December 2003 - cypherpunks-legacy

Re: PGP3.0 & ElGamal
by Steve Reid 17 Dec '03

17 Dec '03

>> Yes, but I believe 3DES has an effective key length of only 112 bits. >> Of course, even this is more than sufficient for a long time to come. > 3DES can have an effective key length of 168 bits if 3 keys are used > instead of two. There are no security problems that I know of from > using 3 keys. The Meet In The Middle attack (MITM, not to be confused with Man In The Middle) is a time-memory tradeoff that works against any multiple encryption. Triple encryption: ciphertext = encrypt(k3, decrypt(k2, encrypt(k1, plaintext))) plaintext = decrypt(k3, encrypt(k2, decrypt(k1, ciphertext))) An MITM attack, as I understand it, works by decrypting from one end and encrypting from the other... Step 1- decrypt(x3, ciphertext) for every possible x3, and store all the results. This requires 2^56 operations and 2^56*8 bytes (550 petabytes?) of memory when done against 3DES. Quite a lot, but it might be doable. Step 2- decrypt(x2, encrypt(x1, plaintext)) for every possible x1,x2. This require 2^112 steps with 3DES. If the result you get can be found in the table built by step 1 then you've figured all three keys.

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:11 ìì 16/11/1996 -0800, Sandy Sandfort wrote: >C'punks, > >On Sun, 17 Nov 1996, George A. Stathis wrote: > >> What worries me is that people still subscribe to the >> cypherpunks list after this assault on free speech takes place. > >So I guess we won't be seeing George around here any more (or >did he just me OTHER people should unsubscribe?). Rest assured that... I am not subscribed to your list anyway. Maybe I allowed 5 or 6 messages to reach you, since the 'recipients' contained your list in the first place. It's part of *your* attempt (AFTER Dimitri's expulsion) to "have the last word". :-) - NOT mine! :-) Perhapds I'd subscribe to your list if serious discussions on... crypography take place, which would enable me to better... protect my own software by some kind of encryption. But I decided to lower my prices and publish (my dictionaries) unprotected anyway! :-) As regards 'PGP'... I don't give a damn anymore who reads my mail, since I got used to infringements of privacy anyway (since my childhood days in a dictatorship). In any case, It is not my style to 'hinder other people's discussions'. And if a list contains more than 1000 people INDIFFERENT to Freedom of Speech, it's not AT ALL 'my' kind of list anyway... :-) >> ...I would gladly write articles on Dimitri's expulsion and the >> facade of Free Speech in mailing lists etc.,...But since I have >> no time, it's likely someone else will report this. > >What was that from Thomas Paine about summer soldiers and >sunshine patriots? Three cheers for George and his commitment >to "Free Speech." I know I'm impressed. Aha! aha! aha! :-) You are on the verge on "taking the piss out of" (even) Thomas Paine! How has it happened that you are so determined in your anti-Vulistic zeal, so as to sacrifice even what the rest of the World admires in your country? I always liked Americans for their support of Individual Rights, their Constitution, Jefferson and Thomas Paine, things like that... Well, if you want all these reasons to vanish in thin air, good luck in your next... forcible unsubscriptions! :-) <shrug> George P.S. I have heard cynical Americans before, being 'sarcastic' against selfless supporters of Free Speech. A lot of you people can't even imagine a selfless cause without financial gain. Such is the... Mafia world of... pimping and prostitution, I suppose... :-) (-joke!) ROTFL

2 1

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > [Discussion of blind signatures] > > Brands has a better scheme that I don't understand exactly. He recently > attempted to explain it to me thusly: > > [Brands quote elided] > > Can anyone tell me more? We had quite a bit of discussion of Brands' technology on the list a couple of years ago. Take a look at <URL: http://chaos.taylored.com:1000/0Z/Digital-Cash/Protocols/Brands/Brands-Cash… > which has several pages discussing discrete logs and some of the ideas behind Brands' protocols. Unfortunately I am getting cut-off versions of these pages tonight, along with occasional failures to find a route to this server, so hopefully it is just the net acting up again. Hal

1 0

Re: Remailer Abuse Solutions
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > Another way to have anonymous posting but not be subjected to spam > and the like is to dispense tokens every week to the subscribers. > They can be signed blindly so that anonymity is preserved, just > like e-cash. I had proposed a similar idea to this a few years ago. You would dispense tokens, each of which needed to be included in an anonymous message. So this prevents spam. But it can also deal with abuse. After sending the message, if it was not abusive, a new blinded token would be broadcast which could only be decrypted by the sender of the original message. But if it was abusive, no new token would be sent. Remailer users would watch these token broadcasts and get their new tokens each time they sent a message. The remailer might have to delay issuing the replacement tokens for a day or two to give the recipient time to complain. If you gave everyone in the world an initial supply of a few tokens, then every time they abused, they'd lose one. But as long as they use the remailer reasonably they can continue to use it forever because they get a new token for each one they use. Messages still remain completely unlinkable and the remailer has no way of learning anything from the tokens it sees since they were all issued in blinded form. Hal

1 0

Re: The Utility of Privacy
by Hal Finney 17 Dec '03

17 Dec '03

David Brin has an article in the December issue of Wired arguing that privacy is obsolete and was never that great an idea in the first place. I corresponded with him a few years ago when he was working on a draft of a book which would develop this idea. Needless to say, I disagreed with many of his views. Here is an excerpt from a letter I sent to him where I defended the notion that privacy is valuable: === You suggest that the main motivation which someone might have for protecting privacy is that they are engaged in some illicit activities: page 45: "Why should I really care if someone sees this? I have nothing to hide." But aren't exceptions to this quite common in real life? What about the gay man who doesn't want to come out of the closet? What about the environmentalist who works in the clerical department of an oil company with little tolerance for such beliefs? What about the closet atheist in the fundamentalist Midwestern town? Maybe you'd say that all of these people should expose their secrets, or have them exposed for them, and that the world would be a better place. (Actually, you do seem to say this, and I'll discuss it later.) But I think this assumes a certain level of tolerance on the part of society. What if this is wrong? What if society, or just your neighbors, or your boss, is not so tolerant? What if you lose your job, or get hounded from your neighborhood, once these secrets are exposed? I really don't think we have any right to second-guess the decisions people have made about what they will reveal and what they will keep private. They are the ones who have to live with the consequences. They are the ones who should make the decisions. For you to say that people should have "nothing to hide" is awfully facile. If you had admitted in your book to be a pedophile or a white supremacist, coming out of the closet as a demonstration of your faith in the values of openness, that would at least indicate that you had experienced that of which you had written. But of course even that would not give you the right to presume to tell others to follow the same course. In my opinion. Furthermore, there is a long tradition of anonymity and pseudonymity in literature. Probably the most prominent examples are the Federalist Papers, published anonymously due to fear of political retribution. The whole area of politically-inspired anonymity is another counter-example to this notion that people only want privacy for evil purposes. How can you look back at the history of even this country, which probably has one of the best records in the world, and feel confident that no one will ever be wiser to express an unpopular view anonymously? Even if you feel safe about it in the U.S., your suggestions would have world-wide impact. There are many countries in the world where criticizing the government will have to be done anonymously if it is done at all. This raises the point that anonymity may promote criticism. You go to some lengths to praise the value of critical commentary as a route to the truth. Yet in real life political considerations are one of the most potent blocks to criticism, and these often apply most strongly to those who are in the best position to criticize. It is only through anonymity that much of the most useful criticism can arise. This is why we have our "whistle-blower" laws, anonymous informants, etc. Yes, anonymity can be easily misused in this regard. Information supplied anonymously needs to be carefully verified before it can be relied on. But I don't see the value in stripping the shield of anonymity from people who would like to expose some injustice but are afraid of the personal consequences. === Hal

