December 2003 - cypherpunks-legacy

ISR on the web
by research＠isr.net 17 Dec '03

17 Dec '03

Internet Security Review is now available on the web. Have a look at http://www.isr.net ==

1 0

Re: 56 kbps modems
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

well here in Australia Telstra our national carrier only "garantees" 2400 baud to work. I live within 2km of the exchange and the best I have ever achieved was 22k/sec over the lines (usually about 18k). This is not what the modem tells you it is doing....but what you get as a result of testing the ACTUAL modem speed using a line analizer program. What a modem manufacturer says you get and what the line gives you are Totaly separate. > People who seemed to know used to say that 'the Shannon limit' >set an absolute upper limit around 40 kbps. Has Shannon been >proven wrong, or what? ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

3 2

IBM_gak
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-15-96. PcWe: "IBM Boosts Encryption Initiative " IBM security initiatives next month will include a new way to build encryption into software and technology that could enable U.S. companies to export products with strong encryption algorithms. IBM also will introduce several "key-recovery" technologies that could enable businesses to satisfy the requirement imposed by the U.S. government that it be able to access encrypted data on demand. IBM is attempting to garner industry support for the new key-recovery technology and is expected to license the technology to Netscape and Sun. 9-13-96. BuWi: "Revolutionary Intranet security product to be demonstrated at Interop DotCom " DSN's NetFortress fully automates hardware-based authentication, encryption and key exchange into a plug and play solution. It completely eliminates the possibility of IP spoofing, eavesdropping and break-ins. "After installing it, I couldn't even tell which service a given packet was from - everything but the packet header itself was rendered undecipherable as it traversed the Internet." DSN Technology was founded by Dr. Aharon Friedman and Andy Savas. ----- http://jya.com/ibmgak.txt (6 kb for 2) IBM_gak

5 4

Re: Juno Newbies are Great!
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 14-SEP-1996 07:37:07.81 >- it's free. Anybody can get on it. Easily. Anonymously, more or less, > since they don't need to have your whole credit history > to be able to charge you money. At most you need a maildrop. As has been previously pointed out, this also makes it nice for disposable remailer front ends. Is anyone currently working on this project? -Allen

1 0

Re: What is best policy paper on crypto?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 7:18 PM 9/12/96, Gregg Cooke wrote: .... > > I'm gonna stick my neck out here and ask a naive question: where > can I find "the NAS report" mentioned in this thread? Note that > I'm new to this list (2 days) so please be kind if this paper is > extremely well known (it's not known to me but it sounds like > something I need to read). > > -Gregg I think that they meant the NRC (National Research Council) report. It is at: <http://pwp.usa.pipeline.com/~jya/nrcindex.htm>.

1 0

Mobile IP URL typo
by John Gilmore 17 Dec '03

17 Dec '03

> >locations. See http://www.ietf.org/html-charters/mobileip-charter.html, > >or search for "Mobile IP" in a web search engine. > That URL got 404-NotFound... s/-/. http://www.ietf.org/html.charters/mobileip-charter.html John

1 0

Pipeline Up
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Cancel that poop about Pipeline being down. Seems only NYC is down. Access is OK through PSInet. jyy(a)gnn.com is for top secret black SIGINT only, okay?

1 0

Cryptography of a sort - redux
by Dale Thorn 17 Dec '03

17 Dec '03

If anyone remembers my original postings from a couple weeks ago (my first-ever on The Net), I described a method to "shuffle" bits in a text-stream, using simple random-number generators, to insure that the text cannot be descrambled by brute-force methods. It has occurred to me only after this time that there was significant misinterpretation of what I proposed. I do not change any bits of text, I merely reposition them, therefore there is no applicability of standard analysis techniques (XOR masking, whatever) to the decoding process. The result file contains the same number of zero and one bits as it started with, through any number of encryption layers. The only way to recover the original text is to reposition the shuffled bits correctly, which requires brute-force guessing of the pseudo-random-number output. This guess is very simple for the first encoding layer, but compounds exponentially in subsequent encodings, so that after half a dozen or a dozen passes, where the executable program(s) is called from scratch for each pass, the shuffling rapidly approaches true randomness, and cannot be decrypted in practice except through the exact mirror-image reversal of the encryption passes. An example: How long would it take for you to guess the number (between 0 and 32000) I'm thinking of, if you could guess 16 billion numbers per second? Would it be .000001 second, on average? If you had to guess the ten different numbers I'm thinking of, and get all ten correct sequentially, it should take an essentially infinite amount of time, yes? And remember, since computer bits have such low differentiation (ones and zeros), looking for "patterns" and so forth just doesn't apply in this type of encryption. As to the Public Key part of the argument, once there is general understanding on the above points at large, it might then be worthwhile to discuss the advantages and disadvantages of how to make/distribute Private keys, etc. One gentleman on this forum made an argument recently, something to the effect that it wouldn't be worthwhile for Hacker X to try to break into datastream Y, assuming datastream Y is encoded with such-and-such a key, that datastream Y is sufficiently unimportant, and motive for such a breakin would not be great enough to justify the expected effort. To such arguments, all I can say is, this is the computer age, and enough mundane transactions can add up to something significant, or, one could lower the expected-effort ratio, you get the picture.

2 1

Re: Workers Paradise. /Political rant.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:43 PM 9/15/96, attila wrote: > NO, it does not need to be or do either, BUT, it means > that everybody independently attempts to succeed and the > 'community' takes care of itself --and in the standard > sense, the ne'er do wells fall off the path of *their own > free choice.* There will always be sickness and calamity, > but that is what the community is for. > > BTW, it still works today; I live in one of 'em. And lest there be any doubt, I _do_ support certain kinds of charities, and will not of course stop anyone from practicing charity. While I have no religious beliefs to speak of, I strongly support the mechanisms some churches have for taking care of their own members, recruits from the street, etc. (Including Salvation Army and "mission" sorts of inner city things--note of course that most such entities also insist on prayer and/or Bible readings as part of the deal...I wonder how long it will be before a class action lawsuit is filed to stop the prayer part? This would effectively shut the missions down, of course.) The thing about _traditional_ charity, of the religious or community sort, was that it was not treated as an "entitlement," as something the resentful masses could "demand" as part of their "human rights." A parish priest, for example, might extend charity to a poor person, or a widow, or whatever, but not to an able-bodied person who simply decided to not work. Nor to an unmarried woman who kept getting pregnant and having more mouths to feed. (I surmise that most such women either died of diseases related to sexual promiscuity, died in childbirth, died of disease brought on by malnutrition, or ended up in convents (Catholic birth control).) The point is that even in an "age of charity," strings have to be attached by the givers of charity. People will simply not give 40-60% of what they earn to support a growing population of people who say it's their "right" to welfare, AFDC (Aid to Families with Dependent Children), WIC (Women, Infants, and Children), food stamps (*), and suchlike. (At certain supermarkets I sometimes shop in on the way back to my town, people in front of me in line put their nice cuts of meat down, their fine loaves of bread, their frozen dinner entrees, their "Ben and Jerry's Ice Cream," and then pay for it with books of blue "Department of Agriculture" food stamps. They use their own cash (perhaps gotten by cashing their welfare and "disability" checks) to buy their smokes and booze, as food stamps are not allowed to be spent on this stuff. My impression is that they eat more expensive food than I do, perhaps because they're buying the food with "play money," whereas I'm buying my food with money that's what's left after I had to pay 40-50 taxes, so I seek to economize when I can!) > Now, I don't intend to be Scrooge, but I'll fight for my > rights to cut off at the knees the knee-jerk liberals and > government slavemeisters who want to tell me that I, and > 2 others are required to support 100 freeloaders. And speaking of Scrooge, I like "A Christmas Carol" about as much as anyone I know, and try to take the lesson of what Scrooge learned as a general lesson about life and living it. (As with "Robin Hood," the message is often confused. Robin Hood was not "stealing from the rich," he was taking back what was stolen from the peasants and farmers by the King and his tax collectors, notably the Sheriff of Notingham. At least this is how I read the myth.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 10

The Living and the Dead
by jya＠pipeline.com 17 Dec '03

17 Dec '03

For the vets unable to sleep: The Washington Post has two heart-breaking pieces today on a new book about Vietnam, "The Living and the Dead: Robert McNamara and Five Lives," by Paul Hendrickson. The book tracks the disaster being formulated in 1965 by DC top-down policy interleaved with savagery to five grunts in bloody battle. There's a laudatory review of the grim book, and a long magazine piece gives an excerpt which includes some of Life's photos of a Marine copter gunner's transition from happy-go-lucky, to butchery of buddies, to grief-stricken collapse. It reawakens what's never forgot. That April, 1965, Life photo-essay, "One Ride With Yankee Papa 13," turned up in a sidewalk stall today so we'll put 18 photos on our Web page for a glimpse back to the future of power-mad policy begetting slaughter. http://jya.com/yp01.jpg through http://jya.com/yp18.jpg

