December 2003 - cypherpunks-legacy

In reference to comments made to me and to the Group
by Barry C. Collin 17 Dec '03

17 Dec '03

This message was in response to comments made by E. Allen Smith on my recent remarks on cyberterrorism. Dear Mr. Smith: Thank you for your perspectives. Save for the irrelevant flaming, I appreciated your taking time. Following are my comments. >>Terrorism to CyberTerrorism > >> The face of terrorism is changing. While the motivations remain the >> same, we are now facing new and unfamiliar weapons. The intelligence >> systems, tactics, security procedures and equipment that were once >> expected to protect people, systems, and nations, are powerless >> against this new, and very devastating weapon. Moreover, the methods >> of counter-terrorism that our world's specialists have honed over the >> years are ineffectual against this enemy. Because, this enemy does not >> attack us with truckloads of explosives, nor with briefcases of Sarin >> gas, nor with dynamite strapped to the bodies of fanatics. This enemy >> attacks us with one's and zero's, at a place we are most vulnerable: >> the point at which the _physical _and _virtual _worlds converge. Let >> us first define theses two domains. > > Ever since the dawn of technological civilization, we've been vulnerable >to terrorism inflicted by those with technological knowledge and intelligence. >Ever since someone discovered how to produce poisonous gases, we've been >vulnerable to attacks such as those in the Japanese subways. Ever since the >electrification of countries, we've been vulnerable to attacks on power >production and distribution systems. Ever since most vehicles became >petroleum-powered, we've been vulnerable to attacks on petroleum production and >distribution systems. Ever since we found out how to cultivate anthrax, we've >been vulnerable to any competent bacteriologist. These are all different tools. Some are simple to create and deploy, some are not. While the definition of classical terrorism (and its motivations) remain the same, we must study each of these tools separately if we are to understand how to detect, prevent, and respond to the threats. > All the above is is Information Super-Highway hype. Thank you for your opinion. >[...] > >>Achieving CyberTerrorist Goals > >> So how does a CyberTerrorist achieve his mission? Like any terrorist, >> a CyberTerrorist actively exploits the goals of the target population >> in areas in which they take for granted. > >> There are three potential acts in CyberTerrorism at the point of >> convergence: >> * 1.Destruction; >> * 2.Alteration; and >> * 3.Acquisition and retransmission (these are a unit). > > I would point out that many instances of the last (I would guess you refer to >the getting and distribution of, say, ITAR-restricted information - you do >accuse crackers of complicity in "CyberTerrorism" by breaking military >security) are not, properly speaking, terrorism; they are instead the >distribution of information that should not be restricted. You guessed incorrectly; I'm not talking ITAR. Test yourself: Can you think of any sensitive or personal information, that if exposed or utilized, could cause terror -- or destabilization? If you can't, you are not trying; you should know more than most the value of privacy, whether it be military, corporate, or personal. >One person's >terrorist is another person's freedom fighter (I'd call both sides in >Nicaragua's Sandanista-Contra conflict terrorists). This nifty statement frequently comes from people who've never seen a child blown up, seen people disfigured, seen property damaged beyond all recognition. Perhaps it is a safe place in your office, Mr. Smith, behind your terminal judging other's thoughts. I don't have that luxury. I've spent more than anyone's fair share of time going through rubble, identifying pieces of what were once people, and telling their families. Freedom fighters who kill random and innocent victims are terrorists and cowards. If you feel otherwise, Mr. Smith, perhaps it is time to step out into harm's way, and then perhaps you too will waken in the night with the images that haunt me. *Then* you can talk to me about such matters. Until then, stick to coding. > >[...] > >>Potential CyberTerrorist Acts > >[...] > >> * A CyberTerrorist will attack the next generation of air traffic >> control systems, and collide two large civilian aircraft. This is >> a realistic scenario, since the CyberTerrorist will also crack the >> aircraft's in-cockpit sensors. Much of the same can be done to the >> rail lines. > > Only a bloody utter idiot would build such systems without enough >backups to avoid these problems; they could come about through computer bugs >or component failures as well. Networked systems are notorious for going down >(see the recent happenings with AOL, for instance); they're _going_ to have >backups if anyone intelligent is running them. Of course, you may have a point >with a government-controlled air traffic controller systems. > The same can be said of most of your other scenarios. These require more than once person be involved. Do not kid yourself, we are not dealing with stupid people here. And bloody utter idiots we have a-plenty -- too many administrators more concerned with their balance sheets to provide the tools people like you need to build safe systems. You'd be surprised of the amount of criminally-inadequate systems out there. That's why it _is_ important that folks like you push the envelope to better the systems. The goal here, Mr. Smith, is to put me out of business, not by flames, but by helping to build better systems. I think we share that goal. > >>CyberTerrorists: Who, Where, and Why? > >> The purpose of this paper is to help you understand the threats that >> exist, and hopefully, to help you prevent these types of atrocities. >> But know this - there are people out there with very different goals, >> who are our real threats, and who are, or will be, attacking us. Make >> no mistake, _the threats are real, today___.__ > > Most people with technical knowledge have a pretty large motivation to >keep the technical society going. One, the loss of it would make our knowledge >useless. Two, we have enough contact with technology and science to want it to >continue - how many neo-Luddite engineers do you know? The Unabomber is the >main exception... and even he didn't use his main area of knowledge in his >bombings. We are not concerned with engineers. We are concerned with fanatics, and fanatics are fanatics whether they are engineers or gardeners. Do not be so naive to believe that everyone shares the morals you have. Mr. Smith, there are people out there who want you dead, and will use all the techniques you pointed out above to accomplish their goal. As I said before, technology is just another tool. >> Who are the CyberTerrorists? There a great many poor movies and too >> many works of fiction about the hacker and cracker communities. In the >> popular media, there recently was the Kevin Mitnick incident, where >> one cracker broke into another cracker's systems. This spawned endless >> press and at least two best selling books. While this incident >> received much attention, the events amounted to meaningless children's >> games. > > I'd agree with that, from what I know of the Mitnick incident(s). I'm >not sure if Shinomura (sp?) should be called a cracker; others with more >knowledge can comment on this. Agreed. >> By and large, the cracker community, based primarily in the United >> States, Europe, the Middle East, Asia, and in the nations of the >> former Soviet Union, is composed of individuals who see the cracking >> process merely as a challenge, a brain teaser, a puzzle. They view >> themselves as not only being innocent of any crime, but perhaps even >> doing something righteous, something to counter the dark monoliths of >> the corporate and government worlds. They believe they are being >> persecuted. These individuals believe that what they are doing is not >> doing any true damage. At its least harmful, these crackers just look >> at information. However, privacy issues and military secrecy can >> render such infiltrations acts of terror. > > Often, military secrecy is just an excuse to not allow information >damaging to governments, etcetera from getting out. With NSC involvement, how >deeply do you think the Iran-Contra dealings were classified? I would, however, >agree with you about privacy issues... but governments are far greater threats >in this regard than all the crackers in the world. Much of the information in >question would not be around in so many places (such as notoriously accessible >government databanks) except for governments gathering information they >shouldn't have in the first place. Whether you are right or wrong about what governments have locked away is not in my work area. As I've said, my work is in fanatics, the disenfranchised, etc. People are people, and some turn rogue. It happens. And people are purchased. My work keeps me entrenched in such mire regularly. > >[...] > >>Crackers as Facilitators > >[...] > >> Historically, individuals engaged in the practice of terror tended not >> to be people working upon a computer 20 hours per day. Terrorists have >> not been in the business of tracking the latest holes found in UNIX or >> an obscure government telnet opportunity. There _are _people, however, >> who are in that business - for illicit as well as good cause. As >> stated, just as indigenous people may be turned into soldiers, so can >> crackers be turned into CyberTerrorists. Sometimes such a transition >> may be motivated by money or prestige. Usually, this transition will >> occur without the cracker's cognizance. The potential threat from such >> transitions is mind boggling, considering the damage even one >> mis-directed cracker can cause. > > The first statement is correct... and is likely to continue to be the >case. We would appreciate some evidence for such transitions occurring without >cognizance, or indeed being at all likelyLet me know what you do for a living, and then we can share more. Not trying to be "spooky", but understand that my piece of the world rests in the violent world, and I need to watch my own back. > >> Further, as young, educated people are brought into the folds of >> terrorist groups, this new generation will have the talent to execute >> the acts of CyberTerrorism of which we have spoken. > > Unlikely. For state-sponsored terrorism, for instance, countries with >the motivation for such are also ones that tend to block people from computer >experience. Getting on the Internet is rather likely to expose the people in >such countries to information that will destabilize them... including programs >such as PGP that are restricted by ITAR in the name of (among other things) >decreasing terrorism. You might be interested in the number of "students" attending our universities that have solid terrorism backgrounds. The ones I spoke to made their purpose very clear. > >> We are going to see increasing levels of in-house expertise, and >> concomitant exponential increases CyberTerrorism. Unlike other methods >> of terrorism, CyberTerrorism is safe and profitable, and difficult to >> counter without the right expertise and understanding of the >> CyberTerrorist's mind. Combine our increasing vulnerability, with the >> explosive increases in the level of violence, and increasing expertise >> available inside terrorist organizations through new blood popular >> media, there recently was the Kevin Mitnick incident, where one >> cracker broke into another cracker's systems. This spawned endless >> press and at least two best selling books. While this incident >> received much attention, the events amounted to meaningless children's >> games. > > You appear not to be making much sense here, but I'll put it down to >misformatting. Yes, there is a block of text missing. If you have any interest, I can resend. Exactly how is CyberTerrorism profitable? Certainly, it's >_possible_ for people to be _hired_ to do things that may enable some form of >terrorism... but that doesn't make the _terrorism_ any more profitable than >before.It's more profitable since the cost of entry, and continued operations, are less. In addition, access to financial resources (computer crime) is readily available. And you don't lose someone after they've been blown up. > >[...] > >> If a computer security advisor states that you, your organization, and >> your country are safe behind firewalls, behind a system put into place >> by people who have never fought cyberbattles, behind audit trails, >> passwords, and encryption, then a great and dangerous fallacy (or >> fantasy) is being perpetrated upon you. The only solution is the quick >> deployment of a counter-CyberTerrorist - someone who knows what you >> are up against today, someone who lives in the world of the people who >> are, and will be, attacking - someone who can train the people who >> must fight the battles. > > Passwords and encryption can do a very good job of stopping crackers, >thank you - that's one major concern for which they're developed.It's all in the implementation, Mr. Smith. You know that. >Economic and >other espionage are very much already on the minds of those suggesting using >firewalls, passwords, and encryption; they're a lot more experienced, when >the computer community's expertise is summed up, than you are.Again, just because the tools for protection are there, doesn't mean they are properly implemented. You could not possibly be telling me that everything is locked down safely at this point. Bottom line, if you can make it, someone can break it. Always has been, always will be. > In other words, the above just translates into "give us money." Have some idea of what you speak before you speak, Mr. Smith. We do not accept funding from the private or public sector. We are all volunteers who research high-intensity crime and low-intensity conflict. When I am not volunteering, my job is to make sure you can safely send out your emails without getting blown away or blown up. > >>Ex Post Facto > >> An effective auditing system will only inform the target manager that >> they have taken a hit; perhaps a fatal hit. By that point, it is too >> late. _Now _is the time to take action. Unfortunately, due to this >> open nature of this document, specific counter-CyberTerrorism measures >> cannot be discussed. Those discussions must be reserved for secured >> facilities. > > Nobody disagrees with that auditing isn't the _only_ method needed; >_everyone_ uses other methods.Watch your generalizations. You'd better tune in to how bad things really are. Remember that old saying about prevention and >cure? > Your claim that you can't discuss security in the open is laughable. >Quite simply, security by obscurity doesn't work; in cryptography, it's one of >the signs of "silicon snake-oil" - which is what this document looks like in >any event. First, making a system obscure motivates a lot of people to try to >find out how it works; intelligent people are curious, and don't like >unnecessary secrets unless they're authoritarians. Second, the less people >know about a system, the less people can spot bugs to be _fixed_ in that >system. I prefer a system that has been tested by as many people as possible, >thank you, particularly if my life may depend on it.Again, I'm not worried about you at your keyboard clicking away and offering opinions. There's more to this than encryption. Take off the blinders, Mr. Smith: encyrption is just one little piece of this puzzle. It comes down to psychology, far more than technology. I appreciate your curiousity, your wish for totally open systems. In a perfect world, or even a sane world, that would be ideal. I would love society to be filled with people like you who believe in improving the state of the art, the pushing of the envelope, etc. But you are not who I deal with every day. Unfortunately, just because you don't see these folks, doesn't mean they are not there. They are not the ones with cutesy handles and who send messages to usenets and such. It's the people off the radar screen, the one's that know better than to go public. I've spent way too much time with these nutcases, and I assure you, Mr. Smith, they are very real. > In other words, go back to the drawing board and find something else to >try to sound a tocsin over. > -AllenOpen up your world, Mr. Smith. There is a whole parallel universe of garbage that exists with yours. Whether or not you believe or understand that is frankly irrelevant to me or my work. But hopefully this will open your eyes to the fact that this is not about evil governments, nor military spookery, nor commercialization, nor fear of crackers. The next time I have to travel to a bomb site, and as I try and figure out what cause could justify the death of someone who just happens to be in the wrong place at the wrong time, I will not be thinking of you in your office lecturing me on the computer world. Barry C. Collin -- Institute for Security and Intelligence A Non-Profit Research Institution P.O. Box 9877 Stanford, California 94309-9877 USA