1 0

Re: Censor John Gilmore -- EFF is a disgrace!
by George A. Stathis 17 Dec '03

17 Dec '03

At 12:07 ðì 17/11/1996 -0600, snow wrote: >> Stephen Boursy wrote, along with a horde of others with no lives: >> [lots of worthless crap snipped out] >> > None of that analogy is applicable to the cyberpunks list. >> > When a list gets as big as that, it it no longer to be considered >> > a "mailing-list" but it is a _public_ forum. The whole problem >> > here is the abuse of power by both the EFF and John Gilmore. > > Boursy is a twit who has lost more accounts that Vulis. In this case, I'd quote a poet who said "I am not sorry for the poets who were left without an audience, I am sorry for the audiences who were left without any poets". I would suggest that it is not at all a "safe" indication of personal or intellectual _worth_, (of Mr. Boursy or of anyone) "how many accounts he has lost". For two reasons: (1) As I read Mr. Boursy's postings, I see no indication that he is either deranged, or evil, or lacking sanity or maturity. If he had these qualities, they'd sooner or later show up inside the F-K list, to which I subscribe for several months (nearly a year?). (2) The situation inside the "less official" side of thje Internet, at the moment (aka mailing lists) is so notoriously repressive that perhaps a _minority_ of mailing lists do not indulge in so-called "forcible unsubscriptions". E.g. what about the "Orgonomy mailing list" kicked out an eloquent critic of its owner (Dr. Demeo) (can find all names and details if you like) just because he opposed Dr. Demeo's "experiments" in an Israeli desert which (allegedly, according to the critic) resulted in people's deaths. I mention this case, because I was present there, and because (just like the "Cypherpunks" list) it was directly or indirectly related to issues of Freedom ("Orgonomy" being the "Alternative Psychology" of a rather unconventional thinker called Wilhelm Reich who died in an American jail after the McCarthian State framed him). > Ignore him. It is not ethical to send such strong negative _injunctions_ to masses of people and also to strangers (the 1900-strong members of the cyberphunks list for instance). Because, you may or may not have strong reasons for believing you are justified in such invalidation, but more than a 1000 people are now _told_ by (self-appointed) "experts" such as yourself what and whom to ignore or to believe. (Like sheep led to the slaughter)... This was my objection also inside the F-K list, for _some_ of the postings in the past, but none of these postings was connected with acts of censorship, or with "sweeping generalisations" without evidence. On several occasions that I searched and found who or what they were talking about, I discovered they were talking about people whose activities were indeed horrifying (forged cancellations etc) and who also fought back. But what you are doing now, extending the "1-person-blacklist" to your number-two-entry (Mr. Boursy) is exactly the thing that I hoped you might avoid. First they kicked out Dimitri Vulis. Then they slandered and kept out Steve Boursy. Then... When they came after me, there was nobody left to support me. (You can perhaps realize what this paraphrase is about)... :-( Sincerily, and with... Sanity of Mind :-) George Stathis

