December 2003 - cypherpunks-legacy

List membership
by Robert Barnes 17 Dec '03

17 Dec '03

Is cypherpunks subscribed to some CNET new service list by design or accident? I looks like SPAM to me. </enter confession mode> I must admit that in my frenzy to unsubscribe I attempted to unsubscribe cypherpunks. </exit confession mode> RAB -------------------------------------------------------------- Robert Barnes Phone: +61 7 32529722 Engineering Manager Fax: +61 7 32571403 Tritronics (Australia) Pty Ltd Email: robertb(a)tritro.com.au PGP Key fingerprint = 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 58 Send e-mail with "get key" in the "Subject:" field to get a copy of my public key

1 0

Re: PO-2 Brain wave meters.
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

> Subject: PO-2 Brain wave meters. Have not heard of them. Doubt they exist in any end-user, commercial product. Take it from someone who has gone through fun Electro-encephelagrams (EEG) before. You don't want to. > Has NE1 heard of these things? Supposedly you plug it into your printer > port and it shows you your brain waves so you can try to reach "alpha" > waves or something. I think they cost around $500. > If it`s for real you could do some neat things with it; how bout your > computer waking up when you wake up... > that terminator 2 plot comes closer every day.... > NEway if anybody knows anything about it let`s have it. > L8R -Napalm SFNF9UY(a)SCFN.THPL.LIB.FL.US Matt _________________________________________________________________________ Matthew J. Miszewski | <mjmiski(a)execpc.com> Practice Crypto Civil Disobedience | Export your favorite Cryptosystem ------------------------------------------------------------------------- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

God described
by Sven 17 Dec '03

17 Dec '03

> > MATHEMATICAL MODEL OF GOD AND JESUS > >Sexual Sin and Christians > > 19940404 > > Charles Magee (Not available via Internet), > See also: > * Classification of Religions > * Life After Death > >This article's surreality index is 'U' (unreal). > >To solve the question of if sex is a sin in Christianity, the following >model has been constructed. In this model God is a point mass, centered >at the origin of our XYZ space. Christ, we assume, is at the right hand >of God, about 100 centimeters away. His mass is probably around 75 >kilograms. > >Since God has a very large mass (a bit less than infinity), Christ, who >we assume is in a circular orbit around God, has a very large momentum, >and hence has a very small wavelength. This means that Christ's >uncertainty is quite small, so we can therefore conclude that he is >fairly certain in all that he does. > >Now let us consider a sinner. We shall place him at a large distance from >God, say one inch and 45 million light-years. He, being at a constant >distance from God and thus in a circular orbit, and having approximately >the same mass as Christ, will be travelling significantly slower than >Christ, and will therefore be more uncertain. One should also consider, >however, that since Christ's orbit could fit in a kiddie pool, while the >sinner's would encompass not only our galaxy, but a few of the nearby ones >as well, that the sinner gets around more, sees more, and is generally a >more knowledgeable guy than the Savior. This fits in with traditional >wisdom. > >Mary, the Mother of Jesus, being a fairly pure person, is close to God. >This means that she must be a fast woman. From this situation we can draw >the conclusion that sinners have a lot more potential than saints, since >less of their energy is stored as kinetic energy. Further insights can be >gained when we look at the situation of the heathen. > >A heathen is someone who, in general, is not affected by God. This means >that they are at least an infinite distance from him. Now, assuming that >one of these folk starts, by random causes, to travel towards God, he will >convert his potential energy to kinetic energy during the approach, or >descent. Since he started out an infinite distance away, but with some >kinetic energy of his own, he will approach God on a hyperbolic trajectory >and then disappear into space again, never to be seen again. If his >approach is such that it brings him inside the orbit of The Son of God, >then right after his closest approach, the heathen's velocity will be >greater than Jesus', which means that he will be more sure of himself in >his escape than Christ who is in orbit. This is an interesting notion, >but some of the side ramifications are even more intriguing. > >Without any orbiters, therefore, God would not be able to attract anyone; >all approaching bodies would have either parabolic or hyperbolic >trajectories. However, once God has an orbiter, the two of them could >collaborate to capture other bodies. This means that heathens that get >too close to believers in their approaches might get trapped, and by the >same token, believers who are buzzed by heathens could be ejected. > >And what, the reader asks at this point, does any of this have to do with >sex? Well, the answer is this: Sex, as we all know, is the union of two >or more people. This, in our analogy, would be represented as a collision. >Now, in Christianity, almost all of the holy figures are male. For God, a >collision between any of these close in folk would be disastrous, because, >even if we assume they are indestructible, such a high energy collision >would either: > > A) Eject one of the men out of orbit (becoming a heathen) > B) Cause one of them to fall into God (to die) > C) Give them highly irregular elliptical orbits (becoming a > doubter) > >All of these would be bad for God, because in the first two he would lose >orbiters, making His chance at capturing new ones less, and in the third >case He would have a much greater chance of more collisions, as the >elliptical orbiters would cross many of the unaffected circular orbits. >Therefore, God probably disapproves of these collisions. |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

1 0

Turning Peas Into Stars
by mpd＠netcom.com 17 Dec '03

17 Dec '03

In sci.math, David Madore <madore(a)clipper.ens.fr> writes: > Fanciful but true statement: it is possible to cut a pea in a > finite number of pieces, and rearrange them so as to make a ball > the size of the sun (leaving no holes, of course). Nothing to do with crypto, of course, but at least it has something to do with math. Does anyone remember Martin Gardner's April Fool's Day "Mathematical Games" column in Sci Am in which he proposed the Banach-Tarski Paradox as a practical method of turning a solid gold sphere into two solid gold spheres each identical to the original? A nice illustration of why all sets can't be measurable. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Your login/password for SafePassage beta
by Greg Broiles 17 Dec '03

17 Dec '03

At 02:27 PM 11/27/96 -0500, Mark O. Aldrich wrote: >On Wed, 27 Nov 1996, SafePassage Downloader wrote: >> You can now download SafePassage. You'll need the following login/password: >> >> Login: cypherpunks(a)toad.com >> Password: [elided] >> >> Go to http://stronghold.ukweb.com/safepassage/ and select "Download" -- >> you'll be prompted for your login/password, after which you'll be able to >> download the software. Make sure you keep your login/password >> private. Revealing your login/password to anyone is a violation of the >> license agreement. > >Is this to say that you wrote your license agreement with the foolish >premise that an e-mail address belongs to just one person? Maybe you need >to really understand how the Internet works before you write a license >agreement based on incorrect assumptions and your personal preferences for >how things ought to be. The message that UKWeb sends with the SafePassage beta userid/password is incorrect - not because it makes any of the assumptions you're ascribing to UKWeb and license writers, but because the license itself fails to require the person who agreed to it to keep the userid/pw combination confidential. But you are entirely off the mark with your assumptions about the assumptions made by the writer of the license. I am the person who wrote the license. (Actually, I modified some pre-existing license text, merged some in from another source, and generally did the sort of copying & pasting that's considered perfectly acceptable in the legal field and is considered copyright infringement if a programmer does it.) And I made no such assumption. And I know enough about how the Internet works to laugh at anyone says they "really understand how the Internet works." (Hint: before and during law school, I worked as a consultant to ISP's who needed technical assistance.) You would do well to heed your own advice and learn something about law before making grand statements about "how [things] work". UKWeb does not enter into an agreement with anyone (or everyone) who receives E-mail. It enters into an agreement with the person who fills out the form to download the software. People and organizations who haven't filled out the form don't have an agreement with UKWeb to use the software; and absent that agreement, their use isn't legal. I'm not interested in turning this molehill into a mountain. The beta test of the software is unwittingly functioning as a beta test of the license document; this morning's message revealed something I missed when I worked on the license agreement. It will be corrected shortly. (This seems to be as good a time as any to announce that I'm now one of the Cpunks who's working at C2Net.) -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