2 1

Re: DoJ is poking around
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03:42 AM 8/29/96 +1000, Skeeve Stevens wrote: > >Im running a mirror of the DoJ site on http://www.skeeve.net/doj/ > >It has had some 14000 hits or so since I put it up.. so I installed a stats >package to see where they were coming from... > >low and behold! > >US Government >wdcsun1.usdoj.gov > 09:07:07 /doj/ > >wdcsun1.usdoj.gov unknown - [28/Aug/1996:09:07:07 +1000] "GET /doj/ HTTP/1.0" 20 >0 8416 > >also > >US Military >palisade.spacecom.af.mil > 07:21:50 /doj/ > 08:30:51 /doj/ > > >looks like the DoJ have been looking around at the mirrors.. maybe to >legally hassle people about them.... > Or, just maybe, some DoJ employees wanted to see what folks on the outside were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at intel.com since it went up. True, Intel was considering legal action against the site, but there's almost no way all those hits are from Mr. Grove's investigators.... Will Rodger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMiTHI0cByjT5n+LZAQFObAf9G1fBFETkuWL5mlTmKb2RwLTs/HyTGML7 c8nSdpS+Hsj/I+ofvqUHn07ahulsr+kDLWQmmR3JHFKlT0KCsfydmAn0CvjTVRw+ dyeRTFzxW5fbcmwLBpzmijKllQjoEa7GiM3kUgaGb7MYqssnDoa5YDIA9jYtFvTY 3cKymCiyqNUGWTsskLLAS8zjClIH9q9yF6qq+unY66PyRo44dUGkDH6L1Jd4AOZ6 b/Mgphj3oW59veX/scfxKcLlMAnxvJoLpdlLysJHeU2jhVB/tjRneAxNxZqCTFi8 uVXpPbL568V1xR9uyxmaZbbQqG7+0PgEj+kW5r99zvTZfd0fMd6irA== =EwSd -----END PGP SIGNATURE-----

1 0

RE: Real or Not ?
by Osborne, Rick 17 Dec '03

17 Dec '03

I think we all know this is fake. I saw the original web page out there (search lycos for "pgp crack" to find it) and it originally had an extra line at the end (tactfully ommitted, I see) which said something to the effect of "In case you couldn't tell, this is a joke!" -oz ---------- Subject: Real or Not ? Date: Wednesday, August 28, 1996 7:57AM I snagged this off a news group this AM.. comments?? A lot of people think that PGP encryption is unbreakable and that the [...]