3 2

Crypto Bounties: Another Thought that crossed my mind.
by snow 17 Dec '03

17 Dec '03

Here we go again: There are is a lot of software that we would all like to see developed and deployed right? There are a lot of people out there who write code, sometimes even freely redistributable code, but they have to eat, and get their net access right? Well, I was thinking, what if a "Crypto Software Bounty Server" were set up, so that someone could propose a tool that they would like to see, along with an initial bounty. Others could contribute toward that bounty (anonymously if they wish) until either the tool was delivered. The original issuer sets standards for the software (i.e. "easy to use interface to mixmaster remailers for Macintosh", then must define easy to use; Software considered delivered when in [alpha beta late-beta &etc.]). The first to present software meeting these qualifications gets the bounty, with the caviate that the software must be either gnu-copylefted, or some similar "free use" copyright, after all, "The Net" paid for it... Some of the problems (and potential solutions) I can think of in this: 1) Refusing to honor the contract--Maybe when a project is proposed, some other people (for a small percentage of the total) sign on as judges. When they feel that it reached the stated goal, then it is done. -Or- Money put up is non-refundable, and the bounty stays in the "bank" until claimed. 2) If the money stays in the bank until claimed, people might not put up that much (or enough) to make a specific project worthwile-- This could be solved by allowing the "bounty" to lapse in one of 3 ways: A) <x> length of time after the initial proposal (bad because i) someone could already be working on it; ii) bad because other people might add to the bounty, so a potential programmer might not start until the "pot" has grown to a certain level. B) <x> length of time after the last addition to the bounty, bad for both i & ii above. These can both be gotten around (and other problems) by allowing programmers to "register" with the service that they are working on a project (either anonymous registery, so that people will still contribute to the project, or list those registered so that people know [if who] someone is working on it) 3) Funding: The server (in both the machine and the organizational sense) could be funded by: A) Interest on the money accumulated. B) A percentage of the bounty (say 10%) C) Both A & B. Has anything like this been proposed before? I know that the FSF (IIRC) accepts contributions, but I am thinking of something more targeted, more "market driven" if you will. This could be expanded to non-crypto software as well, just think, if half the X Window users ponied up $5 a peice for a "good, easy to use non-motif word processor", how long do you think it would take for someone to start coding a MS Word killer? Comments? Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

~~~ F.Y.I. ~~~
by ReplyOnly＠ByMail.com 17 Dec '03

17 Dec '03

Dear Friend, The Only Internet Book you will ever Need.... So you're on the Internet, but don't know what to do, where to go, or how to do it. This EXCITING 175 page, 14 chapter, E-Book will cover everything from the World Wide Web, Veronica, IRC Clients, Gopher, Telnet, Advanced Email, and how to set up your own electronic store front. Whether you're a veteran on the net or have just begun, there is something to LEARN from "Your Personal Guide to the Internet". The Internet is growing daily and it is quickly becoming the wave of the future. Have you ever wondered what people are talking about when they mention FTP or client-server protocol? Has it made you feel left out when you didn't understand their lingo? Everyone knows that KNOWLEDGE is POWER, so why not learn more and take advantage of it? Picture this. You buy a beautiful boat, and you go to take it out on the lake. You get there, you can start the boat, but can't get it to go anywhere. That is how many people are on the Internet. They have the software and the ability to go online, but don't know what to do with it. This is where "Your Personal Guide to the Internet" comes in. Just as a boat manual would have been useful to allow you to go on your trip, this guide will allow you to do just about ANYTHING that you can imagine on the Internet. So, how much will this knowledge cost you? Simply, $4.00! That's right, FOUR DOLLARS. Why are we selling it for a such a LOW PRICE? We feel that everyone who is online should be able to use the Internet to their full capabilities. Why go to the bookstore and spend $50 to $100 on Internet books, when you can get everything you need for $4.00? This is a MUST HAVE! Do not pass up this OPPORTUNITY! This is a LIMITED OFFER. **** If you order within 10 days, As a SPECIAL BONUS, you will also receive "1000 Places to Advertise for Free"! **** ORDER FORM (print this out and mail it along with your cash, check or money order): Name ______________________________ Address ____________________________ City _______________________________ State_______________________________ Zip Code ____________________________ Phone Number (if sending check) ______________________ Email Address ________________________@_______________________ Would you like this on diskette ($7.00 includes S & H) or emailed to you for only $4.00? (circle one) Make All Checks Payable To: Creative Financial Alternatives Send check or money order to: Creative Financial Alternatives 14837 Detroit Ave. Suite 135 Cleveland, OH 44107 ***Orders will be shipped within 48 hours upon receipt.*** ***Please Note: All checks are held for 5 business days.. ***Due to the Overwhelming demand Please Don't Reply Back By E-Mail.

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:11 ìì 16/11/1996 -0800, Sandy Sandfort wrote: >> ...I would gladly write articles on Dimitri's expulsion and the >> facade of Free Speech in mailing lists etc.,...But since I have >> no time, it's likely someone else will report this. > >What was that from Thomas Paine about summer soldiers and >sunshine patriots? Three cheers for George and his commitment >to "Free Speech." I know I'm impressed. You mean that if I launched an entire publicity campaign against the censorship of Dimitri Vulis and similar evils, I would not thoroughly enjoy it, or not get paid the newspapers here, for it? (the standard rates per column)? Poor soul! :-) What you see as 'voluntarism' or 'sacrifice' is in reality quite the opposite. Which is why... NOT writing about it is an act of generosity, NOT the other way round. (Which is why I'll make sure SOMEBODY writes about it). Tsk, tsk, tsk George

1 0

Re: RFC: A UNIX crypt(3) replacement
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 08:51 PM 11/16/96 -0800, "Joshua E. Hill" <jehill(a)w6bhz.calpoly.edu> wrote: > I'm trying to think of a function to replace UNIX's crypt(3). >My design criteria are as follows: ... >NMAC(k, m) = H(k1, H(k2, m)) .... >Would (n . P . n ) be better? NMAC is probably a bit stronger, but the real question is why you want to reinvent crypt(3). It was fine for logging in from a hardwired or dialup dumb terminal, but in a network environment you really need some sort of one-time password system. S/Key, for instance. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

RE: Another apologist for John Gilmore's censorship
by blanc 17 Dec '03

17 Dec '03

From: Dr.Dimitri Vulis KOTM dv: Why the quotes? John Gilmore censored me with no quotes. bw: Don't worry about it. dv: No. John Gilmore's actions are contrary to free speech, but his own principles clearly don't include free speech. He has no credibility. bw: I guess you think this will bring me anguish. dv: Not true. An honorable person would tolerate all speech and either ignore it or respond with more speech. A dishonorable person, such as John Gilmore, seeks to silence the speech he doesn't like. bw: You're not obliged to be dishonorable even if others are. dv: .....Note also that he hasn't pulled the plugs of other very rude people, like Timmy May (fart). bw: He's not obliged to be rude only according to your preference. dv: Speech is not action. Action is not speech. bw: But the principle regarding the tolerance of insults is the same in both cases. dv: I don't think John Gilmore's sexual practices are *that* bizarre. The Kinsey report estimates that 10% of the population shares his practices. bw: I guess you think you're talking to someone who gives a flip. .. Blanc

1 0

Re: [REBUTTAL] Censorship on cypherpunks?, from The Netly News-Reply
by Raymond Mereniuk 17 Dec '03

17 Dec '03

>>> aga <aga(a)dhp.com> 11/16/96, 02:26am >>> On Fri, 15 Nov 1996, Bill Frantz wrote: >Yes it WAS!! He censored the mode and manner of the speaker. >He censored the personal attacks and the rants and the racial >diatribes! And that SUCKS! Gilmore was a fucking asshole for >doing it! And Gilmore is the WORST kind of censor that there >can be, one who censors a person's "style." >-aga.admin >InterNet Freedom Council You state that Mr. Gilmore censored someone but yet I still see that someone's messages being propagated by `cypherpunks(a)toad.com'. If Mr Gilmore was really trying to censor someone he sure did a bad job of it and can be criticzed for that much as I still see mail from the censored party. Have you every lived, or been involved, in a society where censorship, or local distortion, of facts was the norm?? Do you have any idea how the powers that be discredit any voice in which they don't like the message (or even the tone) and the lengths they go to ensure the offical line is only one which is presented in a reasonable form?? Have you ever been arrested and interrogated by the local anti-corruption police because you made too much money and dealt with a company where one particular person was known to accept brides so therefore you must be corrupt?? So far no big deal, a simple misunderstanding - but the anti-corruption police know how you live your life and since you work long hours you must be cooking the books. There is censorship in this society but it is so not so blatant and is probably more dependent on what the established media choses to report or not report. Mr. Gilmore only made it slightly more difficult for one particular player, who was misbehaving badly, to be heard but did not totally remove that player's ability to be heard. If you are truly concerned about censorship you should be more concerned about how the current administration's polices in regards to cryptography will affect your future freedoms to communicate in a manner in which is completely private and will subject you to no government review of the subject matter discussed. Virtually Raymond(a)advcable.com