1 0

Re: The Living and the Dead
by jim bell 17 Dec '03

17 Dec '03

At 01:54 AM 9/16/96 GMT, John Young wrote: > The Washington Post has two heart-breaking pieces today > on a new book about Vietnam, "The Living and the Dead: > Robert McNamara and Five Lives," by Paul Hendrickson. > > The book tracks the disaster being formulated in 1965 by > DC top-down policy interleaved with savagery to five > grunts in bloody battle. > > There's a laudatory review of the grim book, and a long > magazine piece gives an excerpt which includes some of > Life's photos of a Marine copter gunner's transition from > happy-go-lucky, to butchery of buddies, to grief-stricken > collapse. It reawakens what's never forgot. > > That April, 1965, Life photo-essay, "One Ride With Yankee > Papa 13," turned up in a sidewalk stall today so we'll > put 18 photos on our Web page for a glimpse back to the > future of power-mad policy begetting slaughter. ObAP comment: A few weeks ago, the tv show "60 Minutes" ran an item about a group of Jews who, after the end of WWII, vowed revenge on the Nazis, down to German soldiers, plotting to kill as many as they could. In their biggest coup, they killed hundreds of Germans in a POW camp by poisoning their bread. My reaction? As you might expect, I think that the main thing they did wrong was to not kill enough of them, but more particularly to not target the higher-ups. The way I see it, the fundamental reason that people will continue to participate in holocausts, even today, is that they see no real prospect of being punished for their crimes. Unfortunately, society has been conditioned if not to "forgive and forget," at least to not punish where it has an opportunity to punish. I suggest that this is no accident: It is in the interest of tyrants everywhere to let the other guy off easy, lest he be in the same position someday. This is why numerous African and South American dictators were allowed to "retire" in peace, rather than being killed. How would an AP-type system treat Robert McNamara? He'd be dead in a second. To those who say, "What good would this do?" I respond: Anyone in the American government today who is considering an adventure which MIGHT turn into another Vietnam should be deterred by the knowledge that sometime, in 30 minutes or 30 years, he could be killed for what he did. Robert McNamara, presumably, did what he did because he thought he'd never be punished. The best way to deter future governmental abuse is to remind these people that they _will_ be punished. Jim Bell jimbell(a)pacifier.com

2 1

Re: The Living and the Dead
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 16, 1996 01:54:40, 'jya(a)pipeline.com (John Young)' wrote: >18 Nam photos on our Web page for a glimpse back to the >future of power-mad policy begetting slaughter. Corrected URL's: http://pwp.usa.pipeline.com/~jya/yp01.jpg through http://pwp.usa.pipeline.com/~jya/yp18.jpg

1 0

Re: Kiddie porn on the Internet
by James A. Donald 17 Dec '03

17 Dec '03

[Allegations that "save the children" is a political organization providing cover for an effort to ban cryptography] At 01:54 PM 9/9/96 -0400, Hallam-Baker wrote: > Their main mission is sending food to Ethiopia and other famine > areas, development work etc. It is ultra-worthy stuff. Not everyone who sends food to the starving children is ultra respectable. Problem is that the usual cause of starving children is tyranny. In order to get close enough to the starving children to take those cute fund raising photographs you have to pay off and get cosy with tyrants. This creates a moral hazard, in that it is hard to tell the difference between normal bribery needed to do anything in a tyrannical state, and bribery to bribe tyrants to create starving children for photo ops. It is very common for international charities to develop excessively friendly relationships with murderous tyrannies, Monsters do not generally sport horns and a tail. More commonly they walk around on two legs with large neon halos prominently displayed. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

ComLaw> Down South
by jim bell 17 Dec '03

17 Dec '03

Cross-post from commonlaw(a)teleport.com At 09:11 PM 9/15/96 -0400, James M. Cobb wrote: > 09 14 96 Associated Press distributes a newsstory headed: > > MEXICAN REBELS WARN OF MORE 'SELF-DEFENSE' ATTACKS > AGAINST GOVERNMENT > Points from the newsstory: > Leaders of a violent new rebel group are vowing to > press their war on Mexico's military and police.... > > [Last month's] raids were the most widespread guerril- > la attacks in Mexico in decades. > > ...during the news conference, the rebel leaders... > said that...bomb threats issued since last month's at- > tacks were part of an outside campaign to discredit the > group. > > They said their targets will continue to be government, > not civilian, sites. > Please note that word: OUTSIDE. > > Imported from Atlanta. > "Overnight" via NAFTA Express: > [The rebel group's statement] cited "the TERROR and > desperation caused by unemployment, the drastic reduc- > tion of the buying power of salaries, the lack of at- > tention to health, education and housing." > Cordially, > Jim > NOTE. The AP newsstory's www.nando.net online filename: > > world2_15734.html > I capitalized the Clinton-word in the last quota- > tion. > This critical essay was composed 09 15 96. >From what has appeared in the American media about this new Mexican rebel group, I'm particularly pleased with them. This is exactly the kind of alternative that we need to the stereotypical, "kill lotsa innocent citizens" attacks which are often associated with the term terrorism. They make it clear that they specifically target soldiers, police, and other government employees. After reading a couple of articles, it is obvious what they need: A method to prevent spoofing of their communiques, a function that PGP could do quite easily. Jim Bell jimbell(a)pacifier.com

1 0

Re: SPL -- Suspicious Persons List
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:04 PM 9/15/96 -0400, Phill <hallam(a)ai.mit.edu> wrote: >> Work for the competition, or start your own company. >Easy enough for you or me who can charge the minimum wage rate >for an hour for a period more like a minute. In this part of California, most yard work is done by small companies run by guys named Jose or Pablo, who can charge maybe 2-3x minimum at most before the competition undercuts them. And they have to worry about blacklists also - "business licenses" and "immigration papers". >... >Being opposed to government slavery isn't enough. Coorporate slavery >is just as bad. Unless people are enfranchised ecconmically as >well as politically the political liberties don't matter much. It's not corporate slavery when you don't have to work for them. >I am on an SPL that is run by an organisation called the "Ecconomic >League". It is an organisation run by the UK Conservative party >which keeps lists of "unsafe" employees. Of course the list is (Just because I don't believe in the concept of "corporate slavery" doesn't mean I don't think corporations can be offensive. This sucks...) Out of curiousity, I thought the UK had Data Privacy Laws or some sort of Database Cops - does that not apply to applications like this? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

3 2

"But if it saves just one child."
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:51 PM 9/15/96, James A. Donald wrote: ... >Not everyone who sends food to the starving children is ultra >respectable. > >Problem is that the usual cause of starving children is tyranny. ... >It is very common for international charities to develop excessively >friendly relationships with murderous tyrannies, But there is a simple rationale for this behavior... The rallying cry heard so often these days: "But if it saves just one child." Hence the moves to ban guns, the moves to ban cigarettes, the moves to remove violent scenes from movies, books, and video games, and, yes, the close alliances between Save Our Children and the Idi Amins of the world. (Hillary also thinks it takes a village to save the children.) --Tim May, who think GAK and Position Escrow are justified if they save but one child's life. We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: Internet Drivers' Licenses
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From paul(a)fatmans.demon.co.uk Mon Sep 16 05:27:03 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Mon, 16 Sep 96 07:19:42 EDT for dlv Received: from relay-4.mail.demon.net by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA14516 for dlv(a)bwalk.dm.com; Mon, 16 Sep 96 05:27:03 -0400 Received: from post.demon.co.uk ([(null)]) by relay-4.mail.demon.net id ak19721; 15 Sep 96 11:16 GMT Received: from fatmans.demon.co.uk ([158.152.120.223]) by relay-3.mail.demon.net id aa23486; 15 Sep 96 11:02 BST Received: from fatmans.demon.co.uk by fatmans.demon.co.uk with SMTP id AA842733091 ; Sat, 14 Sep 96 20:31:31 +0000 Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> From: paul(a)fatmans.demon.co.uk To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> Date: Sat, 14 Sep 1996 20:31:31 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Subject: Re: Internet Drivers' Licenses Priority: normal X-Mailer: Pegasus Mail for Windows (v2.31) Message-Id: <842781779.23486.0(a)fatmans.demon.co.uk> > mpd(a)netcom.com (Mike Duvos) writes: > > A given key could mean "I am Mike Duvos", "I am Tim May" > > Fart. How long is it going to take for you to grow up you trailer butt-fucker? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: 56 kbps modems
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

That I realize that baud and bit/sec are not the same, but I feel you would have a hard time getting a 56k modem to work on a line that does not support 28.8k fully, let alone 33.6k. A leased line (copper pair) from telstra only supports 9.6k and costs close to ISDN. When the telco reinstalls the literal tons of copper cable that we have lying underground for at least 20 years in some instances that connects the exchanges, and replaces this with optic fibre preferably, or at least higher bandwidth co-ax, we will not have 28k even. In the states you have better lines and ISDN is far less expensive. For two B channels perminantly connected I have to pay about $2500/month in this country. Not many home users can pay this, thus they have to still use modems. With the lack of bandwidth to and from the exchanges, there is not a chance in hell a 56k modem will work in this country for many years. (Australia - the lucky country...not in regards to bandwidth) > As I am sure has been discussed at length before, baud does not equal > bps. AFAIK, V32bis is only 2400baud. ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

2 1

Re: Email Robot draws fire from CypherPunkz
by peter＠baileynm.com 17 Dec '03

17 Dec '03

Sneck. The points I get out of this: 1. Cypherpunks lives up to its name. Mainly, the second part. 2. Whether an email spam is business related or not, it's neither desirable or interesting. Two years ago having a robot like that might have been amusing. Now it's just another spam. 3. Y'all really oughta read Stand on Zanzibar again. I think you're missing the point.