TV/Radio: Crypto Policy on NPR
by Ernest Hua 17 Dec '03

17 Dec '03

McNeil & Lehear (sp?) (ok, I know, one of them is gone, but I forgot which) News Hour had a segment on crypto policy. Generally a balanced non-technical report, except that there is no mention of the free speech issue. If there is a repeat near you, it's worth listening to, to hear (or see) what the informed non-technical public hears (sees). Ern

3 2

New white house internet commerce report
by Marshall Clow 17 Dec '03

17 Dec '03

the full report can be found at: <http://www5.zdnet.com/zdnn/content/inwo/1127/inwo0001.html> Whitehouse Releases Blueprint For Major Net Issues Concerning Government And Commerce By Will Rodger November 27, 1996 02:35:13 PM EST Inter@ctive Week Online The White House will release a blueprint for the governance of personal and business transactions over the Internet early next week that drafters and industry alike say marks a turning point in the Clinton administration's approach to cyberspace. The document, a product of an 18-agency working group headed by presidential Senior Adviser Ira Magaziner, covers every cyberspace major issue before governments and Internet users worldwide. Though in many ways it is a restatement of approaches already suggested elsewhere, the document urges a shift towards free market forces on the Net and a rejection of government interference in electronic commerce. The blueprint also represents the first time the administration has issued unambiguous policy statements regarding tariffs, censorship on the Internet and establishment of a body of international law for commerce. [more snipped] -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0

Re: TIA Invites
by John Young 17 Dec '03

17 Dec '03

Adam Shostack wrote: >Did they say what they were investigating? Usually, talking >to the unworthy is not a crime. :) The TIA rep asked if I knew TR45.3 is ITAR-ed. The document has such a notice, I answered. TIA said, we've told the Feds it's on your Web site. But why tell me, I asked. Thought you'd like to know we told the Feds, TIA said.

1 0

Re: Hurray! A good example of rational thinking ...
by Ernest Hua 17 Dec '03

17 Dec '03

> > It is truly counter-productive to insist on conspiracy theories and > > anti-government rhetoric. Sure, there have been conspiracies in the > > past. Sure, there have been more than our fair share of atrocities. > > > However, the real issues are privacy, security, freedom of speech, and > > effective policy enforcement. When we start calling names like "jack > > booted thugs" and the like, we are sinking to the same low levels that > > Freeh and (more appropriately) Gorelick use when they cry wolf and > > foretell futuristic electronic meltdowns. > > > More importantly, while the public is cynical and skeptical, it isn't > > exactly embracing the right-wing militia movements either. It would > > be a great disservice to the cause if cypherpunks were, in the minds > > of the public, tightly associated with the likes of Timothy McVey. > Not at all. We need more people shouting from the mountain tops at > what are governments are doing. I do believe we need to get more visibility on the seriousness of the issues. I don't think the average person understands why it was so hard to conspire against the people before the telecommunications age, and why it "could" (not necessarily "would") be now. There is a lot of knowledge to pass on before someone can truly appreciate the extent of the need for privacy and freedom protections. While it is bad that the extent of the body of knowledge turns off most people's willingness to learn, the sheer vastness of the task of setting up this infrastructure also makes it very difficult for the NSA or any other agency to become the secret puppet master. Not that they have not been trying. But to accuse them of necessarily harboring evil purposes is not only counter-productive, but most probably incorrect. Most public sector servants are not the New World Order loonies that the militia's have been prepared to fight. It would be safe to say that the NSA, the CIA and the FBI are filled with mostly red-blooded Americans with solid allegiance to the basic principles which you and I cherish. The questions is, why have 3 branches of government? Why have multiple conflicting agencies for any given task or goal? Why not just choose a "good guy" once and for all and let him (or her) do the "right thing"? It's not that we don't trust him when we first elect him. It's a question of what he would do with that power? And those that succeed him? That is why we don't "just trust them". It's too bad that we can't hold Reagan responsible for Iran-Contra just because he's presiding over the executive branch at the time. After all, we expect him to be responsible (whether he knew about it or not). Why not drop all these stupid laws that PREVENT the citizens from suing the government for incompetence? > We are not as free as we were 10yrs ago. We are not as free as we > were 100yrs ago. Hell we are not as free as we were under King > George over 200yrs. ago!! I seriously doubt you "long" for the King George days. If you do, well, we are just not in the same universe. > The issue of cryptology is only one area of attack on our > freedoms. Just one small piece in the Big Picture. Below are some of > the some of the trends we have to look forward to: > > National ID's: > Tracking of movement of all citizens: > Display of documentation for all Public transport: > Display of documentation for Employment: > Electronic Cash: > Automated Drift-Net Fishing of Phone conversations: > Federal Thought Crimes: Have you ever consider the possibility that maybe ... just maybe ... the government really IS as incompetent as it is reputed to be? Consider this ... If you were a know-nothing beaurocrat, how would you run a large institution? Top-down? Probably. Gather as much info as you can? Of course. Require that everyone trust your judgement (a la "executive priviledge")? Naturally. If there were guaranteed political opposition, no matter what you do, would you just push for more power/priviledge/money in everything you do? Damn right! Especially if you don't know how many of these things you push for will be won ... Oh, and there is this minor problem with some of these methods clashing with the Constitution ... Oh bother! I'm simply saying that it natural for the branch of the government primarily responsible for law enforcement and national security to care deeply about that side of any issue. If I were president, I would play the same political games Clinton is playing. A president is not just responsible for the specific free speech of programmers or specific privacy rights of individuals. He is responsible for a much bigger picture. It just so happens that, in our nation, we value "individual" liberty much more than anything else (including anybody else's "big picture"). Therefore, there are a lot of people against the more obvious methods of invasion of privacy. But let's face it, the public just isn't very informed or consistent on the topic; it is just easily swept up in hysteria. > I was born a free man, in charge of my destiny, with inalienable > right endowed by my creator. I will not be made a slave of the state > but will fight and die a free man. You were born to your mother and father, who are members of a society which has long built up imperfect infrastructures for surviving and thriving on the land which it depends. If you were alone in the vast American plains, you can claim you have infinite rights, and no one would disagree with you. You, your mother, your father, make trade-offs everyday on your purest rights versus your practical rights. Your purest rights are mostly given lip service, and then where it matters more, protected by gentlemen's agreements, sometimes backed by force. But the right itself is not enforced by any real means. It is the threat of punishment that keeps the right from being violated. Cryptography is one of those interesting areas where, for once, man can prove, for all practical purposes, that there is a hard limit somewhere that he can draw. More importantly, it is also genuine protection of a "right", specifically, a right to privacy, which society previously protected using the old methods (threat of punishment). Imagine a line in the sand ... if you cross it, someone shoots you in the leg. You can still cross it, but you'll suffer the consequences. With cryptography, you cannot cross it, no matter what you do. This brings into question whether or not it was useful (to you and to society) to shoot you MOST of the time, but not if you present a good reason to cross it first. THIS is the interesting part of all of this. I don't like to see this issue drowned out by all the conspiracy talk (which no one on this list is in any position of proving or fixing unilaterally). Ern

