, and is probably quite hard to evaluate. In practice, you'd >probably want to compute upper and lower bounds instead, > > Let's see if we can come up with a model that preserves this property >of giving high trust values to densely connected keys, yet is also >highly resistant to (some plausible model) of attacks against the Web of >trust. > >Raph I like this. The most obvious attack on key signatures is to cross sign a huge number of bogus keys, is of no benefit. As the density of this bugus-clique increases, it comes closer and closer to acting as a single entity for trust calculations. Then your trust calculation for any key in the clique is simply your trust of the real key which signed all the bogus ones. It should be no time at all before most reputable key signers cut all links to that key. Another nice property of this calculation of probability is that it automatically drops off exponentially with the number of links (at least along any one chain). We need to think about how much we want multiplicity of paths to bolster our trust. Here is the scenario I want to avoid: Mallet creates a large number of keys: A, B, C[...]. C is a large set of keys. A is the Key Mallet uses publicly. It has a few signatures. B is the key Mallet uses to sign keys who's trust he wants to boost. In addition to signing B with A, Mallet also signes all the C[i] with A, and signs B with all the C[i]. This multiplicity of paths should not boost the trust in any key which is reached through this complex. In general it may be difficult to decipher which paths you want to follow in multiply (and cyclically) connected paths. I suppose one approach to this would be to pick various ways of calculating trust, and see if anyone can come up examples to attacks to exploit them. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Remailer in a box
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 6:55 PM 5/8/96, E. ALLEN SMITH wrote: > Questions. How much memory does the Mixmaster remailer take up? My remailer (with source code and spooled messages) is 1.4M. >What >accesses/permissions/etcetera on a machine do I need to have in order to have >it running on an account? It will run out of any account. A procmail script could be used to direct the mail to Mixmaster (or the front end scripts). If you use the account for other things, you can have the procmail script only forward the Mixmaster messages. >Has anyone set up one such that it will only remail >from & to a set of addresses (e.g., other remailers)? I, for instance, wouldn't >be willing to deal with the hassles involved with running a remailer that was >either what the end user would see (thus getting potentially deluged with help >questions) or the end mailer (thus getting potentially in problems if someone >abuses the remailer)... but I (and others) might if it was set up just for >chaining. (Yes, I know I'd need a UNIX account... I'm looking into that.) This could be done with a trivial modification to the source and destination blocking lists (just change the sense of the checking). Cyberpass (www.cyberpass.net) offers UNIX accounts without dialin access for $7 per month. These are available anonymously, and can be paid for with ecash. > Speaking of UNIX, does anyone have any existing programs to >automatically mail out at random intervals a looping or /dev/null directed >message through the remailers, in order to increase security against traffic >analysis? > Thanks, > -Allen Yes, but I only give it to remailer operators. The "bramble" might get flooded otherwise. Operators see the repercussions of their actions. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Cyberspace--Silencing the Net
by hrwatchnyc＠igc.apc.org 17 Dec '03

17 Dec '03

EFFORTS TO CENSOR THE INTERNET EXPAND U.S. a Miserable Role Model with Passage of Communications Decency Act May 10, 1996 (New York) Governments around the world, claiming they want to protect children, thwart terrorists or silence racists and hate mongers, are rushing to eradicate freedom of expression on the Internet. "The U.S. Congress and the Clinton administration, reacting to recent hysteria over cyberporn,' led the way by passing the Communications Decency Act," says Karen Sorensen, Human Rights Watch on-line research associate. "It is particularly crucial now, in the early stages of vast technological change, that all governments reaffirm their commitment to respect the rights of citizens to communicate freely, and for the United States as the birthplace of the Internet, to be a model for free speech, not censorship," she adds. Human Rights Watch is a plaintiff in the lawsuit brought by the American Civil Liberties Union challenging the CDA on constitutional grounds. The hearings in the lawsuit, which was filed in U.S. Federal District Court on February 8 (the day it was signed into law) end today in Philadelphia, Pennsylvania. The judges are expected to rule shortly thereafter. In addition, Human Rights Watch is calling on the nations participating in the G7 Ministerial Conference on the Information Society and Development to be held in South Africa from May 13-15, 1996, to repudiate the international trend toward censorship and to express unequivocal support for free expression guarantees on-line. Among the G7 countries Britain, Canada, France, Germany, Italy, Japan, and the United States only the U.S. has actually passed legislation curtailing freedom of expression on-line. The trend toward restricting on-line communication is growing, according to Silencing the Net: The Threat to Freedom of Expression On-line, which documents restrictions that have been put in place in at least twenty countries, including the following: -- China, which requires users and Internet Service Providers (ISPs) to register with authorities; -- Vietnam and Saudi Arabia, which permit only a single, government- controlled gateway for Internet service; -- United States, which has enacted new Internet-specific legislation that imposes more restrictive regulations on electronic expression than those currently applied to printed expression; -- India, which charges exorbitant rates for international access through the state-owned phone company; -- Germany, which has cut off access to particular host computers or Internet sites; -- Singapore, which has chosen to regulate the Internet as if it were a broadcast medium, and requires political and religious content providers to register with the state; and -- New Zealand, which classifies computer disks as publications and has seized and restricted them accordingly. Human Rights Watch recommends principles for international and regional bodies and nations to follow when formulating public policy and laws affecting the Internet, sets forth the international legal principles governing on-line expression, and, examines some of the current attempts around the globe to censor on-line communication. The 24-page report is available via e-mail at sorensk(a)hrw.org or from the Human Rights Gopher: URL: gopher://gopher.humanrights.org:5000/11/int/hrw/general Paper copies of Silencing the Net are available from the Publications Department, Human Rights Watch, 485 Fifth Avenue, New York, NY 10017-6104 for $3.60 (domestic), $4.50 (international). Visa/MasterCard accepted. Human Rights Watch Human Rights Watch is a nongovernmental organization established in 1978 to monitor and promote the observance of internationally recognized human rights in Africa, the Americas, Asia, the Middle East and among the signatories of the Helsinki accords. It is supported by contributions from private individuals and foundations worldwide. It accepts no government funds, directly or indirectly. The staff includes Kenneth Roth, executive director; Cynthia Brown, program director; Holly J. Burkhalter, advocacy director; Barbara Guglielmo, finance and administration director; Robert Kimzey, publications director; Jeri Laber, special advisor; Gara LaMarche, associate director; Lotte Leicht, Brussels office director; Juan Mndez, general counsel; Susan Osnos, communications director; Jemera Rone, counsel; and Joanna Weschler, United Nations representative. Robert L. Bernstein is the chair of the board and Adrian W. DeWind is vice chair. Human Rights Watch 485 Fifth Avenue New York, NY 10017-6104 TEL: 212/972-8400 FAX: 212/972-0905 E-mail: hrwnyc(a)hrw.org 1522 K Street, N.W. Washington D.C. 20005 TEL: 202/371-6592 FAX: 202/371-0124 E-mail: hrwdc(a)hrw.org