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 05:08 ðì 17/11/1996 -0500, Black Unicorn wrote: >The problem with people too used to dictatorships is that they grow >so accustomed to taking those favors and incentives which are dictated to >them that the freedom (and responsibility) of "financial gain" seem like >too much work. Boy oh boy!!!! :-) Financial Gain being "too much work"??? :-) Hey dude, I work for myself, you know. Ever since childhood, I learned how not to rely on ANYBODY. I experienced no "favors" nor "incentives" whatsoever, all my life. The taxation here is designed to drain the blood of all SMALL businesses (like mine) and favor the big businesses. There is very poor welfare here, too. America is almost... socialist in some respects compared to the Greek welfare state. Your 'model' of what's going on is more appropriate for the Russians and the Eastern Block (former) dictatorships, in which case I agree! :-) >The free market will ever be the only real path to free speech, because, >in essence, it is free speech. The free market is the _precondition_ for free speech. But Free speech does NOT necessarily follow from it. What happened in GREECE and CHILE in fact is a living proof of this: Such countries had ENTIRELY free market and NO FREE SPEECH. This is right-wing fascism, as you know. I hope you agree with these clarifications. I don't see why not... >Much easier to just work for food. "The all-knowing General Pinoriega >would have given us money if we needed it." The 'all-knowing' dictators of Chile (installed by US involvement) gave NO money to ANYBODY (but big businesses and American corporations). As for the Nicaraguan case, the scandal of the C.I.A. financing the contras using drug-money from selling drugs to American Blacks has been thoroughly exposed in the rest of the world. The only 'all-knowing' philanthropists around the world have been the Stalinist lunatics who are nowdays replaced by (more 'professional' Mafiozos). You should be glad to be American, in fact! :-) (At least you are ruled by the Trilateral Commission; the Mafia plays only a secondary role in your politics). :-) >Of course the result is an increased dependence on the state. We never run out of saliva spitting on the face of the (Greek) state over here. Same is true all over the world... >Market economies which approach true "free market" status provide no >foothold for regulation. You cannot really have one without the >other. This is a big discussion. The free market _is_ the only way. I agree. However, as I explained in another (private and humourous) posting, for instance, I am a winter-swimmer, and use the facilities of a beach run and owned by the State here in Greece, which will probably CLOSE DOWN, as soon as it is privatised. At the moment, it's a gift to us -10 or 20 'winter-swimmers' operating at a loss, not a profit. One must be on guard for extreme views, neo-liberal or otherwise)... :-) >(Note the coming backlash against free speech and free markets in >the United States). I am in solidarity with your worries, and in favour of both. But... Sometimes one does not 'automatically' imply the other. >Free speech does not, however, require that all speech be universally >broadcast to each and every citizen on the planet free of charge. That's >"subsidized speech." How much should I be charged for every word I utter? In 1990 I was being PAID for every word I wrote. Not so anymore! :-) :-) At least you could afford (as the English say)... 1 penny for these thoughts! ROTFL!!!! :-) >Consider long and hard if that is the path that you would like to take. Me? I voluntarily waste my time, dude, to write my opinions for free! :-) It's the last thing I do for free, after some rare friendships and other rare precious things in life. Don't we al have such things? :-) If we don't write _some_ opinions for free we'd all become... whores waiting for the next pimp to exercise 'list-owner's rights on our speech. Or get bribed to tell lies, and so on! :-) :-) Perhaps my clarifications helped. George P.S. In Logic, Complete Systems are Consistent, and Consistent Systems are Incomplete. Thus, 'extreme views' of any kind are impractical. (theorem of Goedel in Logic and Mathematics applied in practice).

1 0

Re: Censor John Gilmore -- EFF is a disgrace!
by George A. Stathis 17 Dec '03

17 Dec '03

At 05:51 ðì 17/11/1996 -0500, Tim Scanlon wrote: >George A. Stathis wrote: >> This was my objection also inside the F-K list, for _some_ of the postings >> in the past, but none of these postings was connected with acts of >> censorship, or with "sweeping generalisations" without evidence. On several >> occasions that I searched and found who or what they were talking about, >> I discovered they were talking about people whose activities were indeed >> horrifying (forged cancellations etc) and who also fought back. > >Horrifying eh? Hmm I found this just a bit to priceless to resist. >I guess it falls under the old 'but I'll defend your right...' way >of looking at things... > >In any case, here you go, this is the latest contribution of software >from Dimitri to the values of freedom of expression and non-censoring >& all that blather. > >#From Phrack 49, file p49-09 published this month: > .oO Phrack Magazine Oo. > > Volume Seven, Issue Forty-Nine > > File 09 of 16 > > by Dr.Dimitri Vulis (KOTM) > > A Content-Blind Cancelbot for Usenet (CBCB) > >And what follows, is Dr. Dimitri, defender of freedom of expression, >champion of the anti-censors on the net, posting code to the world to >engage in exactly those activities that everyone has been ranting about >as being so utterly "horrifying (forged cancellations etc)" as it were. > >Amusing to say the least. > >Tim Well, this is why we _NEED_ this discussion; we _NEED_ Dimitri to explain his ideas and his critics ALSO to explain his ideas. My guess is that Dimitri's 'CANCELBOT' is intended to remove pure spam. A little while ago, I received Spam from the same source an 8th time. It even automatically replied to my... complaint AS IF it was not a complaint but a request for info, and it also... forged my E-mail address. If Dimitri Vulis (and others) possess the technical genious to relieve us of such very annoying spam-problems, I don't see at all how this contradicts Free Speech, or the right of people to speak when invited to open meetings. In any case, I am extremely greatful for the info, and would appreciate the full text and the sources of it. Cheers George

1 0

Re: Does John Gilmore...(CORRECTION)
by George A. Stathis 17 Dec '03

17 Dec '03

At 12:40 ìì 17/11/1996 -0200, George A. Stathis wrote: >In Logic, Complete Systems are Consistent, and Consistent Systems >are Incomplete. Thus, 'extreme views' of any kind are impractical. >(theorem of Goedel in Logic and Mathematics applied in practice). Boy oh Boy! time to flame myself this time: "Complete Systems are INconsistent, and Consistent Systems are INcomplete". At least in the Predicate Calculus. This is why I look forward to Dimitri explaining his 'Cancelbot' in detail. It's possible that the _misuse_ of such an innovation would be against the original goal (of Spam-elimination etc). In any case, while you all go to sleep, it's me for me to do some work! :-) George

1 0

Re: A word on "emergencies" [WAS Re: Final Solution to the Crypto ]
by John Young 17 Dec '03

17 Dec '03

Michael Froomkin wrote: >Rather, my point is a simple one. The fact that the President has >declared an emergency here is primarily a technical legal event. It is >not a sign that martial law is about to be declared, that they are coming >to take you or your [fill in blank] away, or that anything fundamental has >changed. Multi-year emergencies in which the executive uses one statute >to compensate for the Congressional decision/failure to pass another >statute is not, I submit, a particularly telling sign of a mature and >healthy democracy. But this goes to large and gradual processes, not to >anything that suddenly happened. Thanks for the steady-hand reassurance. Your papers are balm. Was it not Hal's original ironic lament about the current charade -- that it's business as usual among the jaded insiders who are confident that they know how power really works. The disdain for public accountability -- cynical extension of declared emegencies well past their time -- is what breeds the desire of outsiders to protect themselves from insiders. Hence, the desire for crypto, especially the cryptanalytic kind that ventilates those privileged inside communications. The battle may be between cryptogologists and lawyers, it seems to me, the struggle for supremacy between privacy-protecting code and privilege-protecting secrecy. Hoary national security proclamations have become much more lethal munitions than cryptography, and it is these incitements that need ... what, X-rating? What can be done to supplant these thrilling, crowd- rousing proclamations of national threats -- ancient, vulgar strategems around the globe?

1 0

Re: Could Declan or some libertarian explain this?
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dale Thorn wrote: >Could someone explain to me why we have to have *any* censorship, if >people on a list are given tools to filter with and reminded on occasion >how to use them? You are the reason, you can't shut up and you have little or nothing to say. plonk.

1 0

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 4:11 AM 11/17/1996, Black Unicorn wrote: >On Sat, 16 Nov 1996, Huge Cajones Remailer wrote: > >> Date: Sat, 16 Nov 1996 18:22:33 -0800 >> From: Huge Cajones Remailer <nobody(a)huge.cajones.com> >> To: cypherpunks(a)toad.com >> Subject: The Utility of Privacy >> >> >> Privacy is a hassle. Is it worth it? >> >> Which unfortunate situations does privacy prevent? What are the odds >> that they will occur? How much effort will it take to prevent these >> outcomes? As a model, use the present and future situation of a >> typical reader of this list. > >Insurance is a hassle. Is it worth it? > >Which unfortunate situations does insurance prevent? What are the odds >that they will occur? How much effort will it take to prevent these >outcomes? As a model, use the present and future situation of a >typical reader of this list. I know many people who were happy they had insurance due to car accidents, health problems, or whatever. What is more, the odds of these events are carefully calculated and available. Call an actuary. Are there similar sources of information calculating privacy risk? I don't think so. Informally, I don't know anybody who has suffered due to a loss of privacy. It may be the case that it is politically beneficial to have a society of privacy fanatics. But, this is different from the direct benefit to each participant. My question remains unanswered, probably because privacy isn't worth the effort.

4 3

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 10:49 PM 11/16/1996, Hal Finney wrote: >David Brin has an article in the December issue of Wired arguing that >privacy is obsolete and was never that great an idea in the first place. >Maybe you'd say that all of these people should expose their secrets, or have >them exposed for them, and that the world would be a better place. (Actually, >you do seem to say this, and I'll discuss it later.) >I really don't think we have any right to second-guess the decisions people >have made about what they will reveal and what they will keep private. This is not my claim. If free citizens go to the trouble of protecting their privacy, good for them. How important is it that I should do so?

1 0

GIV_eus
by John Young 17 Dec '03

17 Dec '03

11-16-96. WaPo: "Air Force Halts Merger of SAIC and Aerospace. Feared Change Could Affect Spy Program." Aerospace has analyzed all aspects of the nation's super-secret satellite and rocket programs, as well as space companies' most sensitive proprietary data. The Air Force's clubby classified space office feared changing Aerospace's status could disrupt operations. Many defense contractors have complained about such feared contracts for insiders, begging: god, give us. ----- http://jya.com/giveus.txt (4 kb) GIV_eus

1 0

Re: AGA'S LIMITED VOCABULARY
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:37 ðì 17/11/1996 -0500, aga wrote: >> about the use of technology to protect privacy. Perhaps you >> were confusing it with that other list you are on: >> alt.sex.yourmother. > >No, it is your mother I have been fucking. Pity! Aga should respong to this lady's needs FIRST! :-) BTW, (paraphrasing Speedy Gonzales)... I think she really fucks for money, but since you are an aga she'll fuck you for nothing! :-) >> > What year did you graduate from Law School? >> >> Irrelevant, but it was 1975. More importantly, though, when did >> YOU graduate from law school? > >1975. And my school was better than your school. > >I was the fucking class President in Law School. We >fucked on Library tables at Pitt. Where the fuck did >you go to school? I can see the beginnings of an... S/M cyber-romance in these lines. ROTFL!!! Aga should not forget to carry a... cane in his briefcase. The more arrogant they sound at first, the more submissive their fantasies are! (ALL masochists in fact). :-) Love and Jelly Babies George P.S. My first guess is that Sandy is a Piscean, and Aga is a Taurus. It would work out better with him being a Scorpio or a Leo, however. (My second guesses on Aga). My second guess on Sandy is that she's a Virgo, however. In this case avoid her at all costs! ROTFL!!!!