5 5

RE: IQ and age
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

ichudov(a)algebra.com (Igor Chudov) wrote: >Would you dismiss strong correlations between IQ and success in life >and academia as something irrelevant? Remember: Correlation is not causation. In this as in many other correlations, unreported third factors can strongly affect the outcome. In England, Cyril Burt devised an IQ test given to English school children at age 11 in order to decide whether they should proceed through the trade school system or university system. Unsurprisingly, those with higher IQs at age 11 (whatever the reason) typically received better educations and greater monetary success in life. In France, you may find that rich parents correlate well to "success in life and academia" substantially because they achieve more frequent placement in polytechnical institutions which correspond to the best universities in the U.S. and Canada. Poorer students, independently of IQ, usually go to less capable institutions. In the U.S., the Graduate Management Admissions Test (GMAT) administered by ETS is often required for people applying for post-graduate studies. The obstensible reason is that it gives an indication of the probable ability of the applicant to succeed in the course. By ETS's own figures, the correlation is only 30% with successful completion of one year of studies and lower for full completion. There are higher correlations for other factors (incoming institution, age), yet the GMAT number is still mandatory. The draw of a single number is compelling. Did I mention that ETS is also a monopoly. Ciao, James If you can't measure it, it doesn't exist. "What hit him?" "I don't know, I didn't see."

1 0

Issuers of E-money
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 28 Nov 96 01:31:21 +0100 To: dcsb(a)ai.mit.edu Subject: Issuers of E-money From: a9050756(a)unet.univie.ac.at (Mike Alexander) Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: a9050756(a)unet.univie.ac.at (Mike Alexander) I'd like to compile a current list of actual Internet-based E-money issuers and wich technology they are using; pls. mail me any additions to the list from the Cybercash homepage below. I will then post the complete list back here if it's long enough. (info on trials is OK also) THX American Heritage Bankcard Banque SOFINCO Barnett BayBanks Credit Corporation Boatmen's Credit Card Bank Busey Bank Chittenden Bank Compass Bank First Bank of Beverly Hills Bank of Hawaii First Bankcard Center First Hawaiian Bank First National Bank of Omaha First Union Corporation First USA Paymentech Humboldt Bank Huntington Bank Michigan National Bank National Bank of the Redwoods Norwest PNC Bank Silicon Valley Bank SouthTrust Bank Unified Merchant Services / Nationsbank U.S. Bank Vantage Services, Inc. Wells Fargo Bank Best Regards, Michael Alexander Doctoral Student at the University of Vienna -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzIhxYwAAAEEALtfkL/X6GuZpEECWnmkmbqqtGwNalb94Om82VUiBE8iU1OX 2e5WXQGsq1oManSqVQn3TpVo7VE9pMJr5vITAmkEA6szGRt5zbK5u/dIqhLnJnRE sVpiY61Xw6RvQKoXX7LSqOYSCqvIiY8GJ5gRpiKQNPZVuJRqbLipmU0fPqylAAUR tDFNaWNoYWVsIEYuIEFsZXhhbmRlciA8YTkwNTA3NTZAdW5ldC51bml2aWUuYWMu YXQ+iQCVAwUQMiHFjbipmU0fPqylAQGy4QP+LjB6lZXVYFZDpoVB7j8AGvkghSsr XicZapXPmsFX6xpt+S29EF4DGoDJIDq6VLJMZ2rQ1gFfEvvWzL7ekZ3orhLSpJoO WWRZF1MNZVWBNhzxBcdK2T6yrx4cBwQX7t299Ho0y1Go69VE9e3LN8YInIXoQYp5 bc4M0u16GqmV5eI= =5l49 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: IQ and age
by Clay Olbon II 17 Dec '03

17 Dec '03

Have we had an influx of fuzzy-thinking liberals lately? Not that this is a bad thing, it is hard to argue with people who agree with you on everything :-) At 06:49 AM 11/28/96 -0600, Lurker wrote: >>I would. If you look at who has the oppertunities to go college you will >note that those who are good at taking tests (SAT, ACT, or IQ) are those >who get to go. You will also note that money also breeds success, or can >someone give me an argument for the fact that there are more rich kids >going to Harvard, Yale, Stanford, and the like than poor kids. (These >schools almost gaurentee success.) The ability to spell helps to gaurentee success as well. Seriously, you ignore the correlation between performance in college and standardized test scores. There is a reason these are used in admissions - they are actually pretty good predictors of the ability to perform college level work. >If you want to find a correlation look for it in money not tests. And if >you are insistant on finding it in tests, ask why the scores are as they >are (was the test written to the advantage of one group over another or can >one group buy the "A" with special courses which teach the skills needed to >score high.) Oh, I forgot. Only certain racial/ethnic groups are capable of understanding basic mathematical concepts. Of course, caucasians are one of these groups (since they consistently are outperformed by immigrants from other countries). I know it makes you feel good to believe that all that is wrong is caused by conspiracies led by the EVIL RICH in this country. I happen to feel better believing in the potential for any individual in this country to succeed through hard work. Clay ******************************************************* Clay Olbon olbon(a)ix.netcom.com engineer, programmer, statistitian, etc. **********************************************tanstaafl

1 0

Is /dev/random good enough to generate one-time pads?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Subj sez it all. Thank you. - Igor.

3 2

Re: Dorthy Denning is a boot-licking fasicist!!!
by aga 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996, Huge Cajones Remailer wrote: > "William H. Geiger III" <whgiii(a)amaranth.com> writes: > > >I don't know if anyone watched the House Subcomitty on Computers & > >Technology today on C-Span. > > No, we watched 'Dorothy does Georgetown" on C-Spam. > > >Phil Zimmerman, Dorthy Denning, William Reinsch & others were disscussing > >computer security. > > > >Dorthy Denning gave the most pro-government speech I have ever heard. Is > >this clueless bitch on the government payroll?!! > > Yes. > > >William Reinsch is a lying bastard. Fucking politions!! Fucking > >goverment!! They all deserve a long rope!! > > Start with Socks the queer cat. > > >Phil Zimmerman was quite good at attacking the government policies. > > > ><sigh> We are truly a country of fools to have put these jackbooted > >facisit bastards back into office. > Don't worry about it. Doctress Neutopia can suck Bill's dick, and all will be fine. {;-)-~ > "Dorothy Denning" is a man in drag. "She" has a bigger dick that > "her" boyfriend John Gilmore, the cocksucker faggot from EFF. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Is that cocksucker AC/DC or what? Is it true that him and John Perry Barlow do 69 on video? > > >----------------------------------------------------------- > >"William H. Geiger III" <whgiii(a)amaranth.com> > >----------------------------------------------------------- > > Just say GAK to chicks with dicks! > > diGriz > Please define "GAK" and leave the headers intact. -a

1 0

The Difference Between The Right And Left
by varange＠crl.com 17 Dec '03

17 Dec '03

The French Revolution perhaps provided the best definition as the origional coiners of the terms. The Left is for radical change and the Right is for evolutionary change. That would put mainstream politics decidedly on the right wing side of the political spectrum. The left wing is a rather motly collection including many anarchists, communists and nazis, yet many of the same types are decidedly right wing. A historical anecdote would be the Bucharin-Rykov wing of the Bolshevik party in the late twenties. They were right wing while Stalin was left wing. Yet, Bucharin would be considered quite radical for today's bean counting politics. This is, of course, confusing to y'all because your all a bunch of stupid college kids. -- Cheers!