1 0

MEETING: Cypherpunks May 11th San Francisco Bay Area Meeting
by Hugh Daniel 17 Dec '03

17 Dec '03

The monthly meeting of any Cypherpunks in the San Francisco Bay area will happen this Saturday May 11th, 12:00 noon till about dinner time (say 18:00, 6pm). We are going to try meeting in back of the Tresidder Union at Stanford University in the court yard (by the elevator tower). Tresidder Union is a little (peninsula) west of the Stanford main Quad, there is a parking lot just p-west of of the Union that you can park in on weekends. The best automotive access is from the west via Junipero Serra Blvd. (also called Foothill Expressway, Santa Cruz Ave & Alameda De Las Pulgus) into the 'back' of the Stanford Campus, look it up on a map folks. For some semi-useful maps try: http://www.stanford.edu/home/visitors/maps.html There is a chance we will get a room to meet in, in that case there will be a sign/person telling you where to go. If not there is a raised area in the court yard (under the tree) that will be the gathering area. In the case of rain (and no room) we will meet in the pub in the (peninsula) south west corner of the Union. If you have things you want to talk about at this meeting, or can help in some way please email me. ||ugh Daniel hugh(a)toad.com Vague Agenda: 12:00 Meeting intro, Hugh Daniel on Crypto GUI's and toolkits to build them. Discussion on Crypto GUI design. 12:30 Review of various Crypto GUI's (lead by Hugh Daniel) Various Java applets CyberCash Wallet Various Graphic PGP Shells Skey Others? Please email examples of good or bad Crypto GUI's to demo at the meeting. I have a FreeBSD/Windross-95 laptop to demo them on (we could use a larger display then my laptop screen). 13:30 Norm Hardy on Keys(capabilities), what they are, how they can make things secure if done right, and what the functional difference might look like to an end user. 14:30 Break 15:00 Electronic Communities presentation on "E", an extension of Java to provide Keys(capabilities) in a commercial environment. 16:00 Marianne Mueller & John Gilmore report on the recent Java Security workshop. 17:00 Open for breaking issues, future meeting planing etc. 18:00 Break for dinner. At 20:00 there will be a PenSFA party ( PenSFA is the Peninsula Area Science Fiction Assn.) in San Carlos (12 miles up Alameda De Las Pulgus). Talk to me at the meeting for more info. For dinner I will suggest 'Thai City', about a 2 kilometers south of Page Mill at 4329 El Camino Real. It is on the Peninsula East side of the road, white building with a purple stripe around it and some {}`s (really). +1 415 493 0643

1 0

FW: Science Project Fair
by Husa, Carl (MSX) 17 Dec '03

17 Dec '03

>---------- >From: Beverly. Ferguson[SMTP:103014.3727@CompuServe.COM] >Sent: Wednesday, May 08, 1996 9:38 PM >To: KOMBUCHA DIGEST; PARACELSUS DIGEST >Subject: Science Project Fair > > >Originally Posted To: > >>Date: Fri, 3 May 1996 09:58:55 -0400 >>Sender: Methods of Teaching Mathematics <TEACHMAT(a)UICVM.UIC.EDU> >>From: Peggy R Shearin <pshearin(a)WARREN.CES.NCSU.EDU> >>Subject: Science Fair Project > >>>Hi, our names are Stevie and Amanda. We are in the 5th grade at >>>the Phillipston Memorial school, Phillipston, Massachusetts, USA. >>>We are doing a science project on the Internet. We want to see >>>how many responses we can get back in two weeks. (We are only >>>sending out 2 letters). > >>>Please respond and then send this letter to anyone you >>>communicate with on the Internet. > >>>Respond to smc(a)tiac.net. >>>^^^^^^^^^^^^^^^^^^^^^^^ > >>>1. Where do you live (state and country)? > > >>>2. From whom did you get this letter? > > >>>Thank you, >>>Stevie and Amanda > >------------------------------ > >

1 0

Re: Penet-style web remailer?
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 09:17 PM 5/8/96 EDT, you wrote: > http://noah.pair.com/anon.html. It appears to be >sort of a penet-style anonymous remailer, only without return messages. Anyone >know anything else about it? -----BEGIN PGP SIGNED MESSAGE----- I have tried noah.pair.com in several tests and for seemingly secure communications with good results. In addition I have carried on an e-mail conversation with him. Give him a try. Alec camcc(a)abraxis.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZHduCKJGkNBIH7lAQF8HgQArQRgSTMWL0WcAkv9Byk1ZghBYsI9AxRF mxE3nGnHu4H8dhMQXZtUOoY0LN7GkdcCYH8LBab91XwaJCYp3j5WqVt4xPP+feF5 hUTch6VUb/dPB1VYEfHjwNXPAhkOuM2Noarq3cFqbhJNK4UkC1IzNhy1rrhE2yZ+ Yyzv8ppwe4g= =d9bl -----END PGP SIGNATURE-----

1 0

Remailer fot NT
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Thu May 09 09:28:20 1996 Does anyone know of a remailer that runs undet NT. If not, any source that might be ripe for a port. Lou Z. Lou Zirko (502)383-2175 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMZIBJBKvccEAmlQ9AQGs5Af+I8BfY640aj/e483mDzbdHOioEaPrQmZ1 R8rA7H0Kg29VU4/4f+Y5J66ZshMVr4ojOYzj8/H7mrsCjsZPx7MjBqiIH1pbUouG ky0NvGLw+HeBRWZz1OSElDUYE+QMHnMr2CxYnaepS/91erJmpt0xE5/oXVohEQOq q/ARLWAYw4FJ6n7cgDDfkcxp5scHthLsAzMCbuHxfsvzAm/1LdU/QFvUWG2+BNv3 4Hx2TWasGWaSfX/+zZGuXHA123JW2frE98o+nRORcM5y7kCOaXPP69xp+aAJsGdh wf7M/ekRhBjfJgdOLtgID+zKBJbZEHA3kGgCmHdz1ynoWiXnMcTlcw== =bWV8 -----END PGP SIGNATURE-----

1 0

Looking for someone to speak on JAVA security issues (fwd)
by TQDB 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 09 May 1996 03:25:29 -0700 From: The Dark Tangent <dtangent(a)defcon.org> To: dc-stuff(a)fc.net Subject: Looking for someone to speak on JAVA security issues If you or someone you know has seen a Java security expert who would speak at DEF CON, please have them contact me! -- Hey! All my mail is sniffed! Don't forget to PGP important stuff. PGP Key (2.3a & 2.6) on key servers or mail me. Voice (AT&T) 0-700-TANGENT DEF CON mailing list, mail: majordomo(a)fc.net with "subscribe dc-announce" in the body. DEF CON FTP: ftp.fc.net /pub/defcon http://www.defcon.org