1 0

Reg E changes
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Wed, 28 Aug 1996 11:21:09 -0700 To: rah(a)shipwright.com From: Somebody Subject: Reg E changes Bob, If you have not already done so, please submit a public comment re: the proposed Reg E changes [Docket No. R-0919]. The deadline is September 7th. You may want to announce this to other fans of bearer certs. Thanks to my friends at the Fed, I am in possession of comments already submitted. The opposition is trying to get the Fed to not make the proposed account/non-account based distinction when deciding what is covered under Reg E, but instead use a $ cap. The logic is that there is an account anyway, be it on the card (such as the record of the total on a prepaid card that is used for paying subway fares) or be it at the bank. We need to make sure that the supporters of non-book entry systems make their voices heard. When writing the comment, please include a request to do away with the hard copy signature requirements for opening accounts. If the Fed gets enough requests, they will include it in the next round of proposals. -- Somebody --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

RE: File System Encryption
by Wayne Clerke 17 Dec '03

17 Dec '03

The Drifter[SMTP:drifter@c2.net] wrote: On Wed, 28 Aug 1996 02:55:20 +0400, Wayne Clerke <wclerke(a)emirates.net.ae> wrote: >Tried secdev? Edgar Swank (author of secdrv) recently posted >that secdev (note, not secdrv) does, in fact, uses 32 bit disk >access with win95. Win95 reports that the secure device is in >compatibility mode, but the host disk (and therefore the secure >volume file) is being accessed in 32 bit (disk) mode. Not sure >what issues there are with '32 bit FILE access' mode here. > >Sounds worth a try though. Please post the results if >you try this. > I have actually had Secure File System, Secure Drive, and Secure Device all installed with mounted volumes at the same time under Win95. However, 32bit file access is not the problem. When you load a TSR in Win95, the operating system forces you into 16bit DOS compatability mode. I'm not a kernal guru so I can't explain all the specifics, but it basically makes 95 act as Win-3.11 and looses multithreading (as it were) and creates serious memory paging problems if you have >32mb installed. You've got this all wrong. Only certain types of TSRs cause this. I'll leave it to an expert and just quote the author of secdrv: Edgar Swank wrote: >For those users of Win95 and SecureDrive who are concerned about loss >of 32-bit disk access, I've recently learned that use of Secure Device > > ftp.demon.co.uk:/pub/ibmpc/secdev/secdev14.arj > >instead avoids this requirement. Although the Secure Device virtual >drive is listed as in compatibility mode, the real drives are not so >affected. And since the virtual drive is mapped to a dos file on one >of the real drives, I believe you get 32-bit phyical drive access >there as well, although access is still slowed by CPU time necessary >to encrypt and decrypt. Thanks for the reply though .. and if you need assitance with getting SECDEV working under 95, just drop me a note. Thanks for the offer ... Drifter Regards, EMail: wclerke(a)emirates.net.ae PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> If you're not living on the edge, you're taking up too much space.

1 0

Re: libelous action
by James C. Sewell 17 Dec '03

17 Dec '03

At 02:57 AM 8/27/96 -0400, Black Unicorn wrote: >I would remind you that each and every sale you make of this product, when >based on material misrepresentation, constitutes a fraud. If made by >wire, as these sales seem they may, they represent wire fraud. That's one >count of fraud and one count of wire fraud. If a check is sent to you via >mail, that's a count of mail fraud to boot. > Wow, imagine what would happen if a bunch of "in-the-know" folks bought a product like this under the claims to strong crypto and then found out they were fooled! With charges like these a guy could get into real trouble. I sure hope Mr. Holt isn't personally accountable. He sounds like a real swell guy. It would be a shame for him to go to prison for what is obviously his misunderstanding of what is cryptographically strong and what is a pitiful excuse for a product. Of course I've never seen his product so I don't know which category it falls into, but it would be a shame. Disclaimer: I may or may not be serious. I have made no direct claims so whose to say what my intentions are in posting this ;\) Jim Sewell - Programmer Tantalus Inc. jims(a)tansoft.com Key West, FL 33040 Amateur Radio: KD4CKQ 801 Eisenhower Drive Compu$erve: 71061,1027 Multi-player computer games

3 2

Cypherpunks Lite
by youssefy＠ucla.edu 17 Dec '03

17 Dec '03

There was a posting by someone about three weeks ago that gave the address for a person who ran a filtered version of the cypherpunks list, can someone please repost that information?

2 1

stego virus
by Moroni 17 Dec '03

17 Dec '03

If a virus is embedded into a giff ,is it executed when the giff is or does it require the usual overwriting etc methods to execute it? TIA

2 1

There is no Agent Toby Tyler at the FBI [UK Observer Story]
by Richard Charles Graves 17 Dec '03

17 Dec '03

...two different sources, both of whom are anonymous because they work for competing newspapers, tell me. Could someone else with contacts/time to kill/attributability please confirm this? Kinda puts a dent in the whole story, don't you think. -rich

1 0

Re: DoJ is poking around
by Corey Minter 17 Dec '03

17 Dec '03

Forwarded message: > >looks like the DoJ have been looking around at the mirrors.. maybe to > >legally hassle people about them.... > > Or, just maybe, some DoJ employees wanted to see what folks on the outside > were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits > the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at > intel.com exactly. watch out, some DoJ revisionist might get into your mirror site and get you back for trying to keep a history of the incident :). well... maybe not. -- ______________________________________________________________________ Corey Minter | cminter(a)mipos2.intel.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I wish I had a dollar for every time I spent a dollar, because then, Yahoo!, I'd have all my money back. --Jack Handy

1 0

Mimic Function Stego Programs?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Does anybody have a stego program along the lines of Peter Wayner's Mimic Functions? I'm looking for something that you can hand a grammar and a set of bits that will produce sentences in the grammar, plus a decoder that can take the sentences and reconstruct the bits. I have a friend who lives in a kleptocratic country where the local bureaucrats have made it clear they'll confiscate the main email node in his town if they catch traffic they recognize as encrypted, and text in some non-popular language may be less obvious than, say, Mandelbrot sets with stego-bits or other artwork. ----- PHB would work ok... http://www.unitedmedia.com/comics/dilbert/archive/dilbert960821-9577.gif ----- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

3 2

Re: Edited Edupage, 18 Aug 1996 [SATELLITES]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 27 Aug 1996 15:46:13 -0500 (CDT), Igor Chudov @ home wrote: >> >I'd worry far more about the stresses of launch bothering >> >the drives. >> >> That's not a problem at all. Most modern drives are rated for 10's >> of G's, non-operating. Satellite launches are probably a breeze >> compared to this. >I remember reading that Russian satellite launches with people aboard >had acceleration of about 9-10G. Since when do satellites have people on board? (Or was this some new way of silencing politcal prisoners?) / If you think education is expensive, try ignorance. / Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp / Autoresponder: send email w/subject of "send resume" or "send PGPKEY" / Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 / Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Real or Not ?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:09 PM 8/28/96, Declan McCullagh wrote: >On Wed, 28 Aug 1996, Eric Murray wrote: > >> Heh. They forgot the Black Heliocopters manned by agents of >> the UN/New World Order, and the Greys from Zeta Reticuli.. >> >> It's a hoax, with several clues that it is a hoax in it. >> >> Of course you're welcome to prove me wrong by disassembling >> a PGP binary. Examination of the random numnber generator, IDEA >> key setup, or RSA key setup vs what's in the source code >> should show if something fishy is going on. > >Unless of course the program you're using to view the disassembled >instructions has also been altered by the TriLats. And make sure you use >any pre-1992 compiler on a pre-1992 operating system on a computer that's >not hooked up to the Net or even located where NSA agents can get to it. Ha! You think a pre-1992 compiler and OS wil fix this? What about the processor? I can assure you, as a longterm Intel employee during these formative years, that Intel was pressured into including the famous "NSA instructions" into the 8080, in 1974. These instructions are well-known, and the Cray had them as well. Inasmuch as the 8080 instructions live on in every x86 processor--like the reptilian brain inside all of us--this gives the NSA instant access to all contents of the processor. This is why I use a Mac, of course. --Perry Noyd We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: (flatulence): Reply-to loops
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rah(a)shipwright.com" "Robert Hettinga" 28-AUG-1996 02:44:31.09 >We don't do it because of reply-to loops. >Only idiots, or charitably, those with very low traffic, run their mail >lists any other way. >Accidentally sending private e-mail to the list is bad enough without >bringing the listserver to its knees... Umm... only one other list I'm on does reply-to to something other than the list, and some of those lists are running majordomo. Reply-to to the list doesn't have to cause problems; only a few domains (compuserve.com, wow.com, and one other that I can't remember offhand) cause error problems to reply-to addresses. The point about low volume mailing lists vs high volume ones is, however, a good point; the other list with reply-to to other than the list that I'm on is one designed for low traffic. -Allen

1 0

Hmmm MSIE V2.0
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

It seems to be that MSIE V2.0 transmits its data in the clear once it has transmitted the client hello and received the server hello SSL records in some limited circumstance or other. I don't know how widely this bug exists. Neither do I know which versions other than the French one has it. However, if you point your version of MSIE at https://beta.mkn.co.uk/help/system/msie and it indicates that the client has encryption problems. Then you have that problem as well. I would watch this one. Anyone feeling like tracing the packets will find it easier to crack than 2 bit SSL. (let alone 40 bit or 128 bit). Any thoughts?