4 3

Bountyserver Round2
by snow 17 Dec '03

17 Dec '03

Thank you all for you comments and input. I am in the process of rewriting the propsal to make things clearer, and to revise some of the procedures. The original draft will, and the revision will be up at <http://www.bounty.com/proposal.draft.html> by the time most of you get this. I am making a single reply, rather than one at a time to save time and bandwidth. I wrote these replies before I started working on the revisions to the proposal, so things might have changed a bit. Matt: > > This mechanism should be as simple as possible, and as easy to use as > I assume you will make it all web based? Make sure you are using a Yes. It is going to be web based, with (hopefully) email and Usenet access. > secure server. Pay close attention to security of the underlying OS. I am planning on using Apache-SSL or Stronghold, if I can afford it, with Linux as the underlying OS. I plan on disabling telnet access as soon as the server starts accepting credit card numbers. Anyone who then need shell access will have to use SSH. > > Originally I proposed this to apply to software, but I don't see why > > it should stop at software. Initally the server will be restricted > > to software, but I hope that this will work out, and be expanded > There is no reason that it should only apply to software, so I am > glad you are thinking this way. Realize that your costs will go up Software is my main objective, and software is easier. > if you applythis to non-software related industry. You may need to > hire experts in other industries, etc. Of course, it may all pay off > anyway for you. Yeah. There is that. The other technologies I was thinking of were more in the realm of algorythms and protocals rather than hardware. Hardware is possible, but difficult, and may (would) be better suited to Ian's proposal. >> The proposal: >> What I am going to attempt to do is to set up a "Bounty Server" where >> send their initial "bid" to the organization. > Presumably web forms that generate a standard piece of output so that > developers dont have to sift through "original" specs. I have > questions about bids, but ill get to that later. Prozactly. >> This is the "bounty". Other people can add to this bounty, allowing the >> and the server operators. Other technology will be figured out as it >> becomes necessary. > You will need to make several things clear here. When people "add" <snip> > not. It is not impossible to solve this problem, it just takes a bit > of good wording in the Contract. I understand that. If you are willing, I will ask for your opnion on the wording. >> The initial bounty contract gets posted to the WWW server, (possibly) to >> a "developers list" of interested people, and (possibly) to an >> appropriate UseNet Newsgroup. >This may not be a popular point but you asked for legal tips >(/disclaimer BTW, this is not to be relied upon as legal advice. I am > giving it only to make you aware of some issues that you may want to look > into.disclaimer/). You need to be aware of possible discrimination > claims. There is a theory called disparate impact which you may have > a problem with. You should find a way to distribute these > announcements as widely as possible. This is a tricky area and one > you should be aware of. The final decision, of course, is yours. I don't really understand this. I plan on spreading the word as far as possible, but if I only post information in one or two places, isn't that my choice? If I am tryind to hire someone am I required to place adds everywhere I can, or can I choose my medium? >> Once the bounty is posted, other people can "bid up" or add to the bounty, >> and their contribution will be added to the total bounty as well as their >> accepted by credit card, check, money order, and possibly ecash >> (e-cash will be taken at some point, but it really isn't important >> at this point since almost no one uses it.) > > It would be good to accept ecash and maybe contact MarkTwain to see > if you can set up discount accounts for your developers. The people > involved in this project would be familiar enough to give the system > a boost. Why do you think the amount people give is not relevant? I wasn't refering to the amount, but rather ecash being not-relevant AT THIS POINT <runs and hides behind asbestos sheild> Not many people have ecash accounts, so it isn't a priority. It would be nice tho'. As to the amount: It really doesn't matter, but I am thinking of making a minium of $5, just because anything less really isn't worth the book keeping, but I really haven't made up my mind. >> The first developer to upload a _working_ package to the server will >> be cut (or ecash mailed if that works out). > Why do you think you need to keep an archived copy? If you deal with > Copyrighted material you MUST get a license up front. That shouldnt > be a problem for you since the developers are benefiting, but I am > just curious as to your thought process here. Archival copies are for legal reasons. Copyrighted material other than that uploaded by the authors is not going to be allowed, and part of the agreement is that they allow the Server to keep a copy for historical/legal reasons. >> The Server Adminstrator will also do an cursory check to make sure that >> there are no obvious copyright violations. > This needs to be much more than cursory. If you put a copylefted > piece on an open ftp site and it winds up to be copyrighted guess who > could get named in the suit. Not only should you vigorously research I will have the name of the submitter, and I will make a "good faith" effort to detect copyrights. I think that is enough. I don't (in fact I doubt any one person does) have enough knowlege to know every peice of software out there. I am more worried about people decompiling commercial products. >> In the event that there is a conflict between the initiator and the >> developer, the claim will go into adjudication. The server adminstrators >> decesion is final, and he will make every effort to settle the claim >> fairly. Adjudication will incur an additional fee (see the fees section). > appearance of impropriety is important but more important to you is > the need to have someone other than yourself to blame. You dont want > to be held responsible for an "anti-developer" decision if you dont > have to. I am hoping that reputations will handle this. > > Writing the bounty: >> The bounty specifications should include the following: >> else will contribute), owned by the programmer (well someone might >> be that magnanomous), or "copylefted". > > This will be up to the writer. It might not be a good idea for the > initiator to have input here as it will be a wedge causing more > adjudication than it is worth. I disagree. The iniator (hence forth known as Alice) is establishing the rules, it is up to that person to set forth the conditions. If the writer doesn't like it, they don't write it, and Alice looses her money. If enough people add to the pot, someone will bite, and Alice gets what Alice wants. >> 6) Where the initiators money is to go if the bounty is not claimed: >> choice. > Why not give it back to the initiator (minus a fee for the > opportunity). While I am sure you have good charities in mind, > people on the net dont like being forced to do anything. Keeping the > charity donation as an option is a good idea. To keep Alice from reniging once the money is given, it is gone. It means that you have the choice of software or nothing. > > Adding to the bounty: > > Fees: >> The Organization will get 2% of any bounty where the software or >> Technology that is copylefted. 20% of any other scheme. > 20% seems steep. You might want to at least start out with a > discount on this percentage. I like the discount for copylefting. 20% is an 18% penalty for not Copylefting the software. It means that I am going thru a lot of work, and not getting what I want, so I am going to get something. I want this server to produce Free Software. >> Adjudication will incur an additional fee of 2 to 5% depending on the >> difficulty in judging the claim. > This needs to be a certain percentage not a range. If need be assign > it via hourly charges. It is not easy to get people to stay out of > also encourage you to include the amount in all of the bids. You can > spread exposure and lower the rate. You are probably right. I really want to charge each equally. > > Where I need help at this point: >> Legal issues. Any lawyers want to talk to me about this? > Let me know if you have any questions. None of this is legal > advice...blah,blah,blah. Fine. > Looks like a good start. Keep me informed. Thanks. ========================================================================== Omegaman: >> The objective is to actually bring this system online. > "cypherpunks write code." good. Soemthing like that. > > Background: >> graphics editing software, easy to use Graphic Design Software (TeX >> is NOT easy to use) and easy to use Cryptographic software. > many would pay good money for Linux native versions of programs like > Wordperfect, Corelpaint & draw, Pagemaker , etc. I think "pay for" might be a little strong a word. "Assist" is more accurate. >> 4) Desired "quality" level: Proof of Concept, Alpha, Beta, Release etc. > Needs flesh. What defines "alpha" or "beta" for purposes of bounty > or is that up to the person initiating the bounty? If I can find good working defininations (sp?) I will use them. Otherwise I will insist that Alice document what it wants. >> 6) Where the initiators money is to go if the bounty is not claimed: >> honest, as well as the server. Each contributor will also get this >> choice. > Do you have the charities in mind? They