1 0

hks newsgroup
by Kent Briggs 17 Dec '03

17 Dec '03

hks.lists.cypherpunks has shown no new articles in the past three weeks. I've resubscribed to the mailing list but have seen no mention of the newsgroup's status. What happened to hks and is it ever coming back up? Kent

1 0

re: Dempster-Shafer...(re: Transitive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:18 AM 5/9/96, watson(a)tds.com wrote: >tcmay's approach is elegant, and it's refreshing to find a practical use >for AI approaches. I think it needs one more step, though. If we learn >to quantify our trust in a key, we still need to know what the threshold >should be for a given application. Maybe I can get by with a 0.05 Bel >for posting to cypherpunks, but maybe I want a 0.95 for a monetary >transaction. Seems to need a comprehensive risk management approach, [was the rest accidentally cut off?] Anyway, I agree that a more comprehensive system is needed. But even attaching belief estimates to keys, for example, goes a long way in letting others than do some transitive calculations. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Applicable Models for Trust Calculations (Re: Dempster-Shafer Theory and Belief Networks (Re: Transitive trust))
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 09:51 PM 5/7/96 -0700, Timothy C. May wrote: >In particular, one form of belief representation seems especially relevant: >Dempster-Shafer theory. Two quick things: (more in my forthcoming thesis) 1. It is very instructive to consider systems for considering trust and belief (and Dempster-Shafer is a rather nice one). However, these systems (my own decision analysis discussion to a degree, but less so with respect to information gathering) and Dempster-Shafer in particular require the events to be independent: "Further, Dempster-Shafer theory provides rules for combining probabilities and thus for propagating measures through the system. This fourth point is possibly the most attractive, but it is also one of the most controversial since the propagation method is an extension of the multiplication rule for independent events. Since many of the applications involve events that are surely dependent, that rule is, by classical statistical criteria, inapplicable. The tendency to assume that events are independent unless proven otherwise has stimulated a large proportion of the criticism of probability approaches; as it stands, Dempster-Shafer theory suffers the same ill" [Shapiro (ed.) Encyclopedia of Aritificial Intelligence. /Reasoning, Default./ p 846.] The very term "Web of Trust" makes one pause with respect to independent events. 2. Just as a comment, it seems there are different meaning of "transitiviy" in related but different disciplines, for instance in value and utility functions, one requires transitivity, but in a way different from what Hal discusses: "For any three possible set os of consequences, X1, X2, and X3, if X1 > X2 and X2 > X3 then the preference is transitive such that X1 > X3." [deNeufville, R. Applied Systems Analysis: Engineering Planning and Technology Management, 1990, p 313.] This refers to a single person's preferences (rather than 3 individuals in a "network.") _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Mandatory Voluntary Self-Ratings
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:17 AM 05/9/96 -0400, Joseph M. Reagle Jr. <reagle(a)MIT.EDU> wrote: >> I've figured out where my differences between myself and others >lay. The _only_ system and service that I am aware of that is distributing >PICS labels is RSAC. (http://www.rsac.org) They are what one could call an >objective and non-arbitrary content rating system rather than an >"appropriateness" system. "Appropriateness" systems will be valuable 3rd >party systems when the vigilantes and fundamentalists wish to create label >bureaus. For self labeling, if many people (main stream people) are going to >use that system within their browser, it will have to have mind share. If >it's going to have mind share, I think it would be advantegeous to it to be >a descriptive label rather than "appropriate." Hence, much of the concerns >I'm hearing aren't so worrisome to me. SurfWatch is offering self-rating via a web page at their site. It spits back the appropriate 'meta' tags to embed in an html document. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZFQ+MVrTvyYOzAZAQFM+gP/edsvNSSkeiyZVBuJyWYCK82J7O1zG5O8 jI5cGj22R/qSPAhhpZj6pLFxvoKnuUc7P+8QzAao1ccxihZpy5ZW3fzM/+pyn6dW B126/l4R+SRCrDiPV+5HeXyBTXAiWYMjRAuv2nZtHVIiLjQrjziwrug4H/4U26GP NEbKT8Uqwno= =UAbu -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

www.cdnow.com accepts ecash
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cool. Get your fresh CD's via WWW and UPS. Pay with Mark Twain ecash. This is the first thing (excepting, of course, BAP, cyberbuck gambling, and pornography) that I actually want to buy with ecash. And I spend time crawling www.cdnow.com even when I don't want to spend money, just to read the words and look at the pictures. http://www.cdnow.com/ This has been a public service announcement. CDNow is not paying me. (Although, of course, they are welcome to send me some free CD's in return for my kind words...) Bryce Disclaimer: NO. I'm not speaking for anyone else. Not even the company mentioned in the From: line. PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMZIn9EjbHy8sKZitAQELPAL9G6lYkqhbTdYrt0YFe4VjF9jyyjxznCi2 SY3f86o2XvD86AMUQkVT31GhQAmGC6TN2cJ0pQDRpHfh5Qk+IZFgd3iyEEZqzrmc UztgRNEhaIFgYXjV33gzRE5sk+fnpQaL =H96X -----END PGP SIGNATURE-----

1 0

Compu$erve, Netscape offering Lotus Notes competitor
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

There is no mention in either of these articles about what encryption protection will be used; it does appear that Netscape Navigator software will be used, which does have some protections (very little for the out-of-US stuff, of course). Jeff? -Allen >Copyright 1996 Nando.net >Copyright 1996 Bloomberg >COLUMBUS, Ohio (May 9, 1996 12:41 p.m. EDT) -- CompuServe Corp. this fall >will offer corporate customers Netscape Communications Corp. software used >to share documents over computer networks. >The move presents another challenge to International Business Machines >Corp.'s Lotus Notes software, whose popularity has declined as companies opt >for cheaper Internet software capable of many of the features Notes offers. >Using Netscape's software, company employees and partners in distant offices >can exchange and work on documents at the same time. Netscape also is >developing audio and video technology that will let employees talk to each >other. [...] >Columbus, Ohio-based CompuServe already offers Lotus Notes and decided to >strike an agreement with Netscape because customers were asking for a >similar, cheaper product. [...] >CompuServe will offer Netscape's server software, used to relay information, >and Internet browsing software. Terms of the marketing and development >agreement weren't disclosed. >Netscape's software is based on technology it acquired with the purchase >last year of Collabra Software Inc. [...] >Copyright 1996 Nando.net >Copyright 1996 Reuter Information Service >COLUMBUS, Ohio (May 9, 1996 12:47 p.m. EDT) - CompuServe Corp. and Netscape >Communications Corp. said Thursday they will jointly create a managed >intranet service that will allow a company's employees to communicate over >in-house computer networks. [...] >Intranets refer to private corporate networks that are designed to make use >of Internet software tools. >Under the strategic partnership, the two firms will offer so-called >groupware, a category of software that allows employees to share >applications and electronic mail. They will manage such networks on behalf >of corporate customers. >Customers will have access to features such as electronic mail, online >discussion groups and document-sharing that allow them to share and >co-develop information in new ways. >The service is slated to be available this fall, using Netscape's Navigator >browser and server software.