1 0

New Remailers?
by an401dws＠gold.ac.uk 17 Dec '03

17 Dec '03

OK dont shoot me, im new to this list so please Bear with me: I recently secured an account with anon.penet and then a few days later got a post informing me that the servive was now terminated. Anybody out there know of any remailers where you dont have to have a Phd in computer science and a thorough working knowledge of PGP in order to operate? Also, are there any remailers which will accept binary attachments? doug

1 0

Re: "Remailers can't afford to be choosy"
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > Umm.... freedom of the press is freedom for he who owns the press. > >The remailer operators own the presses; why shouldn't they use whatever means > >they see fit to determine how they can be used? I encourage people not to > >discriminate on the basis of the political orientation of what's going > >through... but spam isn't political speech. (I agree that the government > >should not be in the business of determining what is spam and what is > >political speech - all speech should be protected - but remailer operators > >are not governments.) The point here, I think, that we are failing to see is that the remailers are run on private machines and bandwidth, when you use a remailer you are a guest on someone else property, your mail is using their bandwidth etc. They can determine how they like how they are used, I just hope most of us will have the strength of conscience to refrain from using remailers which censor or restrict their throughput, I agree that spam is a different question but we do have our own way of dealing with this, just mailbomb the senders, if they are commercial they are likely to leave an address or telephone number on the spam even if the email address is anonymized, we have ways ;-) <haha evil nazi grin forms on face> Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

1 0

New type2.list/pubring.mix
by John Perry 17 Dec '03

17 Dec '03

PGP message

1 0

Re: China joins Singapore, Germany, ....
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From paul(a)fatmans.demon.co.uk Mon Sep 16 04:22:40 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Mon, 16 Sep 96 07:19:49 EDT for dlv Received: from relay-4.mail.demon.net by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA11172 for dlv(a)bwalk.dm.com; Mon, 16 Sep 96 04:22:40 -0400 Received: from post.demon.co.uk ([(null)]) by relay-4.mail.demon.net id ak07550; 15 Sep 96 13:11 GMT Received: from fatmans.demon.co.uk ([158.152.120.223]) by relay-3.mail.demon.net id aa23307; 15 Sep 96 11:02 BST Received: from fatmans.demon.co.uk by fatmans.demon.co.uk with SMTP id AA842732056 ; Sat, 14 Sep 96 20:14:16 +0000 Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> From: paul(a)fatmans.demon.co.uk To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> Date: Sat, 14 Sep 1996 20:14:14 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Subject: Re: China joins Singapore, Germany, .... Priority: normal X-Mailer: Pegasus Mail for Windows (v2.31) Message-Id: <842781740.23307.0(a)fatmans.demon.co.uk> > > Nazi POWs were Nazis and deserved to be killed. Likewise, American soldiers > are murderous scum. I wish Saddam Hussein the best of luck in killing every > American he can get. > > P.S. Please do not cc: me. Fuck you. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Internet Drivers' Licenses
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From paul(a)fatmans.demon.co.uk Mon Sep 16 04:17:55 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Mon, 16 Sep 96 07:19:56 EDT for dlv Received: from relay-4.mail.demon.net by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA10926 for dlv(a)bwalk.dm.com; Mon, 16 Sep 96 04:17:55 -0400 Received: from post.demon.co.uk ([(null)]) by relay-4.mail.demon.net id ak19657; 15 Sep 96 11:16 GMT Received: from fatmans.demon.co.uk ([158.152.120.223]) by relay-3.mail.demon.net id aa23377; 15 Sep 96 11:02 BST Received: from fatmans.demon.co.uk by fatmans.demon.co.uk with SMTP id AA842732060 ; Sat, 14 Sep 96 20:14:20 +0000 Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> From: paul(a)fatmans.demon.co.uk To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> Date: Sat, 14 Sep 1996 20:14:14 +0000 Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Subject: Re: Internet Drivers' Licenses Priority: normal X-Mailer: Pegasus Mail for Windows (v2.31) Message-Id: <842781757.23377.0(a)fatmans.demon.co.uk> > This is the kind of project cypherpunks would do if they were writing code, > instead of lies and personal attacks, the way Tim May (fart) does. Is a Tim May reference compulsory in all of your postings you stupid little man? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: > Crypto Anarchy means getting rid of deadwood the old-fashioned way. dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: >Starting with the lying old fart himself. You shouldn't be so hard on Tim. I tried giving up farting years ago but I found I gained a lot of weight. It's also become more socially acceptable as evidenced by the new farting section in many English pubs. They even have a special section for me on some international flights. And unlike smoking, you *can* do it in the toilet. Besides, it can't be worse than smoking. Unless, perhaps, you do both at the same time... Cheers, James

2 1

Re: 56 kbps modems
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Sep 16 15:59:53 1996 I think I have to throw in some words here, too: 1. BAUD is one distingushable signal form. 2. BPS is bits per second 3. NO transmission over a standard phoneline can have more than 3100 baud, because the frequency of anything transmitted over that line is band limited to 300hz - 3400hz. (If you have ISDN it's not relevant anyway, since you are fixed with 8000hz or 64000 bps->in europe :), 56000 bps in usa) 4. Most modern transmission schemes work with multiple bits per baud. I.e. you transmit 10 bits in one baud if you have a 31000 bps modem. the only limitation in transmission speed is the amount of binary values you can pack into one baud. that on the other hand is limited by the S/N (signal to noise) ratio of your line. If you have a noise of 0.9%, you can't use more than 100 steps or you have ambiguous signals. since people talk about 56000 bps modems (we tried 34000 modems here and they couldn't produce more than 28800 on a very good connection) that would mean, that you have to transmit 18 bits = 262144 (!) distinguishable signal forms per baud. Comments? Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMj1dWhFhy5sz+bTpAQHmVAgAqRHydyZdElXlwMSgdKB6hg1fDBCMfhia JoI5W8n0JLcKe9HYN/H0DPqFHHDIATEhlN3b3OIhYCw52cNJ/e3b9Nbp5RQo+sDX zAogz5wZiDV7EA/gL589lNQZ9VKHlgTYBLzu1tqyJ5cD2KhWEUjvXyN4lYuxcEQT NIaiNPeYXrC0BeoLa/AE8mCrtu+7nhxy5HlSjDiu3lEYaVygKIPQHM3+Ljzq0jkq bmbqJbTyZshos+5gxHyXLsbL8rkpST53YT4Z3clL6PCv1ntNGXtb/loWgIDallYJ bHgfh/bAS5Utg7fpzuVNS8AJV8L2VLirScBd4Bq5RAXZxnoTVVQxOw== =9JSI -----END PGP SIGNATURE-----

5 4

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash ksub latent cut ek mix reord"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. Last update: Mon 16 Sep 96 6:48:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- exon remailer(a)remailer.nl.com *#**##*#***# 1:16 100.00% jam remailer(a)cypherpunks.ca *****++***** 17:07 99.99% squirrel mix(a)squirrel.owl.de -+++---++++ 2:04:26 99.98% mix mixmaster(a)remail.obscura.com +++++++++--+ 1:01:22 99.98% lead mix(a)zifi.genetics.utah.edu + -++*++++++ 41:18 99.84% amnesia amnesia(a)chardos.connix.com ----------- 3:38:09 99.82% dustbin dustman(a)athensnet.com -+ ++----+ 1:24:30 99.74% cyber alias(a)alias.cyberpass.net * **+ ++*+ * 33:26 99.37% extropia remail(a)miron.vip.best.com ------.--.- 13:13:34 99.13% haystack haystack(a)holy.cow.net *###-#*##### 3:35 98.87% middle middleman(a)jpunix.com -- - --+ 2:53:19 98.74% replay remailer(a)replay.com ****+* ***** 4:45 98.13% winsock winsock(a)c2.org --- -+--++ 1:20:34 97.83% balls remailer(a)huge.cajones.com ******** * 5:06 88.34% nemesis remailer(a)meaning.com * 24:33 4.73% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) wrote: >"Saving for a rainy day," whether saving, investing, getting an education (while others are out partying), preparing, etc., all takes effort and commitment. If those who save and prepare are then told they have to pay high taxes to support those who partied....well, the predictable effect [...] is _more_ people in agony. When you tell people that a compassionate society will meet their basic needs, a predictable fraction of them will choose not to work hard and prepare themselves. Two questions, two observations: Do you have health insurance? Do you have life insurance? I have commented on your line of reasoning before and and it still seems to me that an important part of the discussion is missed. Specifically, that anyone can "save for a rainy day" and still not be able to provide for events that can always happen: Heart attack, stroke, car accident, pinched nerve that leaves you in excruciating pain and unable to work for several years. I don't think that a reasonable person would argue that medical insurance should be outlawed because everyone should take care of their own needs. A social safety net is simply a form of health and life insurance. Statistical arbitrage if you will. By spreading the risk you minimize the cost. Yes, some people will take advantage of the system. But like a virus, a robust system should be able to withstand this form of attack. I'm reminded of a Bloom County cartoon with Opus, Steve Dallas and Bill the cat sitting on a park bench as a jogger runs past. he derides the trio saying, "I jog three miles and work out every day, eat only healthy foods, and have regular medical checkups. I'll live twice as long as you lazy slobs." In the next panel the jogger is hit by lightning as the trio on the bench look on in shock. The last panel: "Here's to no guarantees!" and "Pass the ding dongs." Prend soin, James [Bible excerpt awaiting review as a motivation for human decency.] The ground of a certain rich man brought forth plentifully: And he thought within himself, saying, What shall I do, because I have no room where to bestow my fruits? And he said, This will I do: I will pull down my barns, and build greater; and there will I bestow all my fruits and my goods. And I will say to my soul, Soul, thou hast much goods laid up for many years; take thine ease, eat, drink, and be merry. But God said unto him, Thou fool, this night thy soul shall be required of thee: then whose shall those things be, which thou hast provided? [excerpted from Luke 12:16-20, King James Version]