should be listed in the > abstract, I think. March of Dimes, NORML, NRA, ACLU, GNU Foundation, FSF, SPLC. As the time gets closer this will get more exact. > Who will be publicize the initial bounty offer -- the server or > bounty initiator? Information about a specific software project will > need to be disseminated beyond bounty.org. Automated positing to relevant newsgroups, and maybe a mail list for those interested. > More details on conflict resolution are needed in a final draft. The > process and priorites the server administator will use to make his > specific hypotheticals detailed. Ok. ======================================================================= Peter Allan: > Snow, I know, Spell Check. >> Abstract: > "new technologies" doesn't seem to be what you mean later on. > I suspect you will get _higher_ overheads with this. For instance > suppose 2 people start work on something, and one wins the bounty, > the other goes unrewarded. To compensate each coder for this risk That is life. First to market means a lot. Look at Lotus. I am contemplating adding in a place for developers to meet and collaborate, sharing the bounty. >> community of users to decide which projects should have priority, >> and which shouldn't. > Hmmm. What about people ahead of the game - like PRZ. He get a VC or two and goes commercial. >> award to be paid to the developer. They then post it on the server and >> send their initial "bid" to the organization. > > Where is the scope for iterative discussion of the spec ? > This is _the_ killer stage for most work. This is Alices responcibility. >> This is the "bounty". Other people can add to this bounty, allowing the >> totals to add until someone claims that bounty by providing proof of > What about proof to the satisfaction of other contributors ? > How do I know Bill and Ben aren't cheating by starting and claiming > a bounty to which I contribute ? (Bill and Ben are fictitious in this > example. <g> ) Good point. Solututions? >> I will provide a short (8 or 10) list of charities that the money >> honest, as well as the server. Each contributor will also get this >> choice. > How does this keep anyone honest ? Keeps them from reniging (sp?) on the bid. =========================================================================== Ian: > Hi, Snow, >> I have started drafting a proposal statement for the Bounty server. > Wow, you've gotta move fast in this game :)) If I don't keep the inertia up, I will never get it done. > [chop where agreed or not disagreed] > > Background: >> It is the "Copylefted" software that interests me at this point. > OK, although for my model, I am assuming that all forms are covered. As I pointed out in private email, I think our model serves different objectives. > > The proposal: >> What I am going to attempt to do is to set up a "Bounty Server" where >> someone can iniate a "bounty" on a peice of technology. The initator > Separate this out, for clarity of model. The initiator (I used > Proposer, and called her Alice coz Alice always initiates) proposes I will do that. > BTW, bid to do what? Using market terminology, I have assumed thay > bid is to buy, that is provide cash. Offer is to sell, that is provide > software. Ah, yes, bid is add to bounty. Think if it as a bet. Kinda like Mr. Bells AP proposal, Alice is betting that the software _won't_ get written. Once the bet is high enough, it _will_ get written. >> This is the "bounty". Other people can add to this bounty, allowing the >> development to the initiator of the bounty. In software terms they would >> and the server operators. Other technology will be figured out as it >> becomes necessary. > This is where I have put most of my efforts, because I need to design the > microstructure that is built into our market. I am going to try to keep it simple, and let the thing evolve as necessary. As Alex (a former reader of this list) put it, the first anonymous remailer was a perl hack done in an afternoon, and improvements came from that. Things will improve as needed, I am just trying to think things out as thoroughly as possible first. >> Originally I was going to put the stipulation in that the software written >> rather simply desired. To aid in that desire, I am going to build in >> an initative to releaseing the software "copylefted". > Absolutely - let the market decide. Some of us, for example, do not like > copyleft. What do you have against "copylefted" software? Is it the specific GNU copyleft, or the concept? > > To get more specific: > [chop] >> The first developer to upload a _working_ package to the server will >> be awarded the total bounty, ... > This worries me. If I, as a junior programmer, am looking to enter the > market, I will have the daunting task of beating everyone else. Real life > doesn't work that way - there are ways in which I can pick up some newbie > tasks for low money, so as to build up experience and/or reputation. 1) As a junior programmer, you take on simpler bounties first. 2) Team up with a more advanced programmer, pool efforts and split the bounty. > I guess the notion of bounty is just that - first one takes all. > However, I think that the solution might be a bit limited in the > long run. It isn't intended to solve all problems, just some. > Interesting in that my proposal leads to task distribution by awarding > contracts, your proposal leads to task incentives by rewarding speed. Yours seems suited for longer and more involved tasks. Mine to shorter. >> "First" will be soley determined by the time stamp of the server. As soon >> as the package is uploaded, the initiator and the server adminstrator >> will be notifed, and the bounty marked "claimed". If the package is >> be cut (or ecash mailed if that works out). > OK, my proposals specifically assume no need for a "decision" by Alice. > That's not to say either is right, it's just that I prefer to design > something that eliminates the individual decision rather than cope > with the complexities. I believe it will result, in the end, in a > more efficient market. It might be more efficient to have a "paid" staff to evaluate the product to make sure it meets the specs. I don't have the funds to set up that infrastructure. >> The Server Adminstrator will also do an cursory check to make sure that >> fairly. Adjudication will incur an additional fee (see the fees section). > Same as above, no adjudication in my system. > Although, it is possible to add underwriters, > by simply making the task offerers (Bob and Carol) > into bond writers who front for programmers. I am hoping that it doesn't come up too much. Honesty and reputation should help. > > Status: >> At this point in time I am (obviously) still in the process of developing >> the procedures. I have registered a Domain Name (bounty.org) and I have >> a couple promises off assistance in certain areas. As well, I have >> a server to start off with. > Wow, *gotta* move fast. As I say, our stuff is based on a lot of > pre-existing software, so we make a lot of assumptions. Given our You are starting with the software, and then figuring out the rest. I am doing it the other way. > different approaches we may end up with competing systems rather > than one, but that's fine, indeed highly valuable as an experimental > approach. I don't think that the two proposals will necessarily compete. > What's financing you in this? Or should I say, monetarily enthusing? Financing? ======================================================================== Blake: > I missed the original discussion of this idea, but it sounds delightful to me. > A couple of thoughts on your most recent post: > What counts as a copyleft should be explicitly defined, i.e. just the GPL, > or how about Perl's artistic license... or Aladdin's GhostScript agreement? Ok. I will put up examples of each, and let Alice choose. > Public domain software should incur no larger percentage fee than copylefted > works. True. > How is the expiration for a bounty determined? I am thinking either 2 years after initial, or 12 months after last contribution, With a 1 year one time extension if someone claims to be "working on it". > Adjudication fees should be split in some fashion between parties. (Otherwise > the initiator has nothing to lose from disputing. (Unless of course you'd > like to > handle that on a reputation basis.)) I am hoping that reputation and the threat of adjudication will prevent it from happening. That is one area that does need work tho'. ========================================================================== Jim Cook: > be awarded the total bounty, minus "brokerage" fees (discussed later) > "First" will be soley determined by the time stamp of the server. <SNIP> I don't like this way of picking a winner ... because I think it would encourage fast and dirty work ... instead of quality ... better I think would be a process analogous to peer review for grants and publications ... with the added feature that the submission of a product is announced ... so that competitors who are almost done can get their entry in also ... and the initiators can evaluate several products simultaneously <SNIP> My reply: In a way it _does_ encourage quick and dirty work, like the first cpunks remailer, hacked together in an afternoon, then came the rest. It is a way to get _more_ software out there, hopefully some of it will be good, some bad. It really can't be much worse than the dreck comming out of some of the commercial houses. I am thinking of a way of implementing checks tho'. ===================================================================== Thanks for the comments. Keep them coming. The original draft will be up at <http://www.bounty.com/proposal.draft.html> later tonight.