2 1

Re: Mandatory Voluntary Self-Ratings
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>Date: Wed, 08 May 1996 19:34:50 -0400 >To: tcmay(a)got.net (Timothy C. May) >From: "Joseph M. Reagle Jr." <reagle(a)mit.edu> >Subject: Re: Mandatory Voluntary Self-Ratings > >At 09:58 AM 5/8/96 -0700, you wrote: >>At 9:31 PM 5/7/96, Joseph M. Reagle Jr. wrote: > >>Should "voluntary self-criticism" become widespread, I expect to rate all >>of my posts as suitable for children of all ages, suitable for >>hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. >>Regardless of whether I'm advocating post-birth abortions or forced >>encheferation of Muslim girls. > > I've figured out where my differences between myself and others lay. The _only_ system and service that I am aware of that is distributing PICS labels is RSAC. (http://www.rsac.org) They are what one could call an objective and non-arbitrary content rating system rather than an "appropriateness" system. "Appropriateness" systems will be valuable 3rd party systems when the vigilantes and fundamentalists wish to create label bureaus. For self labeling, if many people (main stream people) are going to use that system within their browser, it will have to have mind share. If it's going to have mind share, I think it would be advantegeous to it to be a descriptive label rather than "appropriate." Hence, much of the concerns I'm hearing aren't so worrisome to me. > > I'll have more on that when a case study I'm working on with some colleagues for a Sloan on ecommerce course at MIT is finished.. (in about a week, and I should then be making that and my thesis available.) > >>I say it's a waste of our time to even be thinking or worrying about how to >>implement an infrastructure for ratings. In fact, building such an >>infrastructure could make later imposition of "mandatory voluntary ratings" >>(Orwell would be unsurprised) a greater likelihood. > > Maybe, maybe not, hard to say... This or the -L18, both are easy for an ignornant legislator to approve. > _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

RE: self-ratings vs. market ratings
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Vladimir Z. Nuri > >you are free to assume any connotation you like. but in my view >they are pretty much interchangeable. they are both "meta >information"-- information about other things or information. ............................................................... The fact that I, like others, am "free to assume" any connotation means that there easily can exist confusion surrounding the definitions of these terms, and that this can then create controversy in discussions over what anyone means when they make references to them. Those who intend to apply these concepts must determine what they think they are doing (rating content, or establishing someone's reputation?) and must communicate it to others clearly so as to be definitely understood, else risk further compounding of confusion. The word & the concept of "reputation" has been in use for much longer than "rating". In the most recent applications of the term "rating", the idea has evolved to include such things as electronic web page content. It refers to a deliberate, conscious intent to establish a measure, an estimate, or evaluation, of something that an individual or group presents (information) or provides (service). The rating is intentionally applied and is intended to be used for communicating to those who are seeking this specific kind of information, where a reputation evolves "on its own", so to speak, as a coincidence of being generally known. "Reputation" is more a passive reference to the past, where "rating" is actively in regard of a present condition (with future expectations). [These are just comments I have on this subject; I myself don't pay much attention to ratings, as my own measures of things & people tend to be quite different from most, and therefore not very useful for my purposes. So that's all I have to say about it, "Vlad".] .. Blanc >

1 0

Runtime info flow in Java
by Christian Wettergren 17 Dec '03

17 Dec '03

Hi! I'm presenting my licentiate research proposal next week, and I thought that some of you might find it interesting. I'd like to find others that are working with similar projects, to have some people to discuss with. The actual proposal is available at http://www.it.kth.se/~cwe/phd/licprop.ps I've included an abstract below. Comments are most welcome. Regards, Christian Wettergren KTH/Teleinformatics. Licentiate Thesis Proposal Seminar ================================== Title: "Runtime Information Flow Analysis and Security" Candidate: Christian Wettergren Time: Wednesday, 15th May, 15:00--16:00 Place: Room Telegrafen, Dept. of Teleinformatics, KTH, Electrum Bldg., lift B, 5th floor, Kistagangen 16, 16440 Kista, Sweden Committee: Gerald Maguire, KTH/Teleinformatics Sead Muftic, SU/DSV Enn Tuygu, KTH/Teleinformatics Abstract: Today's computer security systems are fragile and brittle. I believe this statement to be consistent with practical experiences. One can for example observe the regularity of alerts from CERT. Many of the problems are caused by data-driven bugs in application programs. It is important to find a security paradigm that is more stable for the communicative and networked world of tomorrow. I propose a new way of doing information flow analysis of programs. This information flow analysis is done in runtime, and will provide detailed information about influences of the process to the access control decision process. The information flow is based on sets of subjects instead of preallocated security classes, thus decoupling the flow analysis from the access control. The runtime analysis is performed by special code that is run along with the original program. It shadows the computation and keeps track of the information flows within the program. A special compiler emits this shadow code. I will implement such a compiler for the Java language. Issues about the compiler and the shadow code will be discussed in the thesis. The thesis will also investigate the behaviour of the shadow code for programs with different communication patterns. For more information contact Christian Wettergren, +46 (0)8-751 14 91, cwe(a)it.kth.se. You can also retrieve the licentiate thesis proposal from http://www.it.kth.se/~cwe/phd/licprop.ps.

1 0

Re: Mandatory Voluntary Self-Ratings
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Couple quick things: At 11:46 AM 5/9/96 -0700, you wrote: >I don't like the use of the term "objective" here. (I object!!) No, it isn't the best term, there is some bias which can be an issue with dealing with this at the international level, but I think there are solutions to that... >a judgement like "child approved" is more subjective than "sex: moderate", >but they are both value judgements. It doesn't even say "sex: moderate", but "(s 3)", and then the parent can consult a chart that is a summary of the questions that directly ask about the content: VIOLENCE ALL (0) HARMLESS CONFLICT; SOME DAMAGE TO OBJECTS 1 CREATURES INJURED OR KILLED; DAMAGE TO OBJECTS; FIGHTING 2 HUMANS INJURED OR KILLED WITH SMALL AMOUNT OF BLOOD 3 HUMANS INJURED OR KILLED, BLOOD AND GORE 4 HUMANS INJURED OR KILLED, BLOOD AND GORE WANTON AND GRATUITOUS VIOLENCE TORTURE; RAPE So we can argue about "objective," but this is _atleast_ very "non-arbitrary" and the process (if people are non-malicious) is deterministic. >now, it seems that the author might as well put the tags in his material >himself instead of going through this submission process. This is a significant issue. >also, above we have the claim it is "fully automated". what??? it >sounded to me like the page designer has to submit a special form >to this service and then go and grab the tags to manually put in his own >page? this is "fully automated"??? Try it for your own page and see! >also, JR, you say the system does not determine "appropriateness". >but in my view it does indirectly. an author can "falsify" his submission >to say that his page has no sex or violence. (who is to say he is >wrong? the internet ratings police?) this will implicitly determine >the "appropriateness" of his page for people who screen their >browswers based on the keywords that were affected. People who misuse the system can be fined. (By using the system one also has to "AGREE"). However, the status of this contract is up at grabs IMHO since they relied on trade mark to enforce their system (the pic on a box). Now, gifs and the like (banners) may still be of issue, but the real meat here is a system (s 3 l 2 v 0), there is no IP protection for this, and if there aren't signatures, this can be a serious problem. >creator, as it should be. (in my view ratings and the content should >be made as independent from each other as possible in the sense >that ratings are not tied up in the content itself) I see it as an author provided a value added service to his content same as anyone else. _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 9-MAY-1996 00:59:47.21 >Cyberpass (www.cyberpass.net) offers UNIX accounts without dialin access >for $7 per month. These are available anonymously, and can be paid for with >ecash. After taking a look at www.cyberpass.net, I can see why you're encoraging people to use it - about like Sameer encouraging people to use c2.org. Your work on remailers does give you some reputation capital, however. The signup form isn't very clear about anonymnity, BTW - I suggest dividing it into optional and mandatory sections, and stating what will be the policy for a lack of the optional ones. What's the 17- vs 18 differentiation for? Thanks, -Allen