1 0

Re: A word on "emergencies" [WAS Re: Final Solution to the Crypto ]
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Professor Michael Froomkin penned, amid the "freedom knight" noise: <snip> >my point is a simple one. The fact that the President has >declared an emergency here is primarily a technical legal event. It is >not a sign that martial law is about to be declared, that they are coming >to take you or your [fill in blank] away, or that anything fundamental has >changed. OK, let's fill in the blank. Gun. I have heard noises that sound like you wouldn't mind this, even though I am totally peaceful and would never want to shoot anyone absent extreme provocation (such as armed invasion of my home). The way I see it, martial law could be declared at any time, or it could slowly be declared now, which I think is happening. Checkpoints and house-searches for drugs and drunks are to get us used to checkpoints and house-searches for guns and unauthorised crypto. This is only my opinion, and I fear revealing my identity publicly because people with guns are starting to get used to hiding our emotions if we are peaceful and harmless, like me. I rarely even go to the range and practice anymore (2-4 times a year). I can imagine my kids feeling the same way about sending messages with strong crypto protection. >Multi-year emergencies in which the executive uses one statute >to compensate for the Congressional decision/failure to pass another >statute is not, I submit, a particularly telling sign of a mature and >healthy democracy. But this goes to large and gradual processes, not to >anything that suddenly happened. Why am I thinking about boiling frogs now?

1 0

Re: Crypto Bounties: Another Thought that crossed my mind.
by azur＠netcom.com 17 Dec '03

17 Dec '03

Eric Hughes gave a two-part presentation at DEFCON IV, which he has subsequently polished up, that addresses: 1. ways to implement a Universal Priacy System that enables simple and anonymous data hiding using the existing Net facilites, and 2. a system of intellectual property distribution and funding which is based more closely on models used in Hollywood (e.g., completion bonds). Eric, what's the status of your proposal? -- Steve >Here we go again: > > There are is a lot of software that we would all like to see >developed and deployed right? > > There are a lot of people out there who write code, sometimes >even freely redistributable code, but they have to eat, and get their >net access right? > > Well, I was thinking, what if a "Crypto Software Bounty Server" >were set up, so that someone could propose a tool that they would like >to see, along with an initial bounty. Others could contribute toward that >bounty (anonymously if they wish) until either the tool was delivered. > > The original issuer sets standards for the software (i.e. "easy to >use interface to mixmaster remailers for Macintosh", then must define >easy to use; Software considered delivered when in [alpha beta late-beta >&etc.]). The first to present software meeting these qualifications gets >the bounty, with the caviate that the software must be either gnu-copylefted, >or some similar "free use" copyright, after all, "The Net" paid for it... > > Some of the problems (and potential solutions) I can think of in this: > > 1) Refusing to honor the contract--Maybe when a project is proposed, > some other people (for a small percentage of the total) sign on > as judges. When they feel that it reached the stated goal, then > it is done. -Or- Money put up is non-refundable, and the bounty > stays in the "bank" until claimed. > > 2) If the money stays in the bank until claimed, people might not > put up that much (or enough) to make a specific project worthwile-- > > This could be solved by allowing the "bounty" to lapse in one > of 3 ways: > > A) <x> length of time after the initial proposal (bad because > i) someone could already be working on it; ii) bad because > other people might add to the bounty, so a potential programmer > might not start until the "pot" has grown to a certain level. > > B) <x> length of time after the last addition to the bounty, > bad for both i & ii above. > > These can both be gotten around (and other problems) by allowing > programmers to "register" with the service that they are working > on a project (either anonymous registery, so that people will > still contribute to the project, or list those registered so > that people know [if who] someone is working on it) > > 3) Funding: The server (in both the machine and the organizational sense) > could be funded by: > > A) Interest on the money accumulated. > > B) A percentage of the bounty (say 10%) > > C) Both A & B. > >Has anything like this been proposed before? I know that the FSF (IIRC) accepts >contributions, but I am thinking of something more targeted, more "market >driven" if you will. > >This could be expanded to non-crypto software as well, just think, if half >the X Window users ponied up $5 a peice for a "good, easy to use non-motif >word processor", how long do you think it would take for someone to start >coding a MS Word killer? > >Comments? > > >Petro, Christopher C. >petro(a)suba.com <prefered for any non-list stuff> >snow(a)smoke.suba.com

1 0

Strong Encryption for International Versions of Netscape
by Scott Weisman 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE: November 17, 1996 ANNOUNCING STRONG ENCRYPTION FOR INTERNATIONAL VERSIONS OF NETSCAPE JERUSALEM, Israel -- SecureScape Technologies announces the alpha release of its first product, SecureScape. This revolutionary program offers international users of Netscape Navigator the same strong encryption as that enjoyed by users in North America. All software encryption products developed in the United States are subject to export restrictions. Such exported software is subject to an arbitrary 40-bit key length, compared to the 128-bit (or greater) key length commonly found in domestic software. This weakened software is in certain ways inferior to no encryption at all, since it gives users a false sense of security. The Executive Order by President Clinton on November 15, which modifies U.S. Government policy on export restrictions, still requires requests for export permits to be considered on a case by case basis. Furthermore, it is very likely that strong encryption products will be granted export permits conditional on key-escrow or other compromise arrangements, because the Executive Order states, "the export of encryption software . . . must be controlled . . . such software shall not be considered or treated as 'technology'." Implying that encryption software is still considered a form of munitions. The irony, of course, is that strong encryption has been widely and easily available outside of the U.S. for years. SecureScape was developed using the freely available SSLeay library, developed by Eric Young of Australia. SecureScape Technologies was founded by Scott Weisman, a software developer residing in Jerusalem, to develop and market Internet security products. The company is seeking investors interested in a strategic partnership. The SecureScape home page is located at <http://www.SecureScape.com/secscape/>. SecureScape currently works with Netscape versions 1.1 or later on the Windows 95 and Windows NT platforms. CONTACT: Scott Weisman P.O.B. 31194 Jerusalem 91311 ISRAEL sweisman(a)SecureScape.com © 1996 Scott Weisman - All Rights Reserved. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation. SecureScape uses software developed by Eric Young (eay(a)mincom.oz.au)

1 0

Unsubscriving Briefly
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I'm unsubscriving from the list for a few days (weeks?) until the noise level drops down a bit. I'll check it periodically on the Web and I'm pretty sure that if something happens that shakes the world of cryptography to its very foundations, someone will probably send me some email about it. Please continue to party while I am away. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Please take me off the list
by Tom Van de Wiele 17 Dec '03

17 Dec '03

Sir Please take me off the list. Thanks Tom Van de Wiele -- tomvdw(a)glo.be

2 1

Re: [NOISE] aga isn't on cypherpunks... (and I'm glad)
by Sven 17 Dec '03

17 Dec '03

>> I have a suggestion... How 'bout if everybody on this list dropped >> a procmail configuration that mailed aga(a)dhp.com and postmaster(a)dhp.com >> a copy of every message that originated from aga(a)dhp.com? Do you think >> he would start to "get it" then? Why are these people so uptight? Sven MOSER016.JPG |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

4 3

Re: MSIE 128 Bit
by Alex de Joode 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM (dlv(a)bwalk.dm.com) wrote: : Steve Shelby <sshelby(a)feist.com> writes: : > : > Microsoft has a 128 bit version of their Explorer available. : > : > You have to jump through a few hoops, but they have it. : How about maiking available on a European mirror site with no questions asked? ftp.replay.com/pub/replay/pub/incoming/0-microsoft/ has one 128 bit version. -- Alex de Joode http://www.replay.com/people/adejoode I have a linux emulator for Win95: it's called "loadlin" ... *g*

1 0

RE: The Utility of Privacy
by blanc 17 Dec '03

17 Dec '03

From: Hal Finney You suggest that the main motivation which someone might have for protecting privacy is that they are engaged in some illicit activities: page 45: "Why should I really care if someone sees this? I have nothing to hide." ..................................................... This statement from David Brin impressed me with the consistency of a certain way of thinking that some people have: "I think that having a minimum standard of living is good, therefore everyone should be coerced to contribute to the general welfare." On the other hand, "I myself have nothing to hide, therefore no one should be concerned (read: permitted) to do so." The issue for them in regard of what everyone should/should not do, is whether anything is logical as far as they themselves can see - and the logic revolves around what they themselves think is right; the extent of their own vision is considered sufficient to determine the parameters of everyone else's life & actions, and therefore sufficient cause to have their measures imposed over all. But this letter of Hal's brought up an important point: that even if a person has nothing to hide, it is not the openness or closedness of information which is of concern, but the *responses of others* to that information. When an individual wants to live a free & open life, they expose themselves to dangers. In order to be free to roam, they must have a way to protect themselve from all manner of destructive influences - the weather, predatory animals, vicious strangers, etc. There must be a way to protect what is one's own in order to preserve it. If it was easier for everyone to defend themselves against attacks on their person or reputation, maybe there would not be as much concern about privacy. Perhaps if a person could "get away" from others, could continue to have a normal life without too much disruption, once some exciting bit of info was out in public, if they could maintain command over the effects upon their life despite living in a fishbowl, then no one would worry quite as much (although the principle of personal control over one's property remains the same). But in the meantime, we have but few ways to protect ourselves under the centralized arrangement for protection (police, defense agencies). Anyone in a government position is aware of how their public expressions can result in public outcries against them; the secret agencies protect their information files because of what "the enemy" would *do* if they found out about these - even if the agency itself does not consider its activities immoral. If Information is like munition, privacy is like defense - it is a form of self defense. .. Blanc