1 0

re:PGP263UI
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back posted re PGP 2.63ui >I was under the impression that with the Legal_Kludge option for >pgp263i, that it already was compatible with old versions of pgp using >the version byte of 2. We kept the control structure of the original ui version by "Matthew". But the compatibility of 2.63ui has been expanded to allow it to Export public keys generated with Version=3 (Legal_Kludge=on) to old versions (2.3a) of PGP. >What else does pgp263ui offer? The GNU license? What about pgp3? >Some people aren't going to be very happy if you do a GNU version of >that, as GNU doesn't preclude selling commercially provided that >source is provided. See the original announcement for the numerous fixes & enhancements not currently available in 2.6.2 or 2.6.3ia including Added CONFIG.TXT parameters/functions LabelEncrypt and PrePendSigV Expanded disk write error checking Ability to edit other people's keys's UserID's. We have no current plans re PGP 3.0. Probably a GNU version of it is not legally possible. But if source is released independent enhancements would be, depending on the license. It also remains to be seen if or how fast PGP 3.0, if it ever comes, will supplant previous versions of PGP in public acceptance. >PS Steve and friends: I've got some stealth code close to usable in >the form of a patch to pgp263 if you want it :-) Yes. Please send me a copy and we'll take a look at it. But the external stealth utility currently available is quite adequate in my view. Steve Crompton <sunray(a)globalnet.co.uk> -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp11UxRHWQsRmI2RAQE/EggAwtnT312Wmi7dWn4sYK/GxVJDqbKpuGuh yVekVPRsrBRQlhcQqm1ICzucGMOd+uDNTNqoxx82tBzjAphN2adANayin3I7FpW1 mkvdCj77pzkEwqc60OcPjqRg5q9xKsPCczAmaHBVmuyKjCDJemEzLMUQsrllohha c3v4WcRgB+epnDpF0hpdDYH7aiIo/FmN59ItcMEvrytkt5Hv7GjZq974UC/1ALik sFsML7QWp6bpVNzDeE8H7FmrT7kKVBddQwQcwFP2dPHOaFdqMRPjVcIxxjiOs5/o I3sCaH8L5VAF/WivcRCvYOBV+kklbTQsJIdt/eTrCGtTpoWtjVhyyw== =VPSl -----END PGP SIGNATURE-----

1 0

Re:PGP263UI
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mark M. (markm(a)voicenet.com) wrote on Sat, 23 Nov 1996 22:24:41 -0500 (EST) >... >> Note that I personally have not done very much of the actual coding on >> this version. However if bugs are reported or constructive >> suggestions for improvements made I will pass them on to the >> individual(s) who have done the bulk of the work to make this release >> possible. I am assured that continuing support will be provided. >I found two bugs so far: > >This version doesn't recognize either .pgprc or pgp.ini as valid >config file names. It is very minor, but this functionality is >stated in the manual. I couldn't find any mention of either filename in -our- docs. Please point out the reference if I missed it. I think this was an MIT "feature". I don't plan to copy it. >One of my favorite options, +makerandom, isn't supported in this >version. This is an undocumented option, but it is useful in >many situations. Not as useful as you might think. A bug has been reported in the MIT version that +makerandom produces -weak- pseudo-random output, as (I am told) can be verified by just generating a large "random" file and viewing it with a hex viewer, looking for regular patterns. I don't know if this was ever fixed in Stale's version. This bug does not produce a weakness in the normal functions of MIT or Stale's PGP. MIT heavily rewrote the random number functions for their versions of PGP and the +makerandom feature depends on this rewrite. I did not want to try to import "mass quantities" of code from MIT both to respect their copyright and to maintain to some degree the independence of the MIT-derived and 2.3a-derived versions to that a bug in one might not be reproduced in the other. For Random numbers up to 24 bytes (192 bits), just use a -copy- of RANDSEED.BIN. For a longer random file, just encrypt (either RSA or conventional IDEA) a file a little longer than the file desired. Throw away a few hundred bytes from the start and end. The result will be just as strongly random as +makerandom even without the current bug. >This version uses +version_byte instead of +Legal_Kludge, but I >consider that a feature. I haven't had time to experiment with >the "Charset:" header. One other minor problem is that >ClearSig doesn't default to "on". This could cause some >frustration with new users. I haven't tried to imlpement the "Charset" header and probably won't. If this feature is important to you, use Stale's version. I will look into this for the next version, but no promises. Clearsig is working correctly as we document it. Another MIT change. It would be more work to change the documentation than the code, but I will consider this for the next release. >Other then that, it's just fine. Thanks for your constructive criticism and comments. Steve Crompton 100645.1716(a)compuserve.com (preferred) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp14FhRHWQsRmI2RAQHndggAgNdcOqya2NPX+8KOkoj1qoYnGBRprREK t0l3sK2HHqUQwTwKSkW5ugD898kG26HjCVlMsqfgQVcw+3nAhZgU/t7MCU9/orD8 yUc9vtXr/C4lLJHTtDGVpjPfRAJpV0m0myDwoqXZo4gTrkoQG43mKaE4eLv9qcl4 zGv4fMv/lh7hUwfUsZ6c7ULGPfKeYtknO1Hh3gKYX6HJPz5Qki2toIdH8qxpw51v CC/Q/MLxLQUGYH/jdHqvUSSD0G1QIu/D/LlL9VaUtPJemqPOuBGmk+ywvE7AAfNG uEnO/AumU3j1yPnFXqv5pUKGxP1gKbMyKR8lrEwWcrDapaiC6mW4oQ== =qk2B -----END PGP SIGNATURE-----