2 1

Re: Applicable Models for Trust Calculations (Re: Dempster-ShaferTheory and Belief Networks (Re: Transitive trust))
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"reagle(a)MIT.EDU" "Joseph M. Reagle Jr." 9-MAY-1996 18:30:11.78 >The very term "Web of Trust" makes one pause with respect to independent >events. Quite. Keys signed by an individual who turns out to be untrustworthy may very well be keys of nyms of that individual; under many circumstances, all are trustworthy or none are trustworthy. -Allen

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 9-MAY-1996 00:59:47.21 >This could be done with a trivial modification to the source and >destination blocking lists (just change the sense of the checking). In other words, just change them from blocking to allowance? How much technical knowledge does this take? I can see doing the incoming with procmail. >Cyberpass (www.cyberpass.net) offers UNIX accounts without dialin access >for $7 per month. These are available anonymously, and can be paid for with >ecash. Interesting. Having ones at other than c2.org is useful for backup purposes. >Yes, but I only give it to remailer operators. The "bramble" might get >flooded otherwise. Operators see the repercussions of their actions. Does it use how busy the remailer is to determine the approximate frequency of the messages, or does it just keep on going with whatever you tell it? Thanks, -Allen

3 2

Re: Cyberspace--Silencing the Net
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Interesting that they're a very liberal organization with the guts - unlike, say, CPSR - to condem German censorship of Neo-Nazis. Their information on that is incomplete, however; Declan and Rich may wish to contact them and give them the whole story. -Allen

2 1

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 8-MAY-1996 16:30:16.71 >Then we'll see what happens. (This is an old debate, here and on the >Cyberia-l list, to wit, what happens when people/perverts/libertarians >choose to subvert the voluntary ratings by deliberately mis-rating their >stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters >should be exposed to certain things?) I don't agree with NAMBLA, BTW, in case anyone is wondering... >I say it's a waste of our time to even be thinking or worrying about how to >implement an infrastructure for ratings. In fact, building such an >infrastructure could make later imposition of "mandatory voluntary ratings" >(Orwell would be unsurprised) a greater likelihood. Quite. There's also the misuse of it by other countries to do filtration (Chinese firewall et al). While this isn't an argument that having it is something that shouldn't be permitted, it's a consideration that those constructing some such system should keep in mind. I haven't seen any evidence that either RCIS (sp?) or SafeSurf have done so. -Allen

1 0

Publicity on PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

The following may give an example of how companies and governments want PICS to be used, instead of how it should be used (market-based ratings not for censorship). -Allen >Copyright 1996 Nando.net >Copyright 1996 Reuter Information Service >PARIS (May 9, 1996 12:41 p.m. EDT) -- A consortium of leading computer firms >launched a global rating system Thursday enabling parents to shield their >children from sexually explicit and violent material on the Internet. >The firms also hope the system will protect them from angry governments who >blame the largely unpoliced international computer network for bringing >pornographic material across their electronic borders. >"We do believe it will provide legal protection in a situation where adult >material is being distributed to minors," said Andrew Gray, European general >manager of CompuServe. "It will very much strengthen our position in these >kind of situations." >The system, an industry standard known as PICS -- for Platform for Internet >Content Selection -- has been in the works for nearly a year, and will take >several more months to become a useful tool for parents and educators, its >primary targets. >Under the system, 39 internet-related firms including giants America Online, >CompuServe, Microsoft, Prodigy and Netscape Communications will soon give >their customers software enabling them to block access to material they >judge objectionable on the Internet's Worldwide Web. >The software will enable parents and teachers to filter out pages according >to their own choice of level of violence, sex, nudity and language. >At the same time, providers will be urged to rate their pages by filling out >an electronic questionnaire resulting in a "grade" for each site, on a scale >ranging from zero, the most innocuous, to four for each category. What was I saying about pressure to rate? >The system depends for its ratings on voluntary compliance by Internet >providers. However parents will also have the option of simply blocking out >all unrated pages, simply by checking an electronic box on their computer >screens. This is, of course, assuming that "Internet content providers" won't simply rate their pages as suitable for all ages. [...] >But there is no way to use the system to seek out pornography or violence on >the web, officials insisted. Yeah, right. >"To content-providers, I would say, 'Rate your sites' To parents I would >say, 'Set the levels for your children.' And to governments, I would say >humbly, 'Think again before censoring the net,"' Stephen Balkam, executive >director of the Recreational Software Advisory Council, told a news >conference. Note again the pressure for self-rating. >"CompuServe supports selection and not censorship, empowerment and not >restriction," Gray said, announcing that his firm would begin distributing >the necessary software to customers in July. >Netscape, whose Netscape Navigator Internet-browsing software is the most >widely used in the world, will begin offering a new version incorporating >the ratings capability by the end of the year, Technology Director Martin >Haeberli said. >"Parents and educators must have some way, some tool, to enable them to >moderate what is available," Haeberli said. Only if you approve of parental censorship. >Internet firms around the globe have been under the gun from governments to >better police their offerings that offend local sensibilities, which vary >considerably from country to country. >A strength of PICS is that "it allows as many countries as would like to set >up a rating system," said Jim Miller, a research scientist who helped >develop the system. Adhering to the system would still be up to individual >households, however. Whatever became of market-ratings? Admittedly, they may mean that each country will be encouraged to given an example system... but I still don't like the idea of government involvement. [...]