4 3

Re: Workers Paradise. /Political rant.
by Rick Smith 17 Dec '03

17 Dec '03

Asgaard wrote: : .... But suppose the population problem could : be fixed. Then, with technology escalating towards singularity, : machines doing almost all labor, there could certainly exist a : system where the 'dumb' and 'lazy' could be fed and housed properly : without anybody complaining. I'm always fascinated when people trot out this notion of technology giving us a maintenance free world that provides all our needs. Like Rifkin's "End of Work." I'm sorry but I just don't see how the problems of food and shelter are solved simply because we've automated the production of bank statements. All the really effective automation has involved symbolic activities, not the basic stuff of life, like food and shelter. : P.S. Mac Donalds could easily be replaced by a bot. Very unlikely. Despite the incredible degree of mechanization that happens in food production, *most* of it requires people in the loop. Part of it is health concerns -- you're far more likely to poison a significant portion of the population if you don't keep active human involvement in food production. But there's also a lot having to do with the structure of the work. You *can't* send a robot tractor into the fields and expect it to treat your corn right. And milking machines, well .... I did a lot with fault tolerance and industrial robotics in a previous life. Robots work fine in highly structured environments. Their value decreases dramatically as you remove structure. In unstructured environments they're either useless or just plain dangerous. Even the so called "industrialized" farms are wildly unstructured compared to a factory floor. And there's little reason to assume that 'biological units' (plants and animals produced for food) in a fully structured factory-like setting will yield all the products necessary for an adequate food supply. It seems that whenever we develop a "complete" model of what people need to survive and subject a few people to it, we discover that something fatal has been left out. : But to force people into menial service jobs just to literally : survive is not to my taste. No, give them minimal shelter for : nothing and from there on let the market anarcho-capitalistic : struggle begin, for obtaining a higher than minimum material : standard or reputational standing. I suspect that the Real World will always require a large portion of the available labor pool to do work that supports the production of food and shelter. The support has gotten pretty indirect in modern industrialized countries, I admit. Rick. smith(a)sctc.com

1 0

RE: Workers Paradise. /Political rant.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:18 PM 9/16/96, jbugden(a)smtplink.alis.ca wrote: >I don't think that a reasonable person would argue that medical insurance >should >be outlawed because everyone should take care of their own needs. A social >safety net is simply a form of health and life insurance. Statistical arbitrage >if you will. By spreading the risk you minimize the cost. Yes, some people will >take advantage of the system. But like a virus, a robust system should be able >to withstand this form of attack. I have never argued against insurance! People who wish to buy insurance are welcome to, obviously. As to the "social safety net," things are far, far beyond a simple safety net. When 14-year-old pregnant inner city girls are given money to set up their own households (cf. Charles Murray's "Losing Ground"), this is not a "safety net," this is subsidized breeding. And so on. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: IBM_gak
by declan＠well.com 17 Dec '03

17 Dec '03

> 9-13-96. BuWi: > > "Revolutionary Intranet security product to be > demonstrated at Interop DotCom " > > DSN's NetFortress fully automates hardware-based > authentication, encryption and key exchange into a > plug and play solution. It completely eliminates the > possibility of IP spoofing, eavesdropping and > break-ins. "After installing it, I couldn't even tell > which service a given packet was from - everything but > the packet header itself was rendered undecipherable > as it traversed the Internet." DSN Technology was > founded by Dr. Aharon Friedman and Andy Savas. Thanks, John, for forwarding. I spoke with the DSN folks today. They developed NetFortress in the U.S. and have recently found a substantial overseas market for it. "That's definitely a problem for us. We're actively lobbying senators to pass procode, to get it out of committee." Since of course multinationals would be unwilling to use DSN stuff under current export-control regime. -Declan