1 0

Re: IQ and age
by Lurker 17 Dec '03

17 Dec '03

At 10:47 PM 11/27/96 -0600, Igor Chudov @ home wrote: >Dale Thorn wrote: >> The biggest influence on IQ are the so-called "engrams" (fears, super- >> stitions, anxieties, etc.) planted in your brain early in life. >> >> Some of this can be overcome with mental exercise, and awareness of what >> negative influences are holding you back. Much easier said than done! >> >> IQ as they attempt to measure it can probably be most easily explained >> as pattern matching skills. Unfortunately for testing, and although you >> can be every bit as intelligent at 70 as at 10, your pattern-matching >> skills change and evolve over time, so any given tests will only apply >> (more or less) at the age group they are optimized for. >> > >Would you dismiss strong correlations between IQ and success in life >and academia as something irrelevant? > I would. If you look at who has the oppertunities to go college you will note that those who are good at taking tests (SAT, ACT, or IQ) are those who get to go. You will also note that money also breeds success, or can someone give me an argument for the fact that there are more rich kids going to Harvard, Yale, Stanford, and the like than poor kids. (These schools almost gaurentee success.) If you want to find a correlation look for it in money not tests. And if you are insistant on finding it in tests, ask why the scores are as they are (was the test written to the advantage of one group over another or can one group buy the "A" with special courses which teach the skills needed to score high.)

2 1

Eudora/PGP Plug-in--Free
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Eudora/PGP Plug-In Download version 0.20 from the Web: * http://www.prism.gatech.edu/~gt6525c/eppi/epp16_02.zip (for 16-bit version of Eudora 3.0 for Windows 3.1) * http://www.prism.gatech.edu/~gt6525c/eppi/epp32_02.zip (for 32-bit version of Eudora 3.0 for Windows NT/95) If you don't have Web access, but have FTP access, try the following sites. Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: papa.indstate.edu: /pub/winsock-l/mail/epp16_02.zip /pub/winsock-l/Windows95/mail/epp32_02.zip /pub/winsock-l/WindowsNT/mail/epp32_02.zip ftp.winsite.com: /pub/pc/win3/winsock/epp16_02.zip /pub/pc/win95/winsock/epp32_02.zip If you want to be automatically notified of new versions, send e-mail to gt6525c(a)prism.gatech.edu with the subject of "eppi news", and the following message body: join stop

1 0

More anonymous hate mail from John Gilmore, Timmy May, and friends
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've received the following e-mail from an anonymous coward. It didn't have any carriage returns (I added them). >Date: Thu, 28 Nov 1996 09:23:00 -0700 >Message-Id: <199611281623.JAA03709(a)zifi.genetics.utah.edu> >To: dlv(a)bwalk.dm.com >From: nobody(a)zifi.genetics.utah.edu (Anonymous) >Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> >Subject: Yo, Kook! Read this. > >... > >>"Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> writes: >>> Actually the opposite is the case, he is a notorious womanizer. >> >>Are _you gay, Phil? > >Look, Kook. Can you at least wait 24 hours after complaining about eliptic >curves being somehow off-topic (as I recall, it was 50k rants about Armenian >genocide that got your dumb ass booted) before posting your own off-topic >sewage? Who gives a flying fuck who is or isn't gay or perverted or whatever >in their private lives? What does it have to do with crypto, or proficiency >in programming, or anything that matters to most of the list? It seems to me >that you should try casting your "pearls" before the much more "noble" >animals of the freedom-knights, who (as opposed to me) _DO_ care who is or >isn't homosexual. Get back on your meds, it'll do you (and the list) good. > >me One of the meanings of "punk" is "young homosexual". There are a lot of them on the "cypherpunks" mailing list, trying to be social and to make friends. They think that the "cypher" part is "kewl" and even rant about it, without understanding the meanings of the technical terms they use (like the recurrent rant about brute-force attacks on one-time pads). But they don't know much about cryptography, so when someone, e.g., tries to talk about elliptic curves, the "punk" crowd screams that it's "off-topic". Today is Thanksgiving, so I hope you choke on your turkey (or whatever else ends up in your mouth :-). I'm thankful that I wasn't born in this country, because Americans are so stupid.

1 0

RE: Re: wealth and property rights
by William H. Geiger III 17 Dec '03

17 Dec '03

In <199611281157.DAA12088(a)infomatch.com>, on 11/28/96 at 04:53 AM, "Murray Hayes" <mhayes(a)infomatch.com> said: >On Wed, 27 Nov 96 10:16:20 -0500, William H. Geiger III wrote: >>In <009ABBF7.ACB06A80.64(a)SPRUCE.HSU.EDU>, on 11/22/96 >> at 12:18 PM, jc105558(a)spruce.hsu.edu said: >> >> >>socialism uses FORCE to take what it wants while the capitilism you have a >>free & volintary exchange. >> >>why is this so hard to understand?? >> >Don't be an idiot. Socialism has nothing to do with force. It is an >economic system not a military stance. >Communisist belive: >>From each according to there abilities >To each according to there needs. >Socialist belive: >>From each according to there abilities >To each accoring to there contirbution. >They are very similar, BUT HAVE NOTHING TO DO WITH FORCE!!! >Some countries have very socialized systems with democracy. Those people >want socalized everything. The US is socialized to a very small degree. >The UK is socialized to a further degree. <sigh> socialism has EVERTHING to do with force. Socialism is based on the TAKING from one to give to another. Without FORCE or the threat of FORCE most people will not allow their hard earned property to be taken away from them. You look at any socialist program in the "democracies". Every one is a) Manditory b) Backed by FORCE. No socialist program has ever been implemented on a large scale without the use of FORCE. It just can't work without it. I do not wish to be part of the socialist programs in the U.S. Medicare, Medicaide, Welfaire, SS, WIC, FoodStamps, ...ect. It is only because of the threat of the use of FORCE against me that I continue to pay for such programs AGAINST MY WILL. This is the same everywhere. If these were programs that the majority were willing to participate volentary then why are they Manditory?? Why use the FORCE of government to implement them?? Because socialism is THEIFT and people naturally resist the theift of their property. -- ----------------------------------------------------------- "William H. Geiger III" <whgiii(a)amaranth.com> -----------------------------------------------------------

1 0

Whitehouse Releases Blueprint...
by null＠void.gov 17 Dec '03

17 Dec '03

Notably, the emphasis is on the needs of business, not "people." We are in an excellent position to observe and document the process whereby "business" -- that is, organizations motivated primarily, if not exclusively, by the desire for short-term profits accruing to vested interests -- comes to dominate and control a technology. The auto and television industries come to mind as two prior examples. We are about to see the net go the same way. Take notes. "I have to praise the administration and Ira for reaching out to the private sector for comments," Computers and Communication Industry Association President Ed Black said. "There's a great emphasis on the needs of business here." Even so, privacy activists remained disappointed with many of the document's features. "This isn't anything new," said David Banisar, counsel to the Electronic Privacy and Information Center. "The privacy stuff is terrible. They say it's market driven, but markets don't work with privacy. It's like what happened with P-Trak."