2 1

Re: FW: Science Project Fair
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

Deja vu all over again. This was forwarded to me by someone within my company a while back. I may be cynical, but the chances of this being a hoax are just too high - it is simply too easy to send out a message like this to get an email address mailbombed. I recommend against replying to this. Clay At 7:20 AM 5/9/96, Husa, Carl (MSX) wrote: >>---------- >>From: Beverly. Ferguson[SMTP:103014.3727@CompuServe.COM] >>Sent: Wednesday, May 08, 1996 9:38 PM >>To: KOMBUCHA DIGEST; PARACELSUS DIGEST >>Subject: Science Project Fair >> >> >>Originally Posted To: >> >>>Date: Fri, 3 May 1996 09:58:55 -0400 >>>Sender: Methods of Teaching Mathematics <TEACHMAT(a)UICVM.UIC.EDU> >>>From: Peggy R Shearin <pshearin(a)WARREN.CES.NCSU.EDU> >>>Subject: Science Fair Project >> >>>>Hi, our names are Stevie and Amanda. We are in the 5th grade at >>>>the Phillipston Memorial school, Phillipston, Massachusetts, USA. >>>>We are doing a science project on the Internet. We want to see >>>>how many responses we can get back in two weeks. (We are only >>>>sending out 2 letters). >> >>>>Please respond and then send this letter to anyone you >>>>communicate with on the Internet. >> >>>>Respond to smc(a)tiac.net. >>>>^^^^^^^^^^^^^^^^^^^^^^^ >> >>>>1. Where do you live (state and country)? >> >> >>>>2. From whom did you get this letter? >> >> >>>>Thank you, >>>>Stevie and Amanda >> >>------------------------------ >> >>

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 8-MAY-1996 04:33:21.44 >The fact that you're sending postcards is only a problem if you don't want >them to be read. It's more the email I receive that I worry about, so all >my friends use the address rich(a)alpha.c2.org now. How would this help? Whoever's wanting to monitor you will just monitor rich(a)alpha.c2.org's incoming mail. -Allen

2 1

Re: Mandatory Voluntary Self-Ratings
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 06:46 PM 5/9/96 EDT, you wrote: > While that they aren't going for "this isn't appropriate" is to their >credit, they do have a lot of problems with the nonsensical nature of some >of their ratings; take a look at the definitions, for instance. (It's also >obvious that they simply copied them from their ratings of video games. A lot >of their HTML references for the definitions are messed up, incidentally.) I would agree the questions seem too video game orientated, and I don't like some of the questions either. However, it is a fair effort, and I don't think if something is questionable (for instance, someone errs by labeling someone that is 18 years old as a teenager) the whole system falls to pieces. Or some crucial piece of information on my home page, that some child might have seen, but won't be seen because I labeled a character in one of my stories as a teenager even if he/she was a teenager. I'm sure this is something that could go on for a very long time in some cypherpunk thread (something I'm not interested in argueing about), but there is no such thing as a perfectly objective or unbiased system. For instance, I don't like the distinctions other systems make for homosexuality, but I also understand some parents may wish to screen on it... _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"raph(a)cs.berkeley.edu" "Raph Levien" 8-MAY-1996 23:28:14.30 > Now we can actually evaluate the probability of a given key being >good. Consider a Monte Carlo process in which each edge in the graph is >present with probability 1-p. For each run, we determine whether the >recipient's public key (actually the binding between public key and >recipient's e-mail address) is reachable from our trust root. The >probability over a large number of runs is (given our assumptions) the >probability of the key being good. > One encouraging consequence of this model is that densely connected >subgraphs can result in highly trusted keys even if p itself is quite >small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For >example, if p is a mere 50%, then in a clique of size 10, each key in >the clique is trusted with a probability of 99.9%. Hmm.... I've got the problem with this that the measure you're using is really good for creating an _upper bound_ for how trustworthy a given key is - not for how trustworthy it actually is. In other words, a key that has your, Lance Cottrell (sp?), Black Unicorn's, and TCMay's signatures on it is pretty reliably determined (at least to me) as being that of whom they say it is - but that isn't equivalent to how good the person is at determining other key linkages. It's an upper bound on how good the person is - if you don't trust a key as not having been compromised (due to a lack of key signatures), you aren't going to rate it highly as an introducer. The interesting question is what relation to this upper bound (and to other characteristics of the web, such as the degree of mutual signatures in a chain) the actual introducer trustworthiness has. -Allen

1 0

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"reagle(a)MIT.EDU" "Joseph M. Reagle Jr." 9-MAY-1996 15:07:09.24 > I've figured out where my differences between myself and others >lay. The _only_ system and service that I am aware of that is distributing >PICS labels is RSAC. (http://www.rsac.org) They are what one could call an >objective and non-arbitrary content rating system rather than an >"appropriateness" system. "Appropriateness" systems will be valuable 3rd >party systems when the vigilantes and fundamentalists wish to create label >bureaus. For self labeling, if many people (main stream people) are going to >use that system within their browser, it will have to have mind share. If >it's going to have mind share, I think it would be advantegeous to it to be >a descriptive label rather than "appropriate." Hence, much of the concerns >I'm hearing aren't so worrisome to me. While that they aren't going for "this isn't appropriate" is to their credit, they do have a lot of problems with the nonsensical nature of some of their ratings; take a look at the definitions, for instance. (It's also obvious that they simply copied them from their ratings of video games. A lot of their HTML references for the definitions are messed up, incidentally.) A. In regards to aggressive violence, they appear to rate self-defense as aggressive violence. B. They do _not_ rate depictions of violent games such as football and rugby as aggressive violence. C. They define any sex between someone under 18 and someone above 18 as a "sex crime" - despite that the age for statutory rape varies considerably, and is usually _below_ 18. They're thus defining it in the same category as rape. D. They define bestiality, even if consensual, as a "sex crime." Again, they're thus defining it in the same category as rape. E. They define "Any portrayal (words, speech, pictures, etc.) which strongly denigrates, defames, or otherwise devalues on the basis of race, ethnicity, religion, nationality, gender, sexual oriention, or disability" as "hate speech." This has to be the most PC definition I've seen in a while. If I mention that someone is a Scientologist, and that their opinions are likely to be unjustified because of this, then I've committed "hate speech" under this definition. If I say that someone who is less intelligent - a disability - is of lesser value in the long run, I've committed "hate speech" under this definition. In other words, they're encouraging parents and others to block out speech that isn't PC. I will give them credit for mentioning "honkey" as an epithet; most PC types seem to cheer on non-white racists like the Nation of Islam. (There, I just committed hate speech against the Nation of Islam - I attempted to bring down their reputation.) F. They also define any "hate speech" that "advocates violence or harm" as "Extreme Hate Speech" - which gets the highest rating. Somehow, I doubt that they're going to want to rate pro-Affirmative-Action speech - advocating harm to those not in the protected groups - as "Extreme Hate Speech." In other words, while they've got some good ideas (as you point out, unlike the SafeSurf system they don't attempt to have a category for "overall appropriate range"), they've got a lot more messed-up ones. I don't think I'll be rating any of my content with them anytime soon, thank you very much. They'd misclassify it as "hate speech" or "extreme hate speech" or some such nonsense. -Allen