1 0

Snake Oil FAQ 0.4 [comments appreciated]
by C Matthew Curtin 17 Dec '03

17 Dec '03

The Snake Oil FAQ version 0.4 is waiting for you to look at it and comment on http://research.megasoft.com/people/cmcurtin/snake-oil/snake-oil-faq.html The text version follows... -matt --------------------------- snake-oil-faq ---------------------------- Snake-Oil Warning Signs Encryption Software to Avoid $Id: snake-oil-faq.html,v 0.4 1996/09/16 13:52:26 cmcurtin Exp $ Distribution Please do not distribute this beyond the circles of cryptographic competence yet. This is an incomplete work-in-progress. Feedback is greatly appreciated. The Snake Oil FAQ is (to be) posted monthly to cypherpunks, sci.crypt, alt.security, comp.security, and comp.infosystems. We're targeting those who have influence over or direct involvement in the purchasing decisions of computer security software and equipment in the corporate and academic worlds, as well as individual users who wish to assert their privacy through the use of good cryptography. Disclaimer All contributors' employers will no doubt disown any statements herein. We're not speaking for anyone but ourselves, based on our own experiences, etc., etc., etc. This is a general guideline, and as such, cannot be the sole metric by which a security product is rated, since there can be exceptions to any of these rules. (But if you're looking at something that sounds familiar on several of the 'things to watch out for,' you're probably dealing with snake oil. From time to time, a reputable and decent vendor will produce something that is actually quite good, but will use some braindead marketing technique, so be aware of exceptions.) Every effort has been made to produce an accurate and useful document, but the information contained herein is completely without warranty. If you find any errors, or wish to otherwise contribute, please contact the document keeper, C Matthew Curtin <cmcurtin(a)research.megasoft.com> Introduction Good cryptography is an excellent and necessary tool for almost anyone. However, there is a multitude of products around. Many good cryptographic products are available, both commercial (including shareware) and free. However, there are also some extremely bad cryptographic products (known in the field as "Snake Oil"), which not only fail do their job of providing security, but are based on, and add to, the many misconceptions and misunderstandings surrounding cryptography and security. Superficially, it is difficult for someone to distinguish the output of a secure encryption utility from snake oil: both look garbled. The purpose of this document is present some obvious "red flags" so that people unfamiliar with the nuts and bolts of cryptography can use as a guideline for determining whether they're dealing with snake oil or the Real Thing. For a variety of reasons, this document is general in scope and does not mention specific products or algorithms as being "good" or "Snake Oil". When evaluating any product, be sure to understand what your needs are. For data security products, what do you need protected? Do you want an archiver that supports strong encryption? An E-mail client? Something that will encrypt on-line communications? Do you want to encrypt an entire disk or partition, or selectively some files? Do you need on-the-fly (automatic) encryption and decryption, or are you willing to select when and which files you want encrypted? How secure is "secure enough?" Does the data need to be unreadable by third parties for 5 minutes? One year? 50 years? 100 years? Different products will serve different needs, and it's rare that a product will serve every need. (Sometimes a product won't be needed: it may be better to use a utility to encrypt files, transmit them over a network using standard file transfer tools, and decrypt them at the other end than to use a separate encrypted utility in some cases.) Some basics The cryptography-faq (found at ftp://rtfm.mit.edu/pub/usenet/cryptography-faq/) is a more general tutorial of cryptography, and should also be consulted. In an effort to make this FAQ more complete, some very basic topics are included below. Conventional vs. Public Key Cryptography There are two basic types of cryptosystems: symmetric (also known as "conventional," sometimes also called "private key") and asymmetric (public key). Symmetric ciphers require both the sender and the recipient to have the same key. That key is applied to encrypt the data by the sender, and again by the recipient to decrypt the data. Asymmetric ciphers are much more flexible, from a key management perspective. Each user has a pair of keys: a public key and a private key. The public key is shared widely, given to everyone, while the private key is kept secret. If Alice wishes to mail Bob some secrets, she simply gets Bob's public key, encrypts her message with it, and sends it off to Bob. When Bob gets the message, he uses is private key to decrypt the message. Asymmetric cryptosystems are much slower than their symmetric counterparts. Also, key sizes must be much larger. See the cryptography FAQ for a more detailed discussion of the topic. Key Sizes Some ciphers, while currently secure against most attacks, are not considered viable in the next few years because of relatively small keysizes and increasing processor speeds (making a brute-force attacks feasible). The tables below should give some general guidelines for making intelligent decisions about the key length you need. If the key is too short, the system will be easily broken, even if the cipher is a good one. In [1] and [2], we're presented with some guidelines for deciding appropriate key length. (It is important to note that this is based on the ability to predict computing power 40, 65, and 100 years from now. Major breakthroughs in computing power 30 years from now might render everything on this chart kiddieplay.) Security Requirements for Different Information Type of Traffic Lifetime Minimum [Symmetric] Key Length Tactical military information minutes/hours 56-64 bits Product announcements, mergers, interest rates days/weeks 64 bits Long-term business plans years 64 bits Trade secrets (e.g., recipe for Coca-Cola) decades 112 bits H-bomb secrets >40 years 128 bits Identities of spies >50 years 128 bits Personal affairs >50 years 128 bits Diplomatic embarrassments >65 years at least 128 bits U.S. Census data 100 years at least 128 bits As mentioned earlier, asymmetric ciphers require significantly longer keys to provide the same level of security as their symmetric cipher counterparts. Here is a comparison table, again, from Applied Cryptography, second edition. Symmetric and Public-Key Lengths With Similar Resistance to Brute-Force Attacks Symmetric Key Length Public-key Key Length 56 bits 384 bits 64 bits 512 bits 80 bits 768 bits 112 bits 1792 bits 128 bits 2304 bits Some Common Snake-Oil Warning Signs The following are some of the "red flags" one should watch for when examining an encryption product * Technobabble The vendor's description of the product may contain a lot of hard-to-follow use of technical terms to describe how the product works. If this appears to be confusing nonsense, it may very well be (even to someone familiar with the terminology). Technobabble is a good means of confusing a potential user and masking the fact that the vendor doesn't understand anything either. A sign of technobabble is a descrption which drops a lot of technical terms for how the system works without actually explaining how it works. Often specifically coined terms are used to describe the scheme which are not found in the literature. * New Type of Cryptography? Beware of any vendor who claims to have invented a "new type of cryptography" or a "revolutionary breakthrough". Truly "new break-throughs" are likely to show up in the literature, and many in the field are unlikely to trust them until after years of analysis, by which time they are not so new anymore. Avoid software which claims to use 'new paradigms' of computing such as cellular automata, neural nets, genetic algorithms, chaos theory, etc. Just because software uses to different method of computation doesn't make it more secure. Anything that claims to have invented a new public key cryptosystem without publishing the details or underlying mathematical principles is highly suspect. Modern cryptography, especially public key systems, is grounded in mathematical theory. The security is based on problems that are believed, if not known to be hard to solve. The strength of any encryption scheme is only proven by the test of time. New crypto is like new pharmaceuticals, not new cars. * Proprietary Algorithms Avoid software which uses "proprietary" or "secret" algorithms. Security through obscurity is not considered a safe means of protecting your data. If the vendor does not feel confident that the method used can withstand years of scrutiny by the academic community, then you should be wary of trusting it. (Note that a vendor who specializes in the cryptography may have a proprietary algorithm which they'll show to others if they sign a non-disclosure agreement. If the vendor is well-reputed in the field, this can be an exception.) Beware of specially modified versions of well-known algorithms. This may intentionally or unintentionally weaken the cipher. The use of a trusted algorithm, if not with technical notes explaining the implementation (if not availability of the source code for the product) are a sign of good faith on the part of the vendor that you can take apart and test the implementation yourself. A common excuse for not disclosing how a program works is that "hackers might try to crack the program's security." While this may be a valid concern, it should be noted that such 'hackers' can reverse engineer the program to see how it works anyway. If the program is implemented properly and the algorithm is secure, this is not a problem. (If a hypothetical 'hacker' was able to get access you your system, access to encrypted data might be the least of your problems.) * Experienced Security Experts and Rave Reviews Beware of any product claiming that "experienced security experts" have analyzed it, but it won't say who (especially if the scheme has not been published in a reputable journal). Don't rely on reviews in newspapers, magazines or television shows, since they generally don't have cryptologists (celebrity hackers who know about telephone systems don't count) take the software apart for them. Just because the vendor is a well known company or the algorithm is patented doesn't make it secure either. * Unbreakability Some vendors will claim their software is "unbreakable". This is marketing hype, and a common sign of snake-oil. Avoid any vendor that makes unrealistic claims. No algorithm is unbreakable. Even the best algorithms are breakable using "brute force" (trying every possible key), but if the key size is large enough, this is impractical even with vast amounts of computing power. One-time pads are unbreakable, but they must be implemented perfectly, which is, at best, very difficult. See the next section for a more detailed discussion. * One-Time-Pads A vendor might claim the system uses a one-time-pad (OTP), which is theoretically unbreakable. That is, snake-oil sellers will try to capitalize on the known strength of a OTP. It is important to understand that any variation in the implementation means that it is not an OTP, and has nowhere near the security of an OTP. A OTP system is not an algorithm. It works by having a "pad" of random bits in the possession of both the sender and recipient. The message is encrypted using the next n bits in the pad as they key, where n is the number of bits in the message. After the bits are used from the pad, they're destroyed, and can never again be used. The bits in the pad must be truly random, generated using a real random source, such as specialized hardware, radioactive decay timings, etc., and not from an algorithm or cipher. Anything else is not a one-time-pad. The vendor may confuse random session keys or initialization vectors with OTPs. * Algorithm or product XXX is insecure Be wary of anything that makes claims that particular algorithms or other products are insecure without backing up those claims (or at least citing references to them). Sometimes attacks are theoretical or impractical (requiring special circumstances or massive computing power running for many years), and it's easy to confuse a layman by mentioning these. * Keys and Passwords The "key" and the "password" are often not the same thing. The "key" generally refers to the actual data used by the cipher, while the "password" refers to the word or phrase the user types in, which the software converts into the key (usually through a process called "hashing" or "key initialization"). The reason this is done is because the characters a user is likely to type in do not cover the full range of possible characters. (Such keys would be more redundant and easier for an attacker to guess.) By hashing a key can be made from an arbitrary password that covers the full range of possible keys. It also allows one to use longer words, or phrases and whole sentences as a "passphrase", which is more secure. Anything that restricts users' passwords to something like 10 or 16 or even 32 characters is foolish. If the actual "password" is the cipher's key (rather than hashing it into a key, as explained above), avoid it. If the vendor confuses the distinctions between bits, bytes and characters when discussing the key, avoid this product. Convenience is nice, but be wary of anything that sounds too easy to use. Avoid anything that lets anyone with your copy of the software to access files, data, etc. without having to use some sort of key or passphrase. Avoid anything that doesn't let you generate your own keys (ie, the vendor sends you a key in the mail, or it's embedded in the copy of the software you buy). Avoid anything by a vendor who does not seem to understand the difference between public-key (asymmetric) cryptography and private-key (symmetric) cryptography. * Lost keys and passwords If there's a third-party utility that can crack the software, avoid it. If the vendor claims it can recover lost passwords (without using a key-backup or escrow feature), avoid it. If there is a key-backup or escrow feature, are you in control of the backup, or does the vendor or someone else hold a copy of the key? * Exportable from the USA If the software is made in North America, can it be exported? If the answer is yes, chances are it's not very strong. Strong cryptography is considered munitions in terms of export from the United States, and requires approval from the State Department. Chances are if the software is exportable, the algorithm is weak or it is crackable (hence it was approved for export). If the vendor is unaware of export restrictions, avoid the software: the vendor is not familiar with the state of the art. Because of export restrictions, some legitimate (not-Snake Oil) products may have a freely exportable version for outside of the USA, which is different from a separate US/Canada-only distribution. Also note that just because software has made it outside of North America does not mean that it is exportable: sometimes a utility will be illegally exported and posted on an overseas site. Other Considerations Interface isn't everything: user-friendliness is an important factor, but if the product isn't secure then you're better off with something that is secure (if not as easy to use). No product is secure if it's not used properly. You can be the weakest link in the chain if you use a product carelessly. Do not trust any product to be foolproof, and be wary any product that claims it is. Contributors The following folks have contributed to this FAQ. Jeremey Barrett <jeremey(a)forequest.com> <geeman(a)best.com> Jim Ray <liberty(a)gate.net> Robert Rothenburg Walking-Owl <wlkngowl(a)unix.asb.com> References 1. B. Schneier, Applied Cryptography, second edition, John Wiley & Sons, 1996 2. M. Blaze, W. Diffie, R. L. Rivest, B. Schneier, T. Shimomura, E. Thompson, M. Wiener, "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security," available via ftp://ftp.research.att.com/dist/mab/keylength.ps ---------------------------------------------------------------------------- C Matthew Curtin Last modified: Mon Sep 16 09:51:41 EDT ---------------------------------------------------------------------- -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/