1 0

Re: Members of Parliament Problem
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:39 PM 11/17/1996, Simon Spero wrote: >On Fri, 15 Nov 1996, Rich Graves wrote: >>Peter Hendrickson wrote: >>> There are times when one wishes to speak anonymously, yet speak >>> as a member of a group. >> You either need to trust a shared server to know and then blind your >> identity, or trust the people with whom you share a secret key not to >> give that key to non-group members. > Why not use blinding for obtaining the certificate? > Create a number up public/private key pairs, blind them, then do the > cut-and-choose thing with the security officer. He signs the blinded key, > then returns it. Unblind the remaining pubic key, and you've got a public > key with the appropriate signature on it. Okay, this would work. But, it requires that all (or at least many) of the Members of Parliament cooperate. If not, then the security officer will be able to make very good guesses about who is speaking. Parliamentarians may not cooperate for a variety of reasons. They may not wish to be attacked by terrorists for the words of others. They may believe that cowardice is not to be encouraged. They may not believe in anonymity. It might be too hard for them. What I would like to see is a method which relies only on published public keys and no other cooperation from the people who are (more or less) being used as shields. This may be impossible. (A number of people have posted references to other ways of doing this. I have yet to track down the references they gave so I don't know if any of them fit the bill.) Peter

3 2

Re: Computer CPU chips with built-in crypto?
by Hal Finney 17 Dec '03

17 Dec '03

From: Martin Minow <minow(a)apple.com> > I'm not sure if I can answer this but, at last week's SF cypherpunks > meeting, an Intel engineer asked whether there might be any interest > in a computer chip with some sort of encryption mechanism built > into the chip. As I understand it, this chip would process an > encrypted instruction stream. I.e., it could not execute a program > unless the "key" for that program was first loaded into the chip. > > An interesting idea: does anyone have more information? This sounds like something which might be used in a set-top-box or "information appliance" application where pay-per-use programs would be loaded from a CDROM or network connection. People have been dreaming about pay per use software for many years. It is a similar idea to the "mini application" concept which would replace the monolithic super-apps, the Microsoft Words and the giant do-everything web-browsers/newsreaders/mail-clients, with small, single function utilities. This is part of the idea behind Apple's OpenDoc and Microsoft's OLE. In the same way, instead of buying a big program for hundreds of dollars, you'd just download and use the functionality you needed for a small fee. Yet in practice it is not clear whether either of these trends will have any market success. Monolithic applications seem to be doing very well, with more integration being the trend, not less. And the whole idea of introducing metering to a market which is used to paying just once for access is one which is bound to meet resistance. Look at AOL which is going to single-charge unlimited access to the net. So in both cases the trend looks to be going in the opposite direction. Another possible application for the built in encryption is software piracy protection. You'd unlock software for your CPU but it would not run on anybody else's without a different key code. Here again there is not much benefit to the end user, unless software prices come down dramatically when this device is used. But otherwise the computer manufacturers are selling computers which have features which will limit the powers of the buyers, and having to sell them more expensively to boot because of the special chip. In these days of razor thin profit margins in the PC business it is hard to see how this will sell. Hal

2 1

[NOISE] Want to know about this "aga" character? Read the Grubor FAQ!
by Alan Bostick 17 Dec '03

17 Dec '03

In case you aren't clued in enough to know, "aga(a)dhp.com" is none other than John Grubor, well-known Usenet Kook Of The Month winner for November, 1995. He *cannot* be reasoned with. Don't even try. He makes Dimitri Vulis appear sane, calm, and rational. Read the Grubor FAQ, http://kendaco.telebyte.com/dharland/Grubor.FAQ.html for more details. Alan "pseudonum of the LYING FORGER PETER VOROBIEFF!!!!1!" Bostick -- Alan Bostick | You know those chemicals women have in them, | when they've got PMS? Well, men have those very mailto:abostick@netcom.com | same chemicals in them *all the time*. news:alt.grelb | Margaret Atwood, THE ROBBER BRIDE http://www.alumni.caltech.edu/~abostick

3 2

Re: Censor John Gilmore -- EFF is a disgrace!
by Dave Hayes 17 Dec '03

17 Dec '03

[Multiple CC's trimmed, I don't think anyone at msn.com cares...] > #From Phrack 49, file p49-09 published this month: ... > File 09 of 16 > by Dr.Dimitri Vulis (KOTM) > A Content-Blind Cancelbot for Usenet (CBCB) ... > And what follows, is Dr. Dimitri, defender of freedom of expression, > champion of the anti-censors on the net, posting code to the world to > engage in exactly those activities that everyone has been ranting about > as being so utterly "horrifying (forged cancellations etc)" as it > were. You call yourself on cypherpunks, and you blithely assume that a Phrack author actually signs his real name? Either I thought you guys were *real* hackers and you aren't, or this is a very funny troll. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "Better to be safe than to be sorry" is a remark of value only when these are the actual alternatives.

3 2

Re: Does John Gilmore...
by Dave Hayes 17 Dec '03

17 Dec '03

> The free market will ever be the only real path to free speech, because, > in essence, it is free speech. > Free speech does not, however, require that all speech be universally > broadcast to each and every citizen on the planet free of charge. That's > "subsidized speech." Given that the free market rule is "he who has the money makes the rules", please explain how anything less than "subsidized speech" (as you put it) is anything close to free speech? [For those who's assumptions rule their perception: I am *not* arguing that all speech should be subsidized. I am merely pointing out that the organization that is spending the money to broadcast is controlling the speech, hence it is *not* free speech in terms of freedom or cost.] ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet If you want to get rid of somebody, just tell them something for their own good.

2 1

You ought to REALLY look at this...
by George A. Stathis 17 Dec '03

17 Dec '03

Ladies and Gentlemen, I hereby quote a rather remarkable letter, which I pass on to whom it may concern. I consider it an _honour_ to have received such a letter, even though the material expressed in the letter is a serious assault on the entire Western Value System, and possibly Civilisation itself, no joke. At first I did not believe such a *terrorist* letter could have EVER been written. And I could never believe myself to be the recipient of it either. But now I strongly recommend you read it carefully and think about it... For your OWN benefit, I believe more than mine... With thanks for your attention George A. Stathis P.S. If you take a deep breath, see my (amusing?) comments in the end. :) >Hops: 0 >Posted-Date: Sun, 17 Nov 1996 20:13:15 -0200 (GMT) >X-Sender: tcmay(a)mail.got.net >Date: Sun, 17 Nov 1996 10:18:36 -0800 >To: "George A. Stathis" <hyperlex(a)hol.gr> >From: "Timothy C. May" <tcmay(a)got.net> >Subject: Stathis on "Don't Hire" List >Content-Length: 1426 > >At 9:00 AM -0200 11/17/96, George A. Stathis wrote: > >>It is not ethical to send such strong negative _injunctions_ to masses >>of people and also to strangers (the 1900-strong members of the cyberphunks >>list for instance). Because, you may or may not have strong reasons for >>believing you are justified in such invalidation, but more than a 1000 >>people are now _told_ by (self-appointed) "experts" such as yourself what >>and whom to ignore or to believe. (Like sheep led to the slaughter)... > >"Not ethical"? > >But we will do it anyway. Moreover, some of us maintain lists of "Do Not >Hire" persons. Few high tech or Silicon Valley software companies will hire >such folks. > >Congratulations, Stathis, as you are now on such a list. > > > >"The government announcement is disastrous," said Jim Bidzos,.."We warned IBM >that the National Security Agency would try to twist their technology." >[NYT, 1996-10-02] >We got computers, we're tapping phone lines, I know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1,257,787-1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." Comments? (1) Well, first of all, Tim May is doing a disservice to the companies who use his services. They will end up hiring only morons and controllable relics of human creativity; Which is why there a WORLD-SHORTAGE of SUPER- PROGRAMMERS at the moment, as reported e.g. by Byte-magazine. (2) If I were a _clever_ American employer, I'd use Tim's 'black list', in order to HIRE precisely those people whom he considers 'unemployable'... (3) Now I don't want to boast about who I am, but it's strangely ironical that I _am_ one such "Super-Programmer" (fluent in PROLOG. Assembly, 'C' and also... English -a computer-lingo as it happens). In the eighties I was also a painter (of pictures, not walls), and other things... As a 'New Age' kind of person, I used to admire America for rewarding and promoting human _talent_, as opposed to human mediocrity, subservience (the "Yes-Man" attitude), and Evil in the Soul. (as often happened in old-whore Europe; especially in Greece)... :-) Nowadays, however, when 'people' like Tim May, are able to dictate to your admirable High-Technology firms, *what* kind of people to hire and what not to hire, I can see... very gloomy prospects for American Research, _if_ this type of monstrocity (as his letter) is prevails for too long... :-) Originally, lists of "unemployable" people, which I had heard of, crossed my mind as 'probably justified'. As an EMPLOYER MYSELF, with a small but strong software-house, here in Athens, with at least one important Market Success, I do have some experience, you know, of what kind of people *are* and what kind of people are *not* 'employable'. I once knew a very good but very egotistic Assembly Language programmer. When he stopped working with me he stole large sections of my source-code. As a result, I find it hard to trust 'employees' ever since... (4) I would therefore request a list of 'unemployable' people in order to choose possible collaborators, in my work. They should be highly proficient in PROLOG code, as well as ASSEMBLY and 'C', and should also be sociable, witty and independent-minded. Clashing with personalities like Tim May's may be considered an added advantage. (5) Just for the record, I spoke on the phone with an important partner, told him what happened, and was told by him that Tim May's letter is the kind of scum-fascism no serious European Company would ever give credit to... However, Tim's letter appears not so much to address me personally, as much as the hordes of gullible, insecure, employment-hungry young Americans, who are often _terrorised_ into complete SILENCE, since the _slightest_ amount of free speech in their own natural (or Net-) surroundings, causes Fascist PUnk-Thugs like TIm May to threaten them with unemployability. Although Tim May's letter in itself constitutes terroristic harrasment, threat to libery (via threat of unemployability), and so on, I consider these labels to be irrelevant in this case, and legal arguments highly irrelevant. When Nazi Germany deported Einstein it took much less elaborate procedures than flawed 'unemployability lists'. Perhaps hiring Mafia men to finish us off would be a much more efficient tactic in this respect. :-) With Dismay, but also... Inspiration :-) Geore A. Stathis P.S. I also cross-posted this DELIBERATELY, this time to the cypherpunks list, in order to give more COURAGE to those poor list-members whose standard of living suffers the terror and threat of Unemployment, just in case they know who is responsible for their future sufferings.