1 0

Re: DoJ is poking around
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:21 PM 8/28/96 -0800, Adamsc wrote: >>> >looks like the DoJ have been looking around at the mirrors.. maybe to >>> >legally hassle people about them.... > >>> Or, just maybe, some DoJ employees wanted to see what folks on the outside >>> were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits >>> the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at >>> intel.com > >Out of curiosity, has anyone used a decompiler to check if any of the >undocumented stuff is getting used in shipping programs? I have not heard of anyone doing this with the Intel code, but I have seen info on the "Secret APIs of Bill" (Undocumented Windows API calls) being used in various programs. (For more info on this, check out "Undocumented Windows" by Schulman, Maxey, and Pietrek.) I am sure that the people who produce SoftIce could give you more info on this. (Either that or talk with whoever is doing the undocumented feature column for Dr. Dobbs.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: stego virus
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:56 PM 8/28/96, Moroni wrote: > If a virus is embedded into a giff ,is it executed when the giff is or >does it require the usual overwriting etc methods to execute it? > TIA The virus is activated when the GIF is _viewed_. The viewing of the GIF activates the cerebro-visual processing centers of the brain, activating the ancient Sumerian meme complex. I assume, of course, you are referring to the deadly Snow Crash Good Times virus. If infected, the only solution is to unsubscribe from the Cypherpunks list before others are similarly infected. Hey, Moroni, we've missed your particular slant these last few months. --Klaus We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Clinton follies ideas?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Aug 28 21:57:52 1996 Our esteemed figurehead, Bill Clinton, will be doing the first stop of his "Road to Victory Tour" campaign this Friday, just a few blocks from my apartment. Does anybody have any cool suggestions on things to do to harass, heckle, or maybe get taken down by the Secret Service? (Or should I just yell, 'Clinton, you suck!'? :) dave Special P.S. to all FBI wiretappers: This is a joke. - ----- David Smith, Thinker of Deep Thoughts :) http://www.prairienet.org/bureau42/library.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMiUHMzVTwUKWHSsJAQE4ygf9F5ihhla2NguUFEFEgqDEb97haqqIv2ak MQ07CRohP+QHYBsMnsnqjMvZslVnQCkr+mJWa8DC22dEPvGQ58+8NdsuykspIgEE jegvZuQqGBmHex3fz6NLcYBQXFuyF8fbGEaXuHJjmvszkZDBqe3Fo95ywuMJPklZ TIpZjE2xbX7T+H6yK2itIi/cmyPHN7zTfHKpdvjWcAY6hMVXuQwLx5g/cg3AErA4 R7MhDTnL2uH/16ccYQKPnpyBqxZ/DYg/DzrwO0Jj1RzeXBllTyALXMt5pQRKrbuy xl8IJJ4j1cFIjeiOvg/tTBpOoFP1f3tj8iDLBYrzqxCytelyWxgQnw== =LK29 -----END PGP SIGNATURE-----

1 0

desubscribe
by backdraft＠earthlink.net 17 Dec '03

17 Dec '03

I would like you to desubscribe me from you mailing list

1 0

NSF yanks Iran's Internet connection, from HotWired
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 28 Aug 1996 20:08:06 -0700 (PDT) From: Declan McCullagh <declan(a)eff.org> To: fight-censorship(a)vorlon.mit.edu Subject: NSF yanks Iran's Internet connection, from HotWired Attached is my column on the NSF and Iran. After I filed it, I received an unconfirmed note from the NSF saying that they removed the restriction in response to my calls earlier today. I'll verify tomorrow. I have some original documents on the Iran sanctions law and executive order at: http://www.eff.org/~declan/global/ -Declan // declan(a)eff.org // I do not represent the EFF // declan(a)well.com // http://www.netizen.com/netizen/96/35/special3a.html HotWired The Netizen Banning Iran by Declan McCullagh (declan(a)well.com) Washington, DC, 28 August The US government has quietly pulled the plug on Iran's Internet connection. The catch? No one gave it permission. Earlier this month, a National Science Foundation official blocked crucial international links to Iran, apparently in response to an Iran and Libya Sanctions Act that became law on 5 August. The move prevents people in the United States from connecting to Iranian computers by cutting off access to the country's only permanent Net connection - a single, achingly slow 9600 bps modem. The link joins the Internet at Austria's Vienna University, which received a letter from an NSF employee - who the foundation claims acted without authority - asking their network gurus to cease forwarding Iranian data to American networks. The NSF employee, Steve Goldstein, told the university that the United States embargoed such exchanges with Iran. From Austria, packets travel across the Atlantic through links funded in part by US taxpayers, which Goldstein claims gives the NSF control over them. Goldstein works in the agency's Networking and Communications Research and Infrastructure division. The NSF's action, however, tramples on the First Amendment. The Supreme Court has upheld the right of Americans to receive a wide range of information from abroad. An existing executive order explicitly allows the import and export of Iranian informational materials regardless of medium of transmission, according to Solveig Bernstein, a lawyer with the Cato Institute. "Congress intended any sanctions the president took to be directed at money and weapons production, not communications," she said. The NSF isn't accepting responsibility. The agency claims Goldstein acted on his own volition. Although Goldstein declined comment, the agency's lawyers say he was not authorized to block the line. "We were not asked by Dr. Goldstein for any opinions, so I'm not sure on what basis we're doing it," said John Chester, NSF legal counsel. Other NSF officials did not return repeated phone calls. Many Iranians in the United States are outraged at losing access to friends, family, and educational links in Iran. Farhad Shakeri, a software engineer at Stanford University who operates the Iranian Cultural and Information Center, says: "Lots of people in Iran are confused. They can't talk to any university in the world.... We just want the problem fixed." Anoosh Hosseini, a webmaster at the Global Publishing Group, says: "It affects me as a person. I want to visit my cousin's homepage, and my brother's homepage. The University of Texas has a Middle Eastern research center, but now they can't research Iran [on the Net]." ###

1 0

Re: DoJ is poking around
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

>> >looks like the DoJ have been looking around at the mirrors.. maybe to >> >legally hassle people about them.... >> Or, just maybe, some DoJ employees wanted to see what folks on the outside >> were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits >> the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at >> intel.com Out of curiosity, has anyone used a decompiler to check if any of the undocumented stuff is getting used in shipping programs? - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: SUN_pak
by Andrew Loewenstern 17 Dec '03

17 Dec '03

I was looking at the description of this patent (thanks to JYA for providing easy access to this article...), and I can't believe Sun got a patent for this. Tunneling encrypted IP sessions over regular IP by using a gateway router is hardly a novel idea and is immediately obvious to anyone who is knowledgable in networking and crypto. Aren't there already products out there (hardware and software) that implement this sort of thing? I seem to remember Cisco producing a router and MorningStar producing software that did this. I also seem to remember the concept being discussed on this very list several years back (can't check the archives from work though...) I believe there is even a name for it: VPN (Virtual Private Networks) John Gilmore is currently putting together a project to do much the same thing in software... Did I miss something innovative in this patent, or is this another example of clueless patent examiners granting patents for things that don't deserve patent protection? andrew

1 0

Re: In reference to comments made to me and to the Group
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com, whgiii(a)amaranth.com Date: Thu Aug 29 11:53:46 1996 I kind of like this valid discussion going on. PERIOD. But I believe that although there's something (maybe, maybe not) politicians (be they Protestant, Palestinians or from Dresden) might find a misdemeanor, one shouldn't boast with possible unwarranted encryption. No, seriously, your arguments tend to be belittled by your spelling. (Maybe you should get Pronto Secure, it has a spellchecker included) BTW, I don't get paid by Commtouch for writing that (SNIF!). A quick overview: beleive, politions, disscusion, orginised, sponcered, orginization, wekness, vailid, Dresdin, durring, expantion, Prodistant, Palisinians, unwarrented, PEROID, somthing, mistamener, mabye, mabye not, possiable, encyrption, disscussing, bost I hate teachers and people who show of with their spelling (and I'm a split personality). Yeah, me too. - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiVoqxFhy5sz+bTpAQFYUgf/eu+dQvQALz7Of3DCWLoBWVICY2fmnDJB tQcHTNbuPXybjACVq8+LxdKT2wjXzuU401/rv4dW5+LgrMRlKMIhjx8xAIKSKBOg VBb2ruV9SG2/+sY0iYzJY1Dz4opf5c9aCLgN5ptM2LeWyWOtK71VtV8ASDaoGBP7 HIs9jVJ3sbyQaf8CPfR+pEQSjGLHCm8QshazSjPvuUdIRxB5f9Etpy+45vK4FVPP EXWYaN3jTBOPC24Qe8qGs+Dn/9C5ZR9y0Y2edv/XzWDZrdg951lSdQKxca4wtCbD nyKQ/R86wvfy65uwrBDzUSFupuA1M8TcF63ncybQ/316cHl8x/z0rA== =musf -----END PGP SIGNATURE-----