1 0

Re: PGP, Inc.
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"shamrock(a)netcom.com" 8-MAY-1996 11:06:21.74 >Since VeriSign is going to issue certs for nyms for free, the only >requirement being uniqueness, using their certs might not prove much of a >problem. I can see some fascinating legal questions with what, exactly, a VeriSign certificate obligates the company for. Digital signature laws should get interesting - any application of this to the Utah one? -Allen

1 0

Re: time services on the Net
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:11 AM 5/7/96 -0400, you wrote: >I'm in need of a time service available over the Internet. >Time-stamping is a plus, but the actual time (GMT, local, ...) >is more important. Does anyone have, or know of where I >can find, a list of these services? Check out http://www.clock.org/clock.org.html and http://tycho.usno.navy.mil/ for more information. There are some standard TCP/IP protocols for time. You can check the RFCs for more information on them, and look in whatever your operating system calls the "services" file. There's a simple "daytime" protocol which gives the time in hours:minutes:seconds at 1-second resolution, in ASCII or binary, over TCP or UDP. It's dumb, but it works fine if that's enough resolution for you, and there are programs to set your system clock based on it, such as rdate for Suns and wsntime for Winsock. There's a far fancier protocol called NTP, the Network Time Protocol, which is a multi-tiered time protocol with servers and clients and mutual agreement and adjustment for round-trip delay and such. Depending on the quality of your network connections, it can be accurate to very fine time resolutions. It's good form for ISPs to support NTP, both to keep their clocks synchronized and to feed time to their clients, but not all of them do that. It's also good form for ISPs to keep _all_ their machines in sync, not just most of them, as occasionally happens at (ahem) some large well-known ISPs, especially if they're going to bill for prime/nonprime time... Another motivation is so that tycho.usno.navy.mil and its friends tick and tock.usno.navy.mil only get hit by a few thousand ISPs instead of potentially millions of individuals. Ask your ISP's administrators what they do about clock sync, unless of course you _are_ the administrator, or your ISP takes three weeks to respond to tech support questions like the (ahem) large well-known ISP not named above. I currently use wsntime to sync off cesium.clock.org because my ISP has reconfigured their time service and takes weeks to respond to tech support quetions, but I was using the ISP directly for a while. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)obscura.com" "Lance Cottrell" 9-MAY-1996 18:58:23.21 On Thu, 9 May 1996, E. ALLEN SMITH wrote: >> After taking a look at www.cyberpass.net, I can see why you're >> encoraging people to use it - about like Sameer encouraging people to use >> c2.org. >Guilty No problem. Modesty is an overrated virtue. >I am not pushing the anonymous accounts until my laywer finishes the user >agreement for them. It is a bit of a tricky document (Sameer, want a copy >when it is done?). The whole site is days away from a complete redesign, >so I am not putting much effort into the current interface. Thanks for >the suggestions though. I suspect that the legal types on cypherpunks would be interested in seeing it. Quite welcome on the suggestions. >The >= 18 condition is to cover my butt. Since minors can not be parties >to contracts, I have no protection with them as clients. I am only a >provider for adults, and they take full responsibility for any children >allowed to use the connection. Fuck the CDA, but keep an eye on its claws. I see your difficulty. It is an additional one with respect to anonymous accounts. Hmm... you could put the burden on other ISPs by only having anonymous accounts via telnet access - and not accepting such from k12.edu domains. Bit of a limit, though. -Allen

3 2

Crypto Law Survey - updated
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

I have just updated my survey of cryptography regulations worldwide. I have included the developments of the past few months and added a number of links to more detailed resources and full texts. http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm Please reset old pointers to this URL. Comments, as always, will be appreciated. Bert-Jaap Koops --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law and Informatization facs +31 13 466 8102 Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

Re: Publicity on PICS
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 05:25 PM 5/9/96 EDT, you wrote: > The following may give an example of how companies and governments want >PICS to be used, instead of how it should be used (market-based ratings not >for censorship). It is _very_ confusing to follow though. >>CompuServe, Microsoft, Prodigy and Netscape Communications will soon give >>their customers software enabling them to block access to material they >>judge objectionable on the Internet's Worldwide Web. Consider that Compuserve had a deal with SurfWatch, which was incorporated in it "Internet" in a box, with a lot of Spry goodies. Now Surfwatch has been purchased by Spyglass (a competitor or Spry). Also, Compuserve offers RSACi services through CyberPatrols RSACi compliance (got some weird derivitive and cross-liscencing works going on here!) and urges its users and 3rd party people to use RSACi... _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: PGP, Inc.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:37 5/9/96, E. ALLEN SMITH wrote: >From: IN%"shamrock(a)netcom.com" 8-MAY-1996 11:06:21.74 > >>Since VeriSign is going to issue certs for nyms for free, the only >>requirement being uniqueness, using their certs might not prove much of a >>problem. > > I can see some fascinating legal questions with what, exactly, a >VeriSign certificate obligates the company for. Digital signature laws should >get interesting - any application of this to the Utah one? VeriSign is going to offer four levels of certs. The first requires only uniqueness. For the other three levels, VeriSign will require more and better assurances of the correctness of True Name stated on the cert. I don't know what form these assurances are supposed to take. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: PGP, Inc.
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"shamrock(a)netcom.com" 9-MAY-1996 23:02:01.67 >At 19:37 5/9/96, E. ALLEN SMITH wrote: >> I can see some fascinating legal questions with what, exactly, a >>VeriSign certificate obligates the company for. Digital signature laws should >>get interesting - any application of this to the Utah one? >VeriSign is going to offer four levels of certs. The first requires only >uniqueness. For the other three levels, VeriSign will require more and >better assurances of the correctness of True Name stated on the cert. I >don't know what form these assurances are supposed to take. The first level, in other words, is less of a certification than a PGP key with self-signature and signature from one other person. It doesn't have _any_ effort to verify that the email address stated on it is the actual email address of that nym. Or am I misinterpreting you? -Allen

3 2

Re: PGP, Inc.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:10 5/9/96, E. ALLEN SMITH wrote: > The first level, in other words, is less of a certification than a PGP >key with self-signature and signature from one other person. It doesn't have >_any_ effort to verify that the email address stated on it is the actual email >address of that nym. Or am I misinterpreting you? I was on a panel with a representative from VeriSign at Interop in Las Vegas. He said that uniqueness was the only requirement for the first level of cert. I don't have any information beyond that. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

True Names
by Jonathan Corbet 17 Dec '03

17 Dec '03

I was wandering around in Amazon Books, http://www.amazon.com/, when I stumbled across an interesting entry for Vernor Vinge: "True Names: And the Opening of the Cyberspace Frontier". It's due out in August. It would appear that True Names is finally being reissued? Since I've never been able to get my hands on a copy of True Names to read, I would be pleased by this. Anybody know any more? jon Jonathan Corbet National Center for Atmospheric Research, Atmospheric Technology Division corbet(a)stout.atd.ucar.edu http://www.atd.ucar.edu/rdp/jmc.html

1 0

Dear friends,
by MOHAMED HABIB MOHAMED EUSOFF 17 Dec '03

17 Dec '03

Dear friends, I am searching for NETWORK SECURITY white paper, documents and hacking uitlities. Maybe you guys/gals can shed some light on this. TQ. See You.