1 0

Re: Giving Kill Files a Workout...
by Dave Hayes 17 Dec '03

17 Dec '03

Dimitri Vulis writes about unwanted noise: > They feel compelled to silence it altogether. They claim altruistically > that they don't want the noise to bother anyone else, such as the clueless > newbies who keep subscribing to this mailing list and don't know how to > use mail filters. (Sandy Sanford's concern for them was soooo touching...) Misplaced altruism is one of the primary causes of social injustice, authoritarian regimes, and security measures. It is not possible to be "altruistic" until one realizes that one doesn't know what true "altruism" is. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't follow in the footsteps of the ancients, seek what they sought.

1 0

Cpunks Frog Forwards discontinuation
by Damaged Justice 17 Dec '03

17 Dec '03

I will be discontinuing my "Cpunks Frog Forwards" filtering service within one week of the announcement of Perry Metzger's new crypto list, and possibly sooner if my patience runs out, because 1) I have too many other things to take care of in my life, 2) there really isn't as great a need for it anymore due to the number and variety of other filtering services, and 3) my sanity is being stretched to its limits having to wade through the mountains of bullshit that now infest my inbox, even with procmail's kindly assistance. Perry was right: Cypherpunks has become a sewer. As Robert Anton Wilson said, "Only a sewer accepts everything." Here is a list of the other filtering services I am currently aware of: o Alan Clegg runs an UNMODERATED cypherpunks digest, which only reduces the the volume of separate messages. Subscribe by mailing to majordomo(a)gateway.com (Standard majordomo list -- send "help" in the body for information.) o Eric Blossom runs a commercial "Cypherpunks Lite" for a modest fee, approximately 20.00US/year. Mail eb(a)comsec.com for more info. For a sample, read the archive at ftp://ftp.crl.com/users/co/comsec/cp-lite o Ray Arachelian runs a free filtering service, sticking mostly to news and technical stuff with a few other tidbits thrown in. Mail sunder(a)dorsai.dorsai.org for more info, or to be added. See you all on the other side. "Cypherpunks write code." -- I let go of the law, and people become honest / I let go of economics, and people become prosperous / I let go of religion, and people become serene / I let go of all desire for the common good, and the good becomes common as grass. .oOo. [Tao Te Ching, Chapter 57, Stephen Mitchell translation]

3 3

Emergency powers
by Charles Platt 17 Dec '03

17 Dec '03

Of course, Michael Froomkin is right in everything he says about presidential emergency powers. But an unconstitutional abuse of power is surely not acceptable merely because it has become a routine method for accomplishing everyday legislative tasks. First, it allows significant possibility for future abuse; and second, if the Constitution is routinely circumvented, this diminishes its general power (as any law loses its power when it is routinely flouted). The situation is all the more troubling because it receives so little publicity, outside of militant "extremist" groups (i.e. those that are crazy enough to believe that presidential power should be limited in accordance with the law of the land). When a president can take almost action under the excuse that it's a "national emergency" (when in fact there is no emergency), and he doesn't have to answer questions till later, and most citizens are unaware of this, we have a potentially dangerous situation. They key word here is "potentially." Michael Froomkin seems relatively sanguine because the potential for great harm has not been realized. I am not so easily reassured. --Charles Platt

2 1

ALERT! 123,000 announced job cuts
by John Jackson 17 Dec '03

17 Dec '03

DOWNSIZED? - RIGHTSIZED? - RESTRUCTURED? HOW CAN YOU PROTECT YOURSELF FROM THIS EVERYDAY OCCURRENCE? ---> AT&T = 123,000 announced job cuts ---> GENERAL MOTORS = 122,000 announced job cuts ---> IBM = 400,000 announced job cuts ---> JOE's PRINT SHOP = 2 announced job cuts Are you dodging the arrows of Corporate America? Do you know someone (a family member, a friend, maybe even yourself) who has lost a job during the past six months? Has this person secured another job that is paying the same salary and benefits as the job they lost? There was once a time when people held a job for 20 to 30 years and retired with a secure pension. Those days are gone! So what can the average person do to protect him or herself financially in the unfortunate, but all too common, event of losing a job? Financial advisors have been telling us for years that we should diversify our investments. If this concept makes sense, should we not also diversify our sources of INCOME? Does it make sense to leave yourself vulnerable by expecting all of your income to come from one source? Rexall, an international company that was founded in 1903, is flourishing today as a very successful publicly traded company. You have no doubt heard of Rexall and are familiar with the more than 7,000 Rexall drug stores around the country. In fact, more than 87% of adult Americans today recognize the name Rexall and associate it with trust and integrity. Rexall's six divisions are all very profitable and growing at staggering rates. So what does this have to do with you? Rexall has developed an entrepreneurial arm of its company that helps individuals build a substantial secondary income stream without the hassles of ordinary business. No huge investments, no inventory, no employees, NO RISK. This is not some fly-by- night operation. This is REXALL! One of the most well known and respected corporate names in America. My partner, Todd Smith, has helped hundreds of people diversify their income and create substantial passive income streams through the entrepreneurial arm of the Rexall Companies. Todd himself has earned over one million dollars in EACH of the last three years in this simple, no-stress, home-based business. He knows what he is doing and how to help point people, like you, in the right direction. If you would like to learn how we can help you create a financial hedge against a possible downturn in your present employment, or simply to develop an additional source of passive income, call me today. Todd has created an informational audio tape that explains our entire business and how you can participate in it. If you are making all the money you want, have your retirement completely paid for, enjoy your job and can see working it until you retire, then CONGRATULATIONS. You are one-in-a-thousand. On the other hand, if you are like most Americans that are not happy with their current financial situation, it would be worth the phone call and some time listening to Todd's tape. What have you got to lose? If you DON'T call, you have a lot to lose. Call (303)-480-5841 right now and ask for this free tape to be rushed to you without any obligation whatsoever. PS: The message on this Tape is timely, addresses the societal and economic forces that WILL change our lives in the coming new century, and explains precisely why entirely new methods of doing business are necessary and are evolving. Your thinking about money, business, success and your own future will be challenged by this message! (303) 480-5841 - 24 hours ASK FOR TODD's TAPE J. Jackson Associates Income Diversification Strategies Parker, Colorado U.S.A.

1 0

Experience Microsoft Site Builder Workshop Live!
by ! Drive 17 Dec '03

17 Dec '03

Microsoft Site Builder Workshop Live! ( apprx 2.5 hours ) via Real Audio at http://ww3.audionet.com/events/microsoft/ what you need: The RealAudio Player At least a 28.8Kbps connection to the Internet A screen resolution size of 800 x 600 pixels :: Archived On November 13th From The INFOMART In Dallas, TX

1 0

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

I have gotten a lot of e-mail that has said basicly the same things: 1) Don't try to redo UNIX crypt(3), S-KEY (Secure Shell, etc.) is better. Well... This is most certainly the case. And if I could force the people in my user base to use one of these alternatives, I would. Unfortunately, I cannot. A fair number of the people who use the systems that I administer log on through dumb terminals. If I can't successfully teach them not to hit the "Ctrl-S" key, how am I going to teach them to do IDEA encryption in their heads? Or MD4 hashes for that matter? The fact is that if I tried to use S/KEY everyone would print out their key list for the month, and then promptly loose it, and regenerate a new one. Gee... Wouldn't that be secure. I have to stay with the one password system. 2) If your administer was worth his weight in spit, you would have a shadow password system, and the preexisting crypt(3) function would be good enough for you. Actually, I _am_ the administrator, and I am worth my weight in spit. Rather, I do use a shadow password suite. However, as security professionals, you must know that it is not whether an attacker can break into your system, but how long it takes. Once there, it is not whether the attacker can gain root, it is how long it takes (how many of the holes have been patched, and how many are even known about). And then to the password file. It is not whether the attacker can crack _all_ the passwords, it is how long it takes. With this algorithm, I hope to increase the last of these values. 3) The algorithm is too complex (or too simple) The algorithm that I proposed makes use of a NMAC as a basic cryptographic primitive. The security analysis of the algorithm should follow the same lines as a hash; that is: if the basic operator is secure, then the chaining of the operator is secure. The NMAC is provably as secure as the key used and the underlying hash function. I did everything that I could to maintain simplicity throughout the algorithm's design. I realize that a simple algorithm is easier to analyze and check for security. A fair bit of the complexity is to make it so that the algorithm is actually a NMAC. 4) Why don't you use FreeBSD's MD5 based crypt(8) replacement? I didn't like FreeBSD's MD5 drop in, because it lacked any security analysis, and complexity of the algorithm prevented any serious attempt at said analysis. It also uses MD5, which has not held up well to the ravages of time. The recent papers on easier ways to find collisions in MD5 did _not_ give me an attack of the warm-and-fuzzies. I would like to make use of an algorithm that is still thought to be secure. Joshua -----------------------------Joshua E. Hill----------------------------- | Thoreau's Law: | | If you see a man approaching you with the obvious intention | | of doing you good, you should run for your life. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

1 0

re: San Jose Mercury News declares encryption battle over