2 1

Desubscribe
by MrAdvent＠aol.com 17 Dec '03

17 Dec '03

I would like you to desubscribe me from you mailing list

3 2

Re: There is no Agent Toby Tyler at the FBI [UK Observer St
by Peter Trei 17 Dec '03

17 Dec '03

Duncan Frissell <frissell(a)panix.com> writes: > At 03:17 PM 8/28/96 -0700, Richard Charles Graves wrote: > >...two different sources, both of whom are anonymous because they work for > >competing newspapers, tell me. > > > >Could someone else with contacts/time to kill/attributability please confirm > >this? > > When I first saw the name, I remembered my misspent youth: > Toby Tyler, or Ten Weeks with a Circus (1960) > USA 1960 Color > Produced by Walt Disney Productions Which proves little (though it is suggestive). People get names for a variety of reasons, and before 1960, there would have been little reason *not* to use the name. Back in the 70's I remember hearing many reports from a news announcer at the BBC World Service named Dick Tracy. Peter Trei trei(a)process.com

1 0

Re: MUD anyone?
by jim bell 17 Dec '03

17 Dec '03

At 09:47 AM 8/27/96 -0700, Jon Leonard wrote: >> Would anyone out there be interested in helping set up a >> crypto-anarcho-capitalist MUD to play around with some of the social >> aspects of crypto-anarchy and anarcho-capitalism? I can probably hack >> together a basic lpmud in a month or two if someone has a machine which >> it could run on and which could run a mailing list for those involved. > >I've been planning to run a MUD like that, at mud.umop-ap.com port 2121. >I just don't have enough coded to be worth announcing yet. >Which cryptographic primitives should be coded in initially? >Obvious choices are: >Pseudonyms >Anonymous digital cash (issued by any pseudonym, not just "banks") >Public and private keys >Secret sharing >Anonymous broadcast & message pools >Anonymous markets > >What am I missing? Should there be direct support for Jim Bell's >assasination markets? It'd provide a means of demonstrating its >ineffectiveness as a means of social control. Aren't you writing up the results of the experiment before you even take the data? That's called "dry-labbing." In any case, I'd welcome such a simulation, but there are a number of caveats. To me, the most obvious one is GIGO: Simulations, especially political/social ones, might depend heavily on assumptions that are programmed into them. A trivial, yet interesting example is the computer game "Sim City" which allowed you to adjust the "tax rate" but problems always cropped up the further away you were from 7%. The libertarians were frustrated that we were unable to drop the tax rate and still get a well-functioning, happy society. It is unlikely, obviously, that there is anything magical to a society about a tax rate of 7% The answer is likely that the people who wrote the program simply hard-coded it into the game, either directly or as a consequence of various political/social assumptions that they didn't realize they were making. Another problem was demonstrated a few weeks ago when a "game theory"-type problem was proposed on CP, the one where 20 thieves sequentially are given the task to propose the disbursement of $20 million in loot, with a vote on the proposal and death for the proposer of a rejected proposal. I pointed out that the difficulty with an _exact_ (game-theoretical) solution to such a problem is that the "cost" of death in this problem is undefined. A person might be willing to take a risk of death for $20 million that he's unwilling to take for $20 THOUSAND, and certainly not $20 DOLLARS. AP (Assassination Politics), at least the initial "government-eliminating" function of it, should work on a financially-sound principle: Actuarially, the value of a continuing $1/year obligation is $20 if the real interest rate is 5%. This means that if a randomly-selected government employee is paid $40K per year including benefits (money which is stolen from taxpayers), it would be worth a one-time cost (actuarially speaking) of 20x40K, or $800,000 to see him dead and not replaced. Assuming his death can be purchased for less than this, you are dollars ahead to buy it. If you can buy his death for, say, $20,000 (half his yearly salary) you have, in effect, profited by $800,000-$20,000 or $780,000 to do this. (Technically, the amount _society_ would benefit is actually the amount of salary cost eliminated, minus the ordinary benefit of that government employee doing his usual job. A person (statist?) might try to conclude from this that getting rid of them won't save much. That's the collectivist point of view. However, the people who (unwillingly) finance these salaries with their tax dollars, and the people who arguably benefit from these employees are, in my estimation, two separate and distinct groups of individuals, so my analysis is still valid for the former group.) It gets even better. If most of these employees decide that discretion is the better part of valor, and 90% of them resign rather than (almost literally!) get the ax then the average cost of getting rid of a given employee is reduced by another factor of 10, perhaps to $2,000. And obviously, the system feeds on itself: Once the average cost of getting rid of them drops to $2,000, their fate is so certain that the resignation rate would probably skyrocket to well over 99%, which would further reduce the average cost to perhaps $200, and so on. The overall effect is somewhat akin of "falling off a cliff," or perhaps the collapse of a star destined to become a black hole: Once a certain point it reached return is impossible or impractical. Now you should understand why I'd be quite pleased to see such a system modelled: It would be great to be able to vary the initial conditions, and see that the outcome turns out almost identically each time. Such an outcome would make you very nervous: It would show that I am correct! (BTW, a similar analysis will probably suggest that the amount of money traditionally spent on US national defense would drop from the current figure of about $250 billion to no more than 1/1000th of this, or maybe even far less, and for similar reasons.) Jim Bell jimbell(a)pacifier.com

1 0

Annoucing LivePGP - content security for web (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

-- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li ---------- Forwarded message ---------- > From ssl-lists-owner(a)minbne.mincom.oz.au Thu Aug 29 01:00:59 1996 > Message-Id: <01BB9594.5E8FC740@minuet> > From: Ming-Ching Tiew <mctiew(a)csi.po.my> > Subject: Annoucing LivePGP - content security for web > Date: Thu, 29 Aug 1996 10:25:07 +-800 > Encoding: 54 TEXT > Sender: ssl-lists-owner(a)mincom.com > Precedence: bulk > > Inspired by Adam Cain's write-up ( and others ) on comparison on the using of PGP, > SSL/HTTPS, SHTTP and others on Web technologies, I have written a LivePGP > plugin for Navigator 3.x and is available for evaluation for anybody who cares to > send me a email ( as I don't have a leased line connection to internet ). > > See below for a summary. > > Thank you, > Regards, > Ming-Ching > mctiew(a)csi.po.my > > ------------------------------------------------------------------------------------------------------ > As a summary, this is a plugin for Navigator 3.x which I developed it > myself, and which I called it LivePGP because it uses LiveConnect and > PGP. > > LivePGP is a plugin to be loaded on Navigator machine; it secures the > content before transmittion to the network. Therefore, it doesn't matter > what network or what's or ever. > > With absolutely no intention to compete with SSL and SHTTP, LivePGP > attempts to address some issues with existing security products :- > > 1. 1024-bit key length of PGP in comparison with 40-bit for SSL ( due to > international export limitation ). PGP is a well-known product which > has survived years to testing. > > 2. Extended security vs point-to-point security provided by SSL. Content > coming out of SSL client and server are plain text, which may > be subjected to system administrator's tempering with the data. Using > LivePGP, the decryption of data can be relayed as late as (operationally) possible. > > More important practical reason is that the signed content can be logged > on the client and server; it is very useful to addresss non-repudiation. > The client cannot argue that he didnot submit the transaction, because > the content which contains the client's signature can be logged and printed out. > > Similary, system administrator's tempering the data could be checked against > with. > > 3. Even thought the plugin is developed using C/C++ and Java, > deployment for any scenerio need only standard HTML/Javascript. > > 4. Client is Win95/NT. Server can be anything. Win3.11 is unknown. > > 5. Every part introduced by me is source code available. > > 6. Can use it together with SSL to make use of the high transparency > of SSL. > > 7. Can use it to upload ( signed and encrypted ) local files, in addition > to uploading ( signed and encrypted ) web content.