1 0

IBM Boosts Encryption Initiative
by Weld Pond 17 Dec '03

17 Dec '03

http://www.pcweek.com/news/0916/16enc.html IBM will roll out several security initiatives next month that include a new way to build encryption into software and technology that could enable U.S. companies to export products with strong encryption algorithms. and uhhh... IBM also will introduce several "key-recovery" technologies that could enable businesses to export encrypted data or software beyond the current 40-bit limit--without breaking U.S. government restrictions and whoa... The sources also added that the technology may satisfy the requirement imposed by the U.S. government that it be able to access encrypted data on demand. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: Snake Oil FAQ 0.4 [comments appreciated]
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Sep 16 12:05:17 1996 > (First off, I'd like to thank Matt for doing this.) > > The key length stuff is good, but a common component of snake oil is > that it claims to have very long key sizes. > > | Some ciphers, while currently secure against most attacks, are not > | considered viable in the next few years because of relatively small > keysizes > | and increasing processor speeds (making a brute-force attacks > feasible). The > | tables below should give some general guidelines for making intelligent > | decisions about the key length you need. If the key is too short, the > system > | will be easily broken, even if the cipher is a good one. > | > | In [1] and [2], we're presented with some guidelines for deciding > | appropriate key length. (It is important to note that this is based on > the > | ability to predict computing power 40, 65, and 100 years from now. > Major > | breakthroughs in computing power 30 years from now might render > everything > | on this chart kiddieplay.) > > | * One-Time-Pads > | > | A vendor might claim the system uses a one-time-pad (OTP), which > is > | theoretically unbreakable. That is, snake-oil sellers will try > to > | capitalize on the known strength of a OTP. It is important to > | understand that any variation in the implementation means that it > is > | not an OTP, and has nowhere near the security of an OTP. > | > | A OTP system is not an algorithm. It works by having a "pad" of > random > | bits in the possession of both the sender and recipient. The > message is > | encrypted using the next n bits in the pad as they key, where n > is the > | number of bits in the message. After the bits are used from the > pad, > | they're destroyed, and can never again be used. The bits in the > pad > | must be truly random, generated using a real random source, such > as > | specialized hardware, radioactive decay timings, etc., and not > from an > | algorithm or cipher. Anything else is not a one-time-pad. > > The phrase easy-to-use should not appear in proximity to one > time pad, except in the context 'Easier key management than a one time > pad!" > I would also suggest that the generation of OTP 'pads' for users is *highly* questionable. Who else is getting a copy of them, assuming they're even valid? Dave Merriman - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjzSBMVrTvyYOzAZAQGVwQP+N6vjyniDH0ad3G8dWu1cPHi5yfvksbS7 EJmgpSVTlaLf1Kp7rX2zBULxKvd2bqN3z3tAhj6reeG8la+P3Skw9gPJS8ggYvOn cXwdRsCyRICgHYMcbaEB/91YsJMweYyzWLe2JZazs3NfsafxdNKerGR7kvoQF0bG oBNR169sGlo= =WqlN -----END PGP SIGNATURE-----

2 1

CDT Policy Post 2.31 - Join Rep. Eshoo Online, Tues. 9/16, 8:00 EDT
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 31 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 31 September 16, 1996 CONTENTS: (1) Join Rep. Anna Eshoo (D-CA) Live Online Tuesday Sept 17, 8:00 pm EDT (2) How to Subscribe/Unsubscribe (3) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) Join Rep. Anna Eshoo (D-CA) Live Online Tuesday Sept 17, 8:00 pm EDT Representative Anna Eshoo (D-CA) will be live online on Tuesday September 17 at 8:00 pm EDT (5:00 pm PDT) to discuss her efforts bring privacy and security to the Internet through the reform of US encryption policy. Eshoo will also take questions from Netizens during the discussion. Representative Eshoo, who represents the heart of California's Silicon Valley, is a co-sponsor of HR 3011, the "Security and Freedom through Encryption (SAFE) Act of 1996", a founding member of the Congressional Internet Caucus, and a strong advocate for enlightened Internet policies. Momentum in Congress for real reform of US encryption policy remains strong. The House Judiciary Committee is scheduled to hold a hearing on HR 3011 on Wednesday September 25, 1996, and the Senate Commerce Committee is expected to vote on the Burns/Leahy "Pro-CODE" bill (S. 1726) soon. DETAILS ON HOW TO PARTICIPATE IN THE DISCUSSION: At 8:00 pm EDT (5:00 pm PDT), point your browser to: http://www.hotwired.com/wiredside/ To participate you will need to have RealAudio installed on your computer (available free at http://www.realaudio.com/) You also need to be a registered HotWired member (there is no charge for registration - visit http://www.hotwired.com/ for details). This forum is the 6th in a series of events organized by the Center for Democracy and Technology and the Voters Telecommunications Watch with the purpose of bringing the Internet Community into the debate over critical Internet policy issues. For further information, please visit the following sites: * For Background on the Encryption Issue: The Encryption Policy Resource Page: http://www.crypto.com/ CDT's Encryption Policy Issues Page: http://www.cdt.org/crypto/ * For details on Congress and the Internet: CDT's Congress and the Net Page http://www.cdt.org/net_congress/ Voters Telecommunications Watch: http://www.vtw.org/ HotWired's WiredSide Chat: http://www.hotwired.com/ ----------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.31 9/16/96 -----------------------------------------------------------------------

1 0

Re: PRESS RELEASE: GERMANY CENSORS DUTCH WEBSITE WWW.XS4ALL.NL
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"gnu(a)toad.com" "John Gilmore" 16-SEP-1996 10:13:36.24 >While you are at it, you could move just the censored material to a >separate IP address from the rest of the archives, and issue Web >redirects for requests sent to the old address. In fact it might be >interesting to redirect readers to various mirror sites automatically, >at random and in rotation. Thus, when someone connects to your web >site to read censored material, they will be automatically redirected >to one of dozens or hundreds of other places where the material can be >found. The German censors will likely find it impossible to block >access to all those sites (and each such site can also be changing its >IP address periodically). The first part (redirection at random) can be done via a CGI script; this may be useful for those wishing to put in links to a mirror site without having to choose a particular one or host it themselves. Incidentally, speaking of mirror sites, I'd be interested in locating scripts to do the following: A. Automatically redirect someone to an appropriate mirror site based upon closeness to their originating IP address B. Automatically poll (via crontab or similar mechanisms) between mirror sites (and to the anonymizer) to see if they're up, using the first part to redirect accordingly. -Allen

1 0

HipCrime as MetaSPAM
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

The Hippie Of Crime <robert(a)precipice.v-site.net> also asked that remailer operators not block HipCrime SPAM deliveries and all mail to HipCrime because people might be interested in his cool fractals and Java neural net lotto-predicters and anarchist pages. If he wants to advertise to people about his other cool products, he doesn't need to do it anonymously. Furthermore, he doesn't provide any method in his web pages for users to anonymously request information, or to have information delivered anonymously. So blocking him from the remailers won't lose him anything. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Judge Kozinski Responds
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Sep 16 17:18:36 1996 cypherpunks: I have been having a private e-mail conversation with Judge Alex Kozinski of the 9th circuit. Today he said: >Jim: Feel free to clarify my position to your comrades >(excuse the term) if you think it will be useful. I guess >I'll keep thinking about this stuff and may change my mind >on some things. ... In a previous message to me in response to cypherpunks messages mentioning him which I forwarded, he said: >The statement about anonymous remailers was largely >accurate. I'm not sure that the fact that you (or some of >your associates) are willing to block people from getting >anonymous mail is a sufficient safeguard. Some may not be, >and it only takes one or two who do not adhere to the code >to make life miserable for the rest of us. > >We agree about the need for privacy, but I'm not at all sure >why the right to send messages anonymously trumps the >recipient's right to know who's addressing him. Getting an >anonymous message--even one that is not harassing or >threatening--is an invasion of my privacy. As for Me: [Please note, this statement caused me to block his address from WinSock messages, but _NO_ I will not give you his e-mail address, so please do not ask me to unless I _know_ you are a remailer-operator, and you send me a PGPmessage including your key and asking for it for blocking reasons ONLY. So far, nobody has been stupid enough to try to use the remailers to harass him. I DON'T want this man harassed, and having him understand "our" point of view will be a "big cypherpunk win"(tm) IMNSHO, so please trust me to represent you fairly. Thanks.] On with the Judge: >Halloween, it only really works when the people dressed up >are about four feet tall. In the rare instances where there >have been adults at my door that were so disguised you >couldn't tell who they were, I felt threatened--kept my >Glock handy before opening door. > >The quote about morphed children's images was sort of >botched, as was my assessment of the Third Circuit's case. >What I said about children is that morphed images did not >involve normal exploitation of children so it would not >clearly fall in the unprotected category, but that there may >be other harms I'd have to think about before deciding. >As for the Third Circuit's opinion, I said at the outset >they got it right in the bottom line; what I criticized was >their use of analogies to deal with the problem. I find >that much thinking about the net is analogy-driven and that >analogies are inherently imprecise and can be misleading. > >Anyway, thanx for bearing with me. There's a lot of this >stuff I have not made up my mind about and I find talking >about it helps shape my thinking. Folks, we have a chance to win or lose, depending on list.maturity and common sense. If this man is harassed, convincing him will become harder for me, and I will be very annoyed. If you make a coherent comment that covers ground that I have not already covered with him, I will forward it on to him. Alex Kozinski is IMO, by far, the closest thing to a libertarian that Reagan ever appointed, and in both messages he has mentioned having an open mind. Let's try not to give him a reason to close it. Thanks for trusting me, and thanks in advance for behaving nicely and respecting the judge's privacy. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3ENG1lp8bpvW01AQEOBAP+IExjfTO6DnrBvF8/xNFWLDcYTgIid5tI Gpya0oRKRFIgYm2v3pjw2y649QxC8bGryy15wi72s6p4f1Sf6pqKbOz6ANcHNkOK JoenVAMBxKK4wwoDIzqkxPBBIBmQO/KzJBw5ymfhGMZNN+NN6nwS9JnlSKeDwFtO 94BZLZ2fec4= =IS+5 -----END PGP SIGNATURE-----