1 0

Re: Mandatory Voluntary Self-Ratings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 PM 5/9/96, E. ALLEN SMITH wrote: >From: IN%"tcmay(a)got.net" 8-MAY-1996 16:30:16.71 > >>Then we'll see what happens. (This is an old debate, here and on the >>Cyberia-l list, to wit, what happens when people/perverts/libertarians >>choose to subvert the voluntary ratings by deliberately mis-rating their >>stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters >>should be exposed to certain things?) > > I don't agree with NAMBLA, BTW, in case anyone is wondering. No need for people to point this out, as my point was an hypothetical, to show that there simply _is no objective standard_ in such matters. For every proposed "ratings" system that involves value judgments about who should see something, I can think of examples where a quite opposite view is held. I still think we are being led down a dangerous path in trying to architect ratings systems. As I said, we don't rate written words (at least I don't), we don't rate newspapers, etc. If a system gets built into the WWW, as with proposals for PICS, it _will_ be used by those who want to control content. We should think twice before helping in any way. (No, I'm not _against_ private ratings services...but this has little to do with _me_, and I won't participate. More importantly, I won't have my content have any kind of tag attached! Thus, the PICS thing looks intrusive to me, and not at all what I think of as a "private ratings service." I'll elaborate if my point is unclear.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)obscura.com" "Lance Cottrell" 9-MAY-1996 20:11:17.14 >I don't know about posting the agreement. My lawyer may not want to see all >his hard work in the public domain. I will ask. Thanks. Incidentally, one thing that I noticed in your listing of services was email to fax. In some circumstances (such as anonymous accounts), the other way around would be useful. Even for a non-anonymous account, there have been times when I've wished I could give someone a FAX number and have it emailed. Admittedly, there is the problem of optical character recognition et al; perhaps this could be handled via temporary web pages with a password emailed to an account on the same system? Sameer may also want to look into this. I've seen some information about such systems on the net; one in New York appears to include voicemail to email services, although I don't know how as yet. -Allen

1 0

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"reagle(a)mit.edu" "Joseph M. Reagle Jr." 9-MAY-1996 20:02:59.66 > I would agree the questions seem too video game orientated, and I >don't like some of the questions either. However, it is a fair effort, and I I will also give them credit for a fair effort. However, it's one that can stand a _lot_ of improvement... like all the rest. > I'm sure this is something that could go on for a very long time in >some cypherpunk thread (something I'm not interested in argueing about), but >there is no such thing as a perfectly objective or unbiased system. For I will be interested in seeing a response from the admin address I cc'd it to. >instance, I don't like the distinctions other systems make for >homosexuality, but I also understand some parents may wish to screen on it... I understand why parents may wish to screen on it; I still disapprove of giving them the ability to do so. Am I in favor of governmental or other coercive suppression of systems that do so? No, not at all. But I still will do my best to discourage them - such as by not rating or mis-rating pages. -Allen

1 0

Re: Nazis on the Net
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tallpaul(a)pipeline.com" 1-MAY-1996 13:19:10.69 >I stand behind my original post and the analysis in it. >I am amused at the tremendous attempts by people with certain political >affinities to bail out Weaver by a series of arguments based either on Actually, the political affinities seem rather to be on the other foot. Every organization I know of that calls Weaver a racist, as opposed to a separatist, also tries to deny exactly how wrongful the government's actions were at Ruby Ridge. The biggest example of this is the US government, but organizations such as the American Jewish Committee are also guilty of this apologia. If you don't believe me on this (Rich, for instance, had doubted that anyone was defending the actions at Ruby Ridge), I suggest reading "A Force Upon the Plain", which is by the AJC's person on hate groups. In it, he calls the actions of the USG at Ruby Ridge as, at worst, a mistake - and a more justifiable mistake in his view than Weaver's not showing up for his court hearing. In almost all cases in the chapter on Ruby Ridge, he states the government's side of the story as fact, and uses quotes - prominently labelled as from "white supremacists" - to describe the Weavers' side of the story. >profound ignorance of political realities or with their own private >dictionaries. If you believe that my definition of racism is out of my "own private dictionary," I invite you to see Webster's Second College Edition New World Dictionary of the English Language: Racism. 1. Same as racialism (sense 1). 2. Any program or practice of racial discrimination, segregation, persecution, and domination, based on racialism. Racialism. 1. A doctrine or teaching, without scientific support, that claims to find racial differences in character, intelligence, etcetera, that asserts the superiority of one race over another or others, and that seeks to maintain the supposed purity of a race or the races. 2. same as racism (sense 2). The second definition of racism is actually _more_ restrictive than my definition. I call someone practicing "racial discrimination, segregation, persecution, _and_ domination" a racist, whether or not they believe in some superiority of some race. I do appreciate the inclusion in Webster's of "without scientific support," since I am a scientist. >The whole argument of racism vs. white separatism vs. white suppremicist >seems more to come from people who argue whether someone is a Baptist or a >Christian or a Southern Baptist or a Protestant. (In mathematical set >theory one would trace the fallacy in thinking to the false idea that any >given element of a set cannot be the element of more than one set. Thus, if >(X is a member of Y) it cannot also be a member of Z.) I regard racism and racial supremacism as two sides of the same thing. Racial separatism overlaps with racism, but someone who practices one is not necessarily in favor of the other. I do not dispute that someone who is a racial separatist can also be a racist, and indeed often is. I simply am not willing to condem someone as a racist when the only organizations calling him such have clear motives to call what happened at Ruby Ridge something other than premeditated murder. >I understand that James D. is not accusing me of being a "child molester" >but merely using it as a reductio ad adsurdem argument. >Let me continue in this vein. >The issue of child molestation was dragged in and had no relevance on the >immediate political isues of Weaver et al. >But imagine people are arguing about the deep fundamental differnces >between someone who is a "child molester" vs. a "pedophile" vs. a "boy >lover." The analogy works quite well, in some ways. A pedophile who carries out his (usually his) desires is a child molester. A boy lover may be a pedophile, and may if a pedophile be a child molester. But I have known someone who had sexual attractions to underage boys but controlled them - he regarded carrying out such urges as wrong (I agree with him, if anyone is wondering). I would not call him a child molester. -Allen

1 0