1 0

Re: In reference to comments made to me and to the Group
by Institute for Security and Intelligence 17 Dec '03

17 Dec '03

Mr. Geiger: I do not have interest in nor time for a flame war. But I do appreciate your perspective, whether or not I agree. Rather than flaming, I propose that all interested readers post their *CONSTRUCTIVE* ideas on the CyberTerrorism issue. If you feel it is not an issue, then don't respond. I'm not looking for opinions on politicians, the government, etc., nor do I care what you think of me or my views. However, if you can put some _solid_ thoughts into bullet items, or any other format you deem useful, perhaps we can move forward. Ideas. Actions. No commentary, raves, rants, flames, or other bandwidth wasters. Let's see what we come up with. Barry C. Collin Institute for Security and Intelligence

3 2

Re: In reference to comments made to me and to the Group
by Ross Wright 17 Dec '03

17 Dec '03

Sir, Please get a spell checker before you post any more thousand word flame-outs On Or About: 29 Aug 96, 0:05, William H. Geiger III wrote, jumping into a flame war before he learned how to spell polititions orginised, > campaines Prodistant Prodistant Palisinians > Unauthorised mistamener <sp?>. mabye, mabye possiable > obsecurity conserned . Ofcource experiance comprehention big bost These are just a few of the spelling errors in a huge rant!!!!! =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: There is no Agent Toby Tyler at the FBI [UK Observer Story]
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:17 PM 8/28/96 -0700, Richard Charles Graves wrote: >...two different sources, both of whom are anonymous because they work for >competing newspapers, tell me. > >Could someone else with contacts/time to kill/attributability please confirm >this? When I first saw the name, I remembered my misspent youth: Toby Tyler, or Ten Weeks with a Circus (1960) USA 1960 Color Produced by: Walt Disney Productions Genre/keyword: Children's / Drama Language: English Runtime: 96 Also Known As: Toby Tyler (1960) Directed by Charles Barton Cast (in alphabetical order) Henry Calvin Kevin Corcoran .... Toby Tyler James Drury Gene Sheldon Bob Sweeney Written by Lillie Hayward James Otis Kaler (novel) Bill Walsh DCF

1 0

Simulations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:05 PM 8/28/96 -0800, jim bell wrote: >To me, the most obvious one is GIGO: Simulations, especially >political/social ones, might depend heavily on assumptions that are >programmed into them. A trivial, yet interesting example is the computer >game "Sim City" which allowed you to adjust the "tax rate" but problems >always cropped up the further away you were from 7%. The libertarians were >frustrated that we were unable to drop the tax rate and still get a >well-functioning, happy society. I was taking economics back in the Armonk Iron days and we played around with an economic simulation program written in Fortran. One was supposed to adjust government spending and taxes to find an optimum level. I set both taxes and spending to zero. We got a lot of economic growth and a lot of inflation (this was not a monetarist simulation). But we were happier. DCF

1 0

MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

Just downloaded the most recent English Version 2.1 for Windows 3.1. This does appear to do the same in terms of no encryption at all after the server hello. To be fair to Microsoft the number of cycles performed for the private key echange is quite high. Therefore, not having any key and not doing the RSA calculations makes the access quite a bit faster. The older versions (and some Win95 versions) that we have found around seem to just crash our server. I am not really feeling like debugging that.

1 0

Re: Thoughts on CyberTerrorism {per request}
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: whgiii(a)amaranth.com, cypherpunks(a)toad.com Date: Thu Aug 29 15:45:06 1996 > The issue of cyberterrorism can be divided into 3 main parts: > Catastrophic Terrorist Attack > Major Criminal Attack > Minor Hacker Attacks > The CyberTerrorist > The CyberTerrorist/Mad Scientist > The Computer Criminal > The Hacker It seems that you have a very broad view as to what constitutes terrorism. According to you, somebody who hacks into a system is a cyberterrorist. It seems, that would make a burglar a real life terrorist, too. So, to state my point: you use the word cyberterrorism in conjunction with ALL possible attacks on a system. Did I get that definition right? If not, why not? Greetings, Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiWe5BFhy5sz+bTpAQGf5gf+L6Mkx4rqvdvsWe84j2TzLYaeOpbO7VCe S1Ia3EC9rByfXK71zmDCWRd7bTdmRULq297dD/Aqr7KWSEEtsBpQCLs8tGiPCV3I S+M613ud6Uy9QXtIyw14Ao7XILijWUDU2Hdwb5xfmJ/GIIQiZyDjMVLDXABM7rgb 4d+5AP+gh6VTRNqd2LmhwcvhUoupeJ40QxlRyOJ2A4ZNT7xaS7shUPnbS5kcuSrF z27nRmnaPkRmh3VD870OIoTRsWUOIQ9lwUkXrPdly9w8E23FyuXGPEMkW+KdUCNZ 6hI7YYsBnCJjM+aUzq3Ypt/N/iUcbPvKO4T+FtbKJHB15IbtDTUr4A== =pg+4 -----END PGP SIGNATURE-----

1 0

Realtime Keyserver update
by Osborne, Rick 17 Dec '03

17 Dec '03

First off, let me say thank you to all of those who responded to my first message, I gained alot of useful information. Mark Rogaski <wendigo(a)pobox.com> and I have decided to write up a RFC on it and are going through the initial stages of deciding on its functionality. We would appreciate any and all useful input on the subject. All ideas are welcome. You can email my autoresponder (at this same address) to get the latest information on what we've decided. Just make the subject GET KEYSERVER INFO for the response. Thank you for your interest and help. Rick Osborne

1 0

List owner named in law suit (fwd)
by Damien Lucifer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 28 Aug 1996 16:52:36 -0400 (EDT) From: Clay Irving <clay(a)panix.com> Subject: List owner named in law suit I can't believe this one! Peter Laws, a recent graduate of the University of Arkansas, maintains an electronic mailing list called "SCAN-L". The list is provided for radio scanning enthusiasts. There are a few hundred subscribers to the list. Recently, in a thread about scanning publications, an employee of publication "A" apparently wrote something to offend someone at publication "B". Lo and behold, next thing you know, Peter is named in a lawsuit because he is the maintainer of the list. Something seems very, very wrong with this. I've never heard of anything like this before. Can a Email list maintainer be held liable for something someone else writes? Peter *just* graduated, and he needs all the help he can get. Thanks, in advance. -- Clay Irving N2VKG clay(a)panix.com http://www.panix.com/~clay/

1 0

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Small German bank claims first with online service
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> FRANKFURT, Aug 28 (Reuter) - German private bank Gries & >Heissel Bankiers on Wednesday launched an Internet banking >service -- the first comprehensive service of its kind in a >country where online bank options are gradually taking off. > The small Berlin-based bank linked up with U.S. computer >firm Hewlett Packard Co to develop the system, which Internet >users can access using a high-security personal code. > Clients will be able to view detailed balances on their >deposit, current and securities accounts and transact all normal >banking business on the World Wide Web. > Although online banking is a developing trend on the German >financial services market, larger banks with far broader >customer bases are working on more selective Internet packages. > Thomas Gries, one of Gries & Heissel's personally-liable >directors, said he regarded Internet banking as a logical >supplement to the bank's existing services. > ``We have had an Internet home page since October 1995. This >move from a pure information medium to an interactive one was a >logical one,'' Gries said. > Banking officials attending the CEBIT electronics conference >in Hanover this week said German online banking business was >poised to grow dramatically. > ``In the next six months, five to ten German banks will be on >the Internet,'' said Stefan Schoeller, board member at Bayerische >Vereinsbank AG unit Vereins- und West Bank. > Vereinsbank plans to launch Internet services within about >six months via its Advance Bank direct unit, pending a review of >security options. > Rival discount broker Direkt Anlage Bank, a unit of >Bayerische Hypotheken- und Wechsel Bank AG, on Tuesday launched >an Internet service for its securities account holders at half >the cost of its telephone banking service. > Meanwhile market leader Deutsche Bank AG is to test >electronic cash on the Internet this autumn in a joint >initiative with Dutch electronic payments group Digicash NV. > Vereinsbank officials at CEBIT said they planned a steady >expansion of the bank's online options over the coming years, >predicting 10 to 15 percent of its current account clients would >be online by the year 2000. Around 12 million Germans would rely >on home banking by that date, the bank predicted. > At the moment, around 3.7 percent of the bank's clients, or >45,000 individuals, handle their banking via PC alone, Stefan >Schoeller said. > Hewlett-Packard's German sales manager Michael Lindner said >his company, which last year helped set up the world's first >Internet bank, Security First Network Bank, had spoken to >several other German banks about some kind of Internet venture. > ``We certainly do not plan to limit our involvement to a >small exclusive bank,'' he said. > Lindner said there were about two million Internet users in >Germany and 35 million worldwide. He admitted that the amount of >bank business transacted on the Net -- about $200 million -- was >``very limited'' but predicted a dramatic rise in volume. > Vereinsbank's Schoeller said the cost advantage alone made >it worthwhile for customers to go online. A normal current >account incurred charges of 8.40 marks a month, while the same >account online would cost just 5.40 marks, he said. > All banks are stressing the security of the Internet. > > > _______________________ Regards, Boredom is the feeling that everything is a waste of time; serenity, that nothing is. -Thomas Szasz Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