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by geeman＠best.com 17 Dec '03

17 Dec '03

At 07:12 AM 11/27/96 +0000, you wrote: .....etc Can you be more specific? What are the vulnerabilities you are aware of? >I've never seen a security review of SSLeay, and if anyone gave it a clean bill >of health, they didn't have their eye on the ball. Note, I'm not knocking >SSLeay here, it is a wonderful lump of code, but it hasn't been written with >security in mind (IMHO). > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

3 4

RE: IQ and age
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Clay Olbon II <olbon(a)ix.netcom.com> wrote: >Seriously, you ignore the correlation between performance in college and standardized test scores. There is a reason these are used in admissions - they are actually pretty good predictors of the ability to perform college level work. < This is a commonly held fiction that is not supported by the evidence. As stated in another message, the infomration given out by ETS, who administer the GMAT and SAT, indicate that there is a low correlation between GMAT scores and successful completion of even first year education programs. This also ignores the issue of why other, better, widely available predictors are not used instead. >Oh, I forgot. Only certain racial/ethnic groups are capable of understanding basic mathematical concepts. < There was a good Scientific American article on cultural influences on learning within the last year or two. It examined Asian groups noted achievements in tests and the parental and cultural support for scholastic achievement. Another anecdotal example is in the opening chapters of "Surely You're Joking, Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon vivant. He describes how his mother introduced a doctor, a general and a professor with the same respectful tones indicating to him that a career in academia was as highly valued as any other high position in society. >I happen to feel better believing in the potential for any individual in this country to succeed through hard work. < I do to. But how good are your feelings as predictors of actual success? James

3 2

RE: IQ and age
by Clay Olbon II 17 Dec '03

17 Dec '03

At 12:40 PM 11/28/96 EST, jbugden(a)smtplink.alis.ca wrote: >Clay Olbon II <olbon(a)ix.netcom.com> wrote: >>Seriously, you ignore the correlation between performance in college and >standardized test scores. There is a reason these are used in admissions - they >are actually pretty good predictors of the ability to perform college level >work. < > >This is a commonly held fiction that is not supported by the evidence. As stated >in another message, the infomration given out by ETS, who administer the GMAT >and SAT, indicate that there is a low correlation between GMAT scores and >successful completion of even first year education programs. This also ignores >the issue of why other, better, widely available predictors are not used >instead. Apples and oranges. I was referring to the correlation of college GPA to SAT scores (which is higher than the correlation between high school GPA and college GPA). GPA measures the ability to do college-level work. As such, SAT scores are very relevant. As you said, <completion> of college probably does involve lots of other factors. I would not expect a high correlation between standardized test scores and completion rates. > >>Oh, I forgot. Only certain racial/ethnic groups are capable of understanding >basic mathematical concepts. < > >There was a good Scientific American article on cultural influences on learning >within the last year or two. It examined Asian groups noted achievements in >tests and the parental and cultural support for scholastic achievement. My point exactly. It is these cultural factors, not the amount of money the parents make, that is really the important aspect. It does seem unfortunate however that in many lower income families, there is less of an emphasis on scholastic achievement. >Another anecdotal example is in the opening chapters of "Surely You're Joking, >Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon >vivant. He describes how his mother introduced a doctor, a general and a >professor with the same respectful tones indicating to him that a career in >academia was as highly valued as any other high position in society. > >>I happen to feel better believing in the potential for any individual in this >country to succeed through hard work. < > >I do to. But how good are your feelings as predictors of actual success? Anecdotal evidence, but I have known people at many levels of society. I have never met anyone who "works hard" that is in dire straits. Some have struggled for a time (I know I did!), but eventually the hard work paid off. Clay

1 0

Fwd: Re: wealth and property rights
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 10:54:51 -0800 (PST), Dave Kinchlea wrote: >On Wed, 27 Nov 1996, Clay Olbon II wrote: >> >> This is provably bullshit. Look at the HUGE numbers of people in this >> country who make the economic decision to do nothing and go on welfare vs. >> going to work. Examine carefully the economic performance of the US vs the > >I don't know how much people get on welfare in your country but I >suspect that it is even less than in this country (Canada). Anyone who >truly believes that people make the `economic decision to do nothing and >go on welfare vs. going to work' has, in my opinion, no &^%* idea what >they are talking about. Just try to *live* on a welfare wage for a few >months to see how silly this thought is. While there may well be a few Hmmm, only a few years ago the Finacial Post did a report on welfare in Ontario. The maximum benifit package (for two adults, two children or something like that) came to about 34 000 dollars. YES 34 000 dollars. Actually, the figure the Post published was wrong. Welfare Ontario said they were a couple of hundred dollars UNDER the true value. Of course that isn't all in cash. It comes as subsidies houseing, free diapers, free baby food...... Are you telling me that it would be hard to live on 34 grand? I wasn't aware that our dollar was so weak.... And then there is the B.C./Alberta fiasco. The final check welfare recipients get in Alberta just happens to be the exact amount it costs to buy a bus ticket to B.C. The B.C. govn't gave up ALL federal funding of their welfare program to impose a rule that required 3 months of residence before benifits would be given. I don't even want to start talking about the newfys. What it comes down to is this. Eventually we as a society will have to make a choice. We will have to chose between hurting the people who work and hurting the people who don't work. You can't have it both ways. IF you MUST make the choice, who will you choose? mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

1 0

Re: First Contact
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: allyn(a)allyn.com, cypherpunks(a)toad.com Date: Thu Nov 28 23:40:50 1996 > I think that the character Data uses either PGP or some > sort of crypto system to lock up the ship's computer. The term used is "fractal cypher." It's not a terribly significant plot point IMO (although, for longtime fans of ST:TNG, there is some juicy humor with Data and the Borg "Queen" when she tries some, er, unconventional tactics to try to get him to reveal it.) > At least if you spend any reasonable time here in > cypherpunks, coderpunks, or other crypto related > areas, you should recognise what he uses. AFAIK the "fractal cypher" is just a couple of clever technobabble words thrown together for effect. > I have not seen seen it; I am guessing that maybe > they are using something to excite the juices of > us Internet folks. If they are, they're not doing a good job. :) > Mark dave - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp53b3EZTZHwCEpFAQHZQQf9HCh0nR44oSTGZDYCeElkqUfSUX759F2M WoUCuJ10EGO6L1euUiwpyg1eBcgicscOliwf0KNYMSdwj2hfAp/gXhWUR8o0XydU NvnCrOSu2iTvvkzZixB4uuIhKUB8z5Rfzv2Sz0EHWK2XKcBvRhht96uKR7mi+wIg QSfBgdx+RVFIVbFCIA6PWJ3NhRU6p/c+5ptm0fVAJOJJ4uHWswP58l3aimI6Ormu TrxEgFs+BezsqvJLNw3ZcAWCYSkOUKJiCC//w/e210RBEJKZOgiht7sSUTJqQDsx 6Z7mnU0hPfOE2Eco+b0zL4U/B7xskUX22OCuDlcsgLsoK1