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dale how long have you been awake? Take a gander at Wei Dei's Crypto++, Peter Gutman's cryptlib, and the half dozen other public domain multi algo source libs available at your finger tips. Anyone with a compiler on just about any platform has access to implementations of blowfish, idea, des, gost, the gamut. So Dale, get coding. diGriz

1 0

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

> This is backwards logic; when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. hmmm... Now that _completely_ depends on the system. Now for the system I administer, the level of security really isn't _that_ high (on the grand scale of things). It is, however, high enough that I inconvenience the users with a pro-active password guesser, and passwords that expire occasionally. I suppose that this is a _minor_ inconvenience, but it raises the level of security a very large amount. On a less mundane system (one run by the government, say), security is only _slightly_ less important than being able to use the system in the first place. :) On this type of system almost any inconvenience is worth the cost. > > You have previously said that the passwd file should not be available > > for public consumption. Though this is certainly true, it does not > > hurt that even if the passwd file is available, nothing particularly > > useful can be done with it. > Hince you use pseudorandom password generators and crack. If you count on > somebody not being able to preform an opperation quickly, they'll usually > prove you wrong. whoa... didn't you just say: > when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. I think that psedu-random password generators would almost certainly "hinder in the functionality of the system"... :-) I want to make it so that users can use passwords > 8 characters, and I want to use something a bit better than FreeBSD's solution. Whether or not this is necessarily the One True Way (TM) to security, it will increase security. I'm not saying "Hey everyone. Here is a spiffy new password system that will make your entire system completely secure!" I'm saying "Could everyone please look at this algorithm that I'm thinking of using. Could you please comment on it, so that I can make it better." That's it. All questions on whether or not passwords should shadowed, crackable, not crackable, or consisting only of the letter "e", aside. Is this algorithm secure, and if not, why not. Joshua > --Deviant > The Macintosh is Xerox technology at its best. I very much like your signature... very nice... -----------------------------Joshua E. Hill----------------------------- | Allen's Law: | | Almost anything is easier to get into than out of. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

2 1

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:49 PM 11/15/96 -0800, Timothy C. May wrote: >It sounds ominous to me. Another backroom deal, probably for some form of >key recovery strategy, aka GAK. I'd bet GAK too. RSADSI has been working on GAK protocols, so these ones might actually work. I feel as pessimistic about this one as Lucky usually is. At 12:05 PM 11/15/96 -0800, John Gilmore wrote: >Are they the next Big Company to knuckle under to the Feds? Their >pcmcia-with-local-country-surveillance-chip-socket initiative never >seemed to go anywhere. Since I am inherently optimistic, one ray of light may be that the San Jose Mercury News was mentioning the ability to export the system, and then when the necessary licenses (US and foreign) were obtained, turn on the encryption. I guess from this that the encryption is in hardware. Now, software/hardware interfaces are usually fairly simple, so what we have here is a software system with a crypto hook. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

6 5

Re: ideal secure personal computer system
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:24 AM 11/16/96 -0600, Igor Chudov @ home wrote: >Bill Frantz wrote: >> Protection against strangers walking up to your machine and using it is >> nice, and easy to do. Protection against viruses which install Trojan >> horses in your system would also be nice, but is very hard to do in systems >> where programs run with all the privileges of their users. Examples >> include (in alpha order): DOS, MacOS, Unix, and Windows (including NT). > >I wonder what are the operating systems where programs may be run with >_less_ privileges than the user who starts them? Is VMS one of such >systems? Ah, you touch on 20+ years of my professional life. KeyKOS is such a system as is EROS, a similar system being developed at University of Pennsylvania. See: http://www.cis.upenn.edu:80/~eros/ http://www.cis.upenn.edu/~KeyKOS/ http://www.agorics.com/agorics/allkey.html - For KeyKOS documentation. In general these systems provide an execution environment where programs only have access to the resources they need. Think of it as a Unix chroot jail which is specifically designed for each program. Then add controlled communication links back to the user's terminal and you get the idea. Unless a program has a need to write the system file, it won't have the privilege, even if it's user does have the privilege. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

RE: ideal secure personal computer system
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:51 PM 11/16/96 -0800, John Fricker wrote: >In WinNT a program may impersonate a user such as Guest. Also, trojan horses >are ineffective in NT as typical users do not have write permission to system >binaries. I assume that administrators only run programs from trusted libraries and do not include their current directory in their path. They never run programs that aren't directly related to systems administration etc. etc. etc. The typical Trojan horest sits around until someone with the proper authority runs it. That is not the way NT is used at one large commercial operation I am somewhat familar with. (I'm being obscure to protect the guilty.) I think there are very few NT (or Unix) systems which are administrated with a safe level of paranoia. I would like to see more compartmentalization in the system. (Note that even if it only runs with a user's privileges, a Trojan horse will have no problem stealing e.g. that user's PGP secret key ring. Not everything of value is in system files. Question, can a user-level Trojan horse insert itself as a keyboard monitor and get the PGP pass phrase as well?) ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Off the subjects.
by twilley＠juno.com 17 Dec '03

17 Dec '03

Hi all, I am anxious to find an E-mail list forum dealing with financial matters. Possibly, there exists a forum to find a forum. Here in New Jersey there are rumors running about; that 401K's, and other corporation contribution plans are corporate assets: both their contribution, and the monies deducted from your pay, as well as, any other contributions you may have made. In the event of reorganization, in any form, including bankruptcy, these monies are available for redistribution to creditors. Meaning, not us. If true, it's a bit frightening; all and all. Thanks, Twilley.

2 1

DSA over Elliptic Curves
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

Has anyone implemented this yet? I am going to and was wondering what good sizes for q (the prime corresponding to the 160 bit prime in DSA) and p (the prime corresponding to the 512-1024 bit prime in DSA) would be? Leonard

1 0

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > At 1:39 PM 11/17/1996, Simon Spero wrote: > > Create a number up public/private key pairs, blind them, then do the > > cut-and-choose thing with the security officer. He signs the blinded key, > > then returns it. Unblind the remaining pubic key, and you've got a public > > key with the appropriate signature on it. > > Okay, this would work. But, it requires that all (or at least many) of the > Members of Parliament cooperate. If not, then the security officer will > be able to make very good guesses about who is speaking. > > Parliamentarians may not cooperate for a variety of reasons. They may > not wish to be attacked by terrorists for the words of others. They > may believe that cowardice is not to be encouraged. They may not believe > in anonymity. It might be too hard for them. > > What I would like to see is a method which relies only on published > public keys and no other cooperation from the people who are (more > or less) being used as shields. This may be impossible. The 4th method of Chaum's, from Eurocrypt 91, somewhat satisfies this, as does a method from the Eurocrypt 94 paper. Each person can choose his own public key g**x for a discrete log system. However, the problem is that all members of the group have to choose the same prime p as the modulus, and generator g, for their discrete logs. The issue of using a common modulus in discrete log systems has been somewhat controversial. I think when the government first proposed DSS they planned to do something like this, one modulus with everyone having different secret x values with corresponding public keys y = g**x mod p. This has the advantage that public keys are smaller since everyone uses the same g and p. So all you need is one value for your public key. Without this you have to have g, y, and p be your public key so it is 3 times bigger. The problem is that the way the main discrete log algorithms work, once you have broken one discrete log for a certain g and p you can break all the others very easily. So the particular g,p pair which is chosen for everyone to share becomes one very big, fat target to try to apply discrete log algorithms. Now this is not necessarily as bad as it seems. Unlike the case with RSA, there is no secret information which could be leaked to make solving these discrete logs easier. Nobody knows how to do it. So the only way it can be done is by a massive operation roughly similar to factoring an RSA modulus the size of p. Choosing p of 1000 or 2000 bits should still make it effectively impossible for anyone to do this. The numbers are simply far too large. Still the consensus of opinion with discrete logs is that the advantages of slightly smaller keys have not been great enough to justify the risk involved in having eveyone share a modulus, even though that risk is seemingly insignificant. On the other hand maybe for cases like this the additional advantages to common moduli would be enough to tilt the argument in the other direction. Hal

1 0

Political influence [was: Re: A Disservice to Mr. Bell]
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Nov 18 20:54:31 1996 > > ....The only mainstream party to have been in > any measure influenced by libertarian ideas is the Republicans ... I suppose that's why Clinton called himself a "libertarian" when it comes to gay rights. (Calling yourself something and actually *being* that something are, of course, different things.) Phill, you need to listen more and talk less about libertarian politics, I first heard about various wild-sounding now "mainstream" ideas when talking with Libertarians. These ideas are now promoted by members of both parties, especially during the election campaign season. For one thing, we were probably the first party to have a policy against government restrictions on the peaceful use of cryptography. JMR Regards, Jim Ray Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> This key will be valid through election day 2000. PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 DNRC Minister of Encryption Advocacy -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMpETWzUhsGSn1j2pAQGYQgfMCQSQsEEjekyjOaQTptq3ZGmh4eTbPwdT Ow6LGMOzNTBaONJlypERAm7S00NAf9/ri6liFL2xR/A51t47PPIg48WO4xYHbB2S UefMasDZ2q+jT1s9ukUgHL1EgXCJVggAsaN1mSphYlNgVrRoT0zga59MB3ynFVsH hM4NVJEPCv8waE9WohSLUm6Mp2fvA1zLtGmHdf6fR/R38Yw5aVOTA3ha/hV/zPmH MQIsN+WV16f4KXAL/0V56y1mnuPJ0TumUJwJNc/lNxhiSdlI9t5l3ywe7Aw1D1xo TQO4ARkBSN8+/C/g6R9wfEZ+YoAN42NzNpdcATmCgXhwYg== =hhPT -----END PGP SIGNATURE-----

2 1