>> Just downloaded the most recent English Version 2.1 for Windows 3.1. >> This does appear to do the same in terms of no encryption at all after >> the server hello. >I understand that some versions of MSIE support SSL level 3. SSL3 includes a >capability to switch 'cipher suites' in mid-session, or pick one at the start of the >session. One of the standard cipher suites performs authentication, but not >encryption. This is consistant with your description. >Please ensure that the server you are connecting to is not configured for >authenticate-only. It would be a pity to raise a big ruckus over what may be >just a mis-configured server. The server is one which interoperates correctly with Netscape and my own routines. It does strike me that this change is potentially the source of the bug. However, to have a "locked" symbol on the bottom right hand of the display would indicate to me as a user that a secure session has occurred. For SSL devotees the records sent are: 1. Client hello (from the client) 2. Server hello (from the server). 3. Plaintext data packaged up in SSL records from the client. 4. The client then accepts plaintext data packaged up in SSL records. SERVER_VERSION_MSB and SERVER_VERSION_LSB indicate version 2 of SSL. I have not changed the code in any way to deal with version 3 of SSL making I think the valid presumption that browsers using 3 and 2 should be able to cope with a server using 2. I shall reboot my system, trace a bit of a session and post that.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: Stego Virus
by Robb＠SpeakOut.org 17 Dec '03

17 Dec '03

For a virus (a program) embedded in a .gif file to affect you, it would have to unsteg and then run. Just dont run it it you unsteg it. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

1 0

see you guys later
by robbhill＠southwestpaper.com 17 Dec '03

17 Dec '03

This list used to focus on privacy issues, crypto protocols, algorithms, national crypto policy, etc. I saw the Netscape cracks announced here, I saw squeamish ossifrage here, now I see nothing of the sort. Now I see that people are discussing heckling the pres., black helicopters???. I have heard Phil Zimmerman frequently call Paul Zimmerman. See you guys later. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

2 1

Anti-Racist Laws Stifle Political Liberty
by qut＠netcom.com 17 Dec '03

17 Dec '03

llurch(a)stanford.edu (Rich Graves) writes: > Incidentally, [don't college speech codes] belong in the past > tense? Stanford hardly lifted a finger to defend the Grey > Amendment, which was designed and widely regarded to be the most > carefully tailored speech code around. I don't know of any > universities that have tried to enact a speech code since. The > attempt would be futile. (Background: Grey applied only to > "fighting words" directed at individuals. It was fine, under the > [overturned] Stanford policy [which I voted against], to create a > "hostile environment" by screaming hostile verbiage at nobody in > particular; but you couldn't say the same thing to someone's face.) The mere lack of enforcement of an unjust law does not justify the continued extancy of that law. That very "dead letter" law can be fired up at any time to harass critics of the university's anti-racist administration. Some examples of dangerous dead letter laws: * Abortion Most people presume that abortion is legal in the USA, wrong. Most states make abortion very illegal, our whole abortion freedom as currently exists rests entirely on a few federal court decisions. If the previous Supreme Court decisions are overturned, most states will suddenly start enforcing their fascist anti-abortion laws. * Hate Crime Denmark used to be presumed by racists to be the only country in Europe where racism was legal. Denmark's anti-racist laws were not enforced in ages. Yet, the anti-racist laws sprung into action to persecute Gerhard Lauck, an American Nazi who desired to move to Denmark on the account of a provocateur that his organization would not be harrassed in Denmark. Mr. Lauck was deported to Germany where he was sentenced to four years in prison to the outrage of professional anti-racists of the "moderation" of his punishment for merely speaking in pro-Nazi terms in Germany, where politics that challenge the ruling order is strictly illegal. * Racism In Other Countries Racist politics are explicitly illegal in every "white country" in the world except, so far, the USA. The mere lack of enforcement in many of the countries such as South Africa, Canada, Denmark, Russian Federation, Malaysia, Australia, etc., does not exonerate that country from the charge of censorship as political intrigue. * "We Will Take Power" A lot of fake anti-censorship activists insist they are for free speech in the sense of allowing such political purposes as "we don't like your policies and we want you to change," but desiring to make illegal such political goals as "we don't like your power and we're going to try to take it away from you." Yet there is no purpose, no purpose whatsoever in political speech, if there is no threat allowed to the ruling order expressed in idealogical terms and organizational forms. Thomas Jefferson, Thomas Paine and all the nationalist founders of the American nation would approve of radicals organizing and expressing their goals of seizing power legally, or if denied the means of a republic for succession, illegally. * Unfree Nations Germany is an example of a nation that prohibits any type of Nazi political party. Therefore, Germany is not a free country, not an honest republic, in fact, less free even than Wilhelmian Germany in allowing radical parties to challenge the power structure. -- I marvel at the resilience of the white people. Their best characteristic is their desire to learn. No other people has such an obsession with the intellect.

1 0

Re: MUD anyone?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I second many of the comments about the difficulties in coding a reasonably plausible game or MUD for exploring list ideas. Just about four years ago exactly, at the first meeting of what was to become the Cypherpunks group, we "played" the "Crypto Anarchy Game." Based solely on paper tokens, like Monopoly, the idea was to introduce people to concepts like digital money, anonymous remailers, information markets, and so on. Sealed envelopes represented remailed messages, with "mixing" done by hand. Lots of imperfections, lots of stalls and dead ends, lots of confusion. Protocols were imperfectly enforced, messages got lost (literally "dropped on the floor"), and the game eventually ended in laughter, confusion, and silliness. But it was deemed useful by most present, as it made more real the abstractions talked about in the morning session. Coding nearly any of the core cryptographic concepts for use in an online game, even without a real crypto core (e.g., using other trust mechanisms) is likely to be almost as big a job as actually coding the concepts for real-world use. Could be very educational, and a useful dry run for later real-world reification of concepts, but by no means easy. I'm not trying to discourage anyone. Go for it! But it's a _big_ project. And as Jim Bell noted, there are all sorts of costs which are not properly accounted for. I would not, for example, expect anything interesting to emerge out of the simulation of "assassination politics" in such a game, as the costs, dangers, moral issues, and whatnot are not properly accounted-for in such a MUD-type simulation. (No more so than in a fantasy role-playing game, where characters die routinely...) And as a last note, we had a couple of "hits" bought anonymously back then, during the game, in '92. (Hint: One doesn't need a Bell-style infrastructure for bidding on the death of politicians to raise the money for a hit....many interested parties would surely pay the $5000 (or less, say some) to buy a hit if the risks were lowered. And to paraphrase Bell, "I know a way to lower the risks.") --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A _REALLY_ Interesting Bet [2]
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Jim Gillogly <jim(a)ACM.ORG> wrote: <snip> >Idea Futures is dead, and the torch has passed to Foresight Exchange (FX), >which is at http://www.ideosphere.com/ideosphere/ . You can bet on a number >of political issues (US and other), though not (yet) for real money. IMO, a good cypherpunk goal would be to get that "yet" in, with Chaum's Digicash, before the election. Perhaps Mr. Cate has some ideas in this regard...;) When talking to lawyers one finds the justification for the prohibition to be something like, "it would demean the process." IMNSHO, the nest has already been soiled, and the only effect would be to kill the unwanted phonecalls around suppertime, as I said before. The media would eventually flock to the more-accurate poll, even if it involved the dreaded crass freemarket capitalism of people willingly gambling. <snip> >This doesn't track the polls, which typically ask who the potential voter >would vote for rather than who they think will win the election. Indeed. Also, a prominent candidate (this time) told devotees (last time) to give wrong answers to pollsters when called. While it's still possible, this behavior is much less likely with real money (though with his kinda dough, distortions would be possible for him -- & profitable for others). >Other issues: > >Percentage of popular vote to Dem candidate: 47 >" " Rep " : 44 >" " Other " : 12 > >Note that there may be an opportunity for arbitrage when numbers don't add >up to 100; Last time there was supposedly an arbitrage opportunity between odds in Moscow and those in London [Now THAT'S my kind of bet;) -- I can't lose] according to a W$J article on the subject from years ago. 20 minutes on Alta Vista this morning reveals nothing like this available, Ladbroke's links are hardly there, and I don't know the names of any other bookies in London, or any at all in Moscow. The closest thing was a (braindead) "George" magazine article and a few sites lamenting the lack of possible Presidential gambling. AV didn't even reveal the confusing US university site where some gambling is (or was) going on. Perhaps English c-punks can help us on the odds for all candidates, including the longshots. I think publicity from freeing up this information might be more favorable than publicity about things like porn or Assasination Politics, and the process of setting up a site that reveals the odds in semi-realtime from London/Moscow should not be too difficult, especially if actual gambling is not conducted on the site.