1 0

Unsolicited email advertising already illegal in US?
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This piece from RISKS looks interesting. My computer certainly _is_ "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Now, are HipCrime et al. liable for $500 in damages for each piece of spam? If so, where do I sign up? - Ian - ---8<---8<--- Date: Thu, 12 Sep 1996 19:46:42 -0400 From: Dan Franklin <dan(a)copernicus.bbn.com> Subject: Sometimes junk e-mail is already a fax, legally speaking I've been using the following legal information, which I picked up from another mailing list (Keith Bostic's /dev/null list), in my responses to junk e-mail these days. So far I haven't yet received junk e-mail on my home computer while it had a printer attached, but one of these days... Under US Code Title 47, Sec.227(b)(1)(C): "It shall be unlawful for any person within the United States to use any telephone facsimile machine, computer, or other device to send an unsolicited advertisement to a telephone facsimile machine" A "telephone facsimile machine" is defined in Sec.227(a)(2)(B) as: "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Under this definition, an e-mail account, modem, computer and printer together constitute a fax machine. The rights of action are as follows. Under Sec.227(b)(3)(B): "A person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State -- (A) an action based on a violation of this subsection or the regulations prescribed under this subsection to enjoin such violation, (B) an action to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater, or (C) both such actions. If the court finds that the defendant willfully or knowingly violated this subsection or the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under subparagraph (B) of this paragraph." For the full legal text USC Title 47, Section 227, see: http://www.law.cornell.edu/uscode/47/227.html Dan Franklin dfranklin(a)bbn.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3MlEZRiTErSPb1AQFSIgP/SKn68eix0cgOMa2QgOsAJ7IePBZitECs 1KflgL0ziSW9D5JBhYmjAfl3UoFF7UJ1vyROFUV7sgBB1PSXGAvBGycSqrIhciPh Fm/73HUT0pr4foyTAPOndhAOx3ls61+kT497TUx+BecPhtfI41Mu0zTdPaZdWogP vaxfu97SuWw= =OC/R -----END PGP SIGNATURE-----

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca wrote: > By spreading the risk you minimize the cost. m5(a)tivoli.com wrote: >Yea right. Actually, yes. Canada has a single payer system and we spend about two thirds as much as the U.S. on health care as a percentage of G.N.P. We manage to insure all Canadians while about 35% of people in the U.S. have *no* health insurance. Yes, the insurance premium is not optional. Yes, it *is* cheaper. Ciao, James

1 0

Free RSA chip
by Lucky Green 17 Dec '03

17 Dec '03

I secured a 30 page data sheet for the new NTT (actually NLC, a subsidiary of NTT) RSA accelerator chips. The NLC0048 LSI chip can handle keys up to 1024 bits. The secret key can be stored on-chip. If you want a copy of the data sheet, email me your fax number. Furthermore, I have *one* sample chip that I am willing to loan to somebody in the SF Bay Area with sufficient hardware knowledge to put the chip to good use. If you think you qualify, let me know who you are and why you think that you should get the chip. I apologize in advance to the qualified candidates that do not get the chip. There is only one (that I can loan out). --Lucky

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 02:00 AM 9/16/96 -0700, Timothy C. May wrote: >As to the "social safety net," things are far, far beyond a simple safety >net. When 14-year-old pregnant inner city girls are given money to set up >their own households (cf. Charles Murray's "Losing Ground"), this is not a >"safety net," this is subsidized breeding. A friend of mine (who can be just as coarse as I) calls them "Welfare-powered bastard factories." Jim Bell jimbell(a)pacifier.com

1 0

Edited Edupage, 15 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 16-SEP-1996 10:15:59.50 >To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" >************************************************************ >Edupage, 15 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ >SATELLITE BROADCASTERS MUST PROVIDE EDUCATION, TOO >A federal appeals court in Washington has ruled that any company providing >direct broadcast satellite (DBS) services must "reserve a portion of its >channel capacity, equal to not less than 4 percent nor more than 7 percent, >exclusively for noncommercial programming of an educational or information >nature," in compliance with regulations drafted by the FCC to enforce laws >enacted in 1984 and 1992. The unanimous decision rejected arguments by Time >Warner and other broadcasters that the law interfered with their First >Amendment rights. "It is the right of the viewers and listeners, not the >right of the broadcasters, which is paramount," said the court, quoting a >1969 Supreme Court ruling. (Chronicle of Higher Education 13 Sep 96 A29) Bloody socialist Supreme Court... sell the _full_ rights, then use the money to reduce taxes. >SYSTEM CRACKER GOT RECIPE FROM HACKER MAGAZINE >The person who disabled New York's Panix Internet service probably followed >the line-by-line instructions for doing so that appeared in the latest issue >of 2600 magazine, the Hacker's Quarterly. "We need to educate the community >that it's very, very simple to cause massive mayhem," says 2600's editor, >who defended his editorial judgment. "A lot of companies subscribe to us so >they can learn before they're victimized." Panix's co-owner says he >supports 2600's right to publish such information: "As a matter of >principle I don't think they should have been stopped," but adds that unlike >most other recipes for breaching security published in the magazine, this >one has no known technical defense. (Wall Street Journal 13 Sep 96 B5) Helpful to quote Panix on it. >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*********************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Henry R. Luce (if your name is Henry R. Luce; otherwise, substitute your >own name). ... To cancel, send a message to: listproc(a)educom.unc.edu with >the message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0

Re: Snake Oil FAQ 0.4 [comments appreciated]
by Deranged Mutant 17 Dec '03

17 Dec '03

For those not-yet-in-the-know: I no longer have the time to manage it and asked for somebody (and Matt agreed to) to take the Snake Oil FAQ's care and feeding. Note that this is not cc'd to coderpunks. I don't think it's appropriate for coderpunks. On 16 Sep 96 at 9:56, C Matthew Curtin wrote: [..] > --------------------------- snake-oil-faq ---------------------------- > > Snake-Oil Warning Signs > Encryption Software to Avoid [..] > The Snake Oil FAQ is (to be) posted monthly to cypherpunks, sci.crypt, > alt.security, comp.security, and comp.infosystems. We're targeting those who Does it need to be posted monthly? Better to post pointers to it most of the time, possibly to other places as well (alt.2600 comes to mind...). Perhaps when the first 'non-beta' of this document is released a History could be added. [..] > Different products will serve different needs, and it's rare that a product > will serve every need. (Sometimes a product won't be needed: it may be Nitpick: Hm. Change that to "no product will serve every need". > better to use a utility to encrypt files, transmit them over a network using > standard file transfer tools, and decrypt them at the other end than to use > a separate encrypted utility in some cases.) Or more clearly: is encryption THE feature of the utility, or is it an added feature? It's better to use separate utilities made for that purpose rather than one that tries to do everything. [..] > Key Sizes > > Some ciphers, while currently secure against most attacks, are not > considered viable in the next few years because of relatively small keysizes > and increasing processor speeds (making a brute-force attacks feasible). The Change to "making brute force attacks--that is, trying every possible key--feasible". [..] > Symmetric and Public-Key Lengths With > Similar Resistance to Brute-Force Attacks > > Symmetric Key Length Public-key Key Length > 56 bits 384 bits > 64 bits 512 bits > 80 bits 768 bits > 112 bits 1792 bits > 128 bits 2304 bits That's a controversial comparison. I've read references (from a couple of years ago) saying that a 3k-bit RSA key is as strong as a 128-bit IDEA key. Trying to compare the two (symmetric and assymetric) is like running through a tar pit. > Some Common Snake-Oil Warning Signs > > The following are some of the "red flags" one should watch for when > examining an encryption product > > * Technobabble [..] > A sign of technobabble is a descrption which drops a lot of technical > terms for how the system works without actually explaining how it > works. Often specifically coined terms are used to describe the scheme > which are not found in the literature. Of course, how is an amateur supposed to know if these terms are found in the literature? That was a recurring comment that people sent me when I first posted the FAQ. [..] > Just because software uses to different method of computation Typo! "uses to different method..."? [..] > grounded in mathematical theory. The security is based on problems that > are believed, if not known to be hard to solve. Hm. How about "that are widely believed"? [..] > A OTP system is not an algorithm. It works by having a "pad" of > random bits in the possession of both the sender and recipient. [..] > never again be used. The bits in the pad must be truly random, > generated using a real random source, such as specialized > hardware, radioactive decay timings, etc., and not from an > algorithm or cipher. Anything else is not a one-time-pad. Although it is(?) mentioned below, I'd emphasize here in some way that the users of the OTP generate the key. Somebody else sending you a supposed OTP that he generated is not secure. > The vendor may confuse random session keys or initialization vectors > with OTPs. Explain random session keys and initialization vectors. A glossary at the end of the document would be a good thing. > Sometimes attacks are theoretical or impractical (requiring special > circumstances or massive computing power running for many years), and > it's easy to confuse a layman by mentioning these. Oh yeah. These need to be explained. What I had in mind was timing attacks against RSA or IDEA, or factoring of public keys. > * Keys and Passwords > > The "key" and the "password" are often not the same thing. The "key" "often" not?!? (oops...was that my wording?) They aren't the same, though often they are confused in snake oil. [..] > If there's a third-party utility that can crack the software, > avoid it. > > If the vendor claims it can recover lost passwords (without using a > key-backup or escrow feature), avoid it. > > If there is a key-backup or escrow feature, are you in control > of the backup, or does the vendor or someone else hold a copy > of the key? That is, if you lose the key, you don't want a third party to have as much a chance to recover it as you do. [..] > > If the vendor is unaware of export restrictions, avoid the software: > the vendor is not familiar with the state of the art. Also... if the vendor does not understand export restrictions, avoid the software. I'm thinking of a certain snoil-vendor who said 128-bit IDEA keys were'nt secure since they could be exported. > Because of export restrictions, some legitimate (not-Snake Oil) > products may have a freely exportable version for outside of the USA, > which is different from a separate US/Canada-only distribution. Also Such exportable versions are not as secure, of course. [..] > Other Considerations > > Interface isn't everything: user-friendliness is an important factor, but if > the product isn't secure then you're better off with something that is > secure (if not as easy to use). > > No product is secure if it's not used properly. You can be the weakest link > in the chain if you use a product carelessly. Do not trust any product to be > foolproof, and be wary any product that claims it is. I wanted to add some sort of 'non-guru hacks' to test a product. One example might be to actually examine 'encrypted' files to see if they are really encrypted. (I'm thinking of the AMG archiver, which only encrypted the CRC; CODEC archiver also only encrypted the CRC is a file is not compressed.) Thanks again for taking over the FAQ. A good job! Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Diffie Hellman - logs in Galois fields
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Hi all, A question for the matematicians out there: I am looking at the Diffie Hellman public key exchange protocol and am trying to find out why it is computationally hard to take logs in a finite (Galois) field. My maths tutor has told me a bit about the construction of Galois fields (If I`m correct the construction is Z mod N, N some integer, then a transformation F(x) on the residue classes already in the field) I know also the definition is that there are P**k elements, p a prime. My questions are as follows: 1. How can a field be finite, as by definition it has to be closed under addition, subtraction, multiplication and division???? (sorry if this one is a bit of a no brainer, maybe the definition is different but I can`t seem to see how) 2. Why is taking logs in a finite field computationally hard? - Me and Alec (My maths tutor at college) guessed that it is because exponentiation and logs are each others inverse functions, and somehow this becomes a one way function in a finite field. 3. Are the Galois fields used in Diffie Hellman specially constructed in any way or are they just normal GF???? Thanks for any help anyone can give me.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: The Living and the Dead
by jim bell 17 Dec '03