2 1

"Undocumented Features"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:21 AM 8/29/96, Adamsc wrote: >>> >looks like the DoJ have been looking around at the mirrors.. maybe to >>> >legally hassle people about them.... > >>> Or, just maybe, some DoJ employees wanted to see what folks on the outside >>> were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits >>> the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at >>> intel.com > >Out of curiosity, has anyone used a decompiler to check if any of the >undocumented stuff is getting used in shipping programs? This has only marginal relevance to the list, but I'll mention in case it helps a crypto coder out there: be wary of _ever_ using undocumented features of a processor, compiler, or other system. Why? Because "undocumented features" are not promises made by the vendor, and may vanish in the next release (or, worse, change behavior in strange and hard-to-detect ways). We witnessed this several times at Intel with the x86 line. Various customers discovered "undocumented features," made the mistake of exploiting them, and then came crying to us when iterations of the processor (what we call "steppings") took out the "features" or altered their behavior. (And for a while there was even a rift between the Intel versions and the NEC versions, which copied some Intel processors and copied the undocumented features....when Intel was no longer supporting them, the two processor families diverged, causing chaos.) So, beware. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Announce: NCSA HTTPd 1.6b1 and XMosaic 2.6s_b1
by acain＠ncsa.uiuc.edu 17 Dec '03

17 Dec '03

Hiya! This is to announce the availability of NCSA HTTPd version 1.6b1. It is accompanied by a version of XMosaic (2.6s_b1) which can be used for testing the security features. To participate in the beta testing effort, please see http://hoohoo.ncsa.uiuc.edu/beta-1.6/ What's New: ---------- The main difference between 1.6b1 and 1.5.2 is the addition of support for the following security protocols: -- Secure-HTTP (version 1.1) -- SSL versions 2.0 and 3.0 XMosaic 2.6s_b1 supports these protocols as well. Motivation: ---------- We recognize that there are many fine web servers availble on the Internet, some even for free. In releasing NCSA HTTPd 1.6b1, we are niether trying to 'outdo' other server development efforts, nor are we expecting to provide a server which will meet all possible needs. Rather, we wish to follow through on our commitment to making novel features available for experimentation and testing. The capability of performing digital signature-based authentication (via S-HTTP in 1.6b1) is an example of a feature we see lacking in the Web today. Obtaining HTTPd 1.6b1: ----------------------- Currently, HTTPd 1.6b1 is available in binary form to registered, domestic users. An exportable version will be available eventually, and we will announce its availability by the same means. To register for beta testing 1.6b1, please go to the URL given above, and select the "register here" link after reading the page. The documentation (under construction) for this release is available at http://hoohoo.ncsa.uiuc.edu/docs-1.6/ The HyperNews page (good for bug reports, questions, discussion) is at http://union.ncsa.uiuc.edu/HyperNews/get/www/ncsa-httpd/1.6/beta.html Administrative requests may be directed to httpd-beta(a)ncsa.uiuc.edu. Thanks, Adam Cain acain(a)ncsa.uiuc.edu

1 0

RE: Desubscribe
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

perry(a)piermont.com wrote: >MrAdvent(a)aol.com writes: >> I would like you to desubscribe me from you mailing list > >I refuse. > >.pm Lets face it. It's not a lack of volition, it is a lack of ability. Perry couldn't desubscribe MrAdvent(a)aol.com even if he wanted to. I can't unsubscribe myself even when I follow the instructions. When I send an e-mail, the header contains two equivalent addresses: jbugden(a)smtplink.alis.ca and jbugden(a)alis.com. Unfortunately, there is some logic in majordomo that is not symmetric so that while I can subscribe as jbugden(a)alis.com, I can not unsubscribe since majordomo notices jbugden(a)smtplink.alis.ca in the header and treats the attempt to unsubscribe as a forgery. So get used to it MrAdvent. After a few months you may even enjoy the ramblings of the many too pale souls swimming in this communal cesspool. You can unsubscribe any time you like, but you can never leave. James

2 1

Re: MSIE cryptography
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:20 PM 8/29/96 +0000, John Hemming - CEO MarketNet wrote: >Essentially, however, I do not think it is right for a program to display a >locked key regardless of any other issues if the data being transferred >is not encrypted. I fully agree. I wonder if the FTC is interested. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Singapore Global Action Alert (8/29/96)
by Declan McCullagh 17 Dec '03

17 Dec '03

August 29, 1996 *** GLOBAL ACTION BRIEF *** * Please redistribute this document widely with this banner intact * Redistribute only in appropriate places & only until 30 September 1996 Singapore Government Curtails Online Freedoms The government of Singapore recently established strict controls on all Internet Service Providers and many World Wide Web pages. ISPs and content providers will be licensed, and required to adhere to a rigid set of content guidelines which apply to political speech, ethnic and religious remarks including satire, and public morals including "contents which propagate permissiveness or promiscuity." We believe that the licensing policy and broad content guidelines will effectively chill the free flow of information not only in Singapore, but worldwide. Because the Internet is global, transcending geographical bounds, we are convinced that censorship within any nation or state, whether implicit or explicit, poses a threat to all users of the global network. We therefore encourage the government of Singapore, and other governments implementing or considering policies of content control, to stress education rather than regulation. Singapore's approach, like the Communications Decency Act that was passed but quickly rescinded in the U.S., applies a broadcast regulatory standard to the Internet. The application of broadcast-inspired, "one-to-many" regulation to this new *many-to-many* medium indicates a fundamental misunderstanding of the nature of the Internet. Unlike television and radio broadcasting, the Internet does not push material at the viewer, but simply makes material available on demand - not unlike a rapid inter-library loan. And unlike broadcasting, the Internet does not present the views of a limited few privileged speakers, but allows all participants to publish, comment on, and even refute, what they read. Recognizing that every culture has its own standards regarding what is or is not appropriate, the undersigned organizations recommend that Singapore's government allow its citizens to use Internet filtering tools, with which they can block out any material that is offensive to them, rather than embark upon a closed-border approach that will cut Singapore off from the new global online library. Support of individually customizable filtration services, instead of a broad top-down censorship effort, would enable Singapore to participate in a more positive and effective way in the evolution of this new open medium, and would indicate trust in the ability of Singaporeans to choose what is right for Singapore and for themselves. *** WHERE TO FIND MORE INFORMATION For more information on the Singapore censorship situation, and other global efforts to abridge the flow of information over the net, see these web sites: http://www.eff.org/~declan/global/index.html and http://www.io.org/~sherlock/doom/threat.html Human Rights Watch's letter to George Yeo, Singapore Minister for Information and the arts, is located on HRW's gopher, at gopher://gopher.igc.apc.org:5000/00/int/hrw/asia/asia/4 WHO TO CONTACT The following organizations have issued this advisory: ALCEI - Electronic Frontiers Italy * http://www.nexus.it/alcei.html American Civil Liberties Union (ACLU) * http://www.aclu.org Center for Democracy and Technology (CDT) * http://www.cdt.org CITADEL-Electronic Frontier France * http://www.imaginet.fr/~mose/citadel EFF-Austin * http://www.eff-austin.org Electronic Frontiers Australia * http://www.efa.org.au Electronic Frontier Canada * http://www.efc.ca/ Elektronisk Forpost Norge (Electronic Frontier Norway) * http://www.sn.no/~efn Electronic Frontier Foundation * http://www.eff.org Electronic Privacy Information Center (EPIC) * http://www.epic.org HotWired * http://www.hotwired.com Voters Telecommunication Watch (VTW) * http://www.vtw.org Please choose an organization above and visit their web site for contact information. A copy of this advisory is available on the World Wide Web, at http://www.well.com/~jonl/singapore.html.

1 0

CyberTerrorism Thoughts
by Barry C. Collin 17 Dec '03

17 Dec '03

Dear Mr. Geiger: Thank you for your very well-thought-out presentation. That is precisely the kind of material we need to see more of in this forum. It's tough to write, but it's worth it. >From the feedback I've received, I should make this clear: regardless of criminality issues, I do not consider hacking in to a system to view things an act of terrorism (by classical or other definition). My concern, by far, is the fragility I've found with systems connected to physical processes -- processes that affect the physical world. Your segmentation of motivation and actions was excellent. I look forward to your future commentary and postings. Also, although it is sometimes difficult (myself no exception), I think you'd agree that this factual, non-flame approach gets far more work done. Your response in that manner was appreciated. Regards, Barry C. Collin -- Institute for Security and Intelligence A Non-Profit Research Institution P.O. Box 9877 Stanford, California 94309-9877 USA

1 0