17 Dec '03

At 12:40 PM 9/16/96 -0400, Brian Davis wrote: >On Sun, 15 Sep 1996, jim bell wrote: > >> .... >> How would an AP-type system treat Robert McNamara? He'd be dead in a >> second. To those who say, "What good would this do?" I respond: Anyone in > ^^^^^^ >Kind of kills the betting pool, doesn't it? > >EBD Okay, it was just an expression... It would probably take a couple weeks. Jim Bell jimbell(a)pacifier.com

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 11:24 AM 9/16/96 EDT, Dr.Dimitri Vulis KOTM wrote: >jbugden(a)smtplink.alis.ca writes: >> dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: >> >Starting with the lying old fart himself. >> >> You shouldn't be so hard on Tim. I tried giving up farting years ago but I = >> found >> I gained a lot of weight. It's also become more socially acceptable as evid= > >I wonder why containing one's fart would cause one to gain weight. Volume maybe, >but I'd think that gas weight about as much as the air it displaces. Actually, less: It's mostly hydrogen. Jim Bell jimbell(a)pacifier.com

1 0

Spam blacklist project
by hallam＠ai.mit.edu 17 Dec '03

17 Dec '03

Hi, The following idea just hit me. How about a server which maintained a list of people who don't want to recive SPAM? The idea being that email recpients who don't want SPAM send their email address to the list. A SPAMer who want to check an email to see if it is on the list could then obtain the SHA-Digested list of addresses and remove them from their internal databases. Of course I don't for a moment imagine that this will be 100% effective. Without government regulation there will always be slimeballs who send mail to people who don't want it. The advantage of this scheme is that it would mean that the spam industry can avoid regulation pressure and they can deflect criticism. Meanwhile recipients of unwanted spam have a legitimate beef. Comments? Phill

6 7

Re: New Remailers?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:53 AM 9/16/96 BST, you wrote: >I recently secured an account with anon.penet and then a few days later got >a post informing me that the servive was now terminated. Anybody out there >know of any remailers where you dont have to have a Phd in computer science >and a thorough working knowledge of PGP in order to operate? Raph Levien's remailer list lives at http://www.cs.berkeley.edu/~raph/remailer-list.html Most of the remailers on it are the one-way variety - you can send mail to someone anonymously, but you don't get an address for people to reply to you. They're easy to use. Some of them also support anonymous reply blocks, which are a somewhat difficult-to-use feature - you basically PGP-encrypt your return address (in the correct syntax), and tell anybody who wants to reply to you to include the block at the beginning of their mail. There have been some pseudonym servers besides anon.penet.fi, which provide higher security, and are easier to use than anonymous reply blocks, once you set them up (which generally involves creating anonymous reply blocks :-) Two of them have been spammed to death, but the cyber remailer at alias(a)alias.cyberpass.net is still up. Send it a request for help to get information. Raph has a new system coming soon; see his remailer list for details. Private Idaho is Joel McNamara's friendly user interface for remailers and PGP. http://www.eskimo.com/~joelm/pi_list.html . Runs on MSWindows. It made it _much_ easier to use the alpha nymserver while that was still alive; don't know if the new version supports cyber yet or not. Remailer security depends on encryption - otherwise wiretappers can watch mail going into the remailer and know where it's going. So you'll need to learn to use PGP, but it's pretty straightforward, and Private Idaho makes it more convenient. The Mixmaster remailers provide higher security remailing, also with no reply capability; you need to get special client software, which I think isn't ported to Windows yet? >Also, are there any remailers which will accept binary attachments? There are three popular ways to do binary attachments - 1) MIME-encoding (uses MIME headers and maybe a 7-bit content transfer encoding.) 2) UUENCODE (simple-minded header and 7-bit ASCII.) 3) Mail-handler-specific headers with binary stuff following Uuencode is a no-brainer - just stick the uuencoded binary after the remailer headers. As far as I know, none of the remailers are particularly MIME-aware, but they do glue headers together. So you could probably start sticking MIME headers after the remailer headers and try a few times to get it to work. Mail-handler-specific behaviour is, of course, mail-handler-specific :-) You can try it and see, and remember that the person at the other end may not have the same kind of mail handler you do, so even if you sent the mail directly instead of through a remailer, it might not work. You may have trouble getting your mail client to do what you want for sending the message (e.g. if you use Cc:Mail or MSMail.) I looked at the code for my remailer, which is a modified Ghio2, though I don't think I modified this part, and it'll trash binaries. The problem is that, after processing headers, it shoves the rest of the input stream into the output file by a loop of fgets() check for cutmarks fprintf() which will trash anything that contains nulls, and may not do the right thing for newlines either, though it won't bother high-bits. I suppose it wouldn't be too hard to write a getchar/putchar loop that checks for cutmarks while transferring data safely (this would be easier if cutmark behaviour includes outputting the cutmark.) However, the remailer uses the native mail program (e.g. sendmail) to forward the mail, so if your sendmail trashes binaries, or does annoying vestigial things like changing "From " to ">From " at the beginnings of lines, it'll still lose. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Kiddie porn on the Internet
by jim bell 17 Dec '03

17 Dec '03

At 08:51 AM 9/15/96 -0700, James A. Donald wrote: >[Allegations that "save the children" is a political organization >providing cover for an effort to ban cryptography] > >At 01:54 PM 9/9/96 -0400, Hallam-Baker wrote: >> Their main mission is sending food to Ethiopia and other famine >> areas, development work etc. It is ultra-worthy stuff. > >Not everyone who sends food to the starving children is ultra >respectable. >Problem is that the usual cause of starving children is tyranny. >In order to get close enough to the starving children to take >those cute fund raising photographs you have to pay off and get >cosy with tyrants. This creates a moral hazard, in that it is >hard to tell the difference between normal bribery needed to do >anything in a tyrannical state, and bribery to bribe tyrants to >create starving children for photo ops. >It is very common for international charities to develop excessively >friendly relationships with murderous tyrannies, Yet another obligatory AP (Assassination Politics) reference: If a person is really interested in helping out "starving children" he may be able to do far more good by purchasing the death of the local tyrant(s), rather than (just) buying more food. After all, if the donor really believes that this starvation isn't endemic to the country, he has to conclude that it's a condition which is forced on the victims. In addition, you almost always find that these starving countries have well-supplied militaries, defending the local warlords against each other as in Somalia. Indeed, in Somalia the incoming food was actually used to buoy up one group against another, because access to it is controlled directly or indirectly by the factions. Some might argue that the death of a single leader doesn't normally fix the problem. While that's often true, it's normally because there isn't an automatic guarantee that the next 20+ leaders will ALSO be killed if they display the same problems as the first. Provide that guarantee, and (somewhat paradoxically) not only do you not need to kill the 20+, you probably won't have to kill the first one! (wondering when the world will see the light...) Jim Bell jimbell(a)pacifier.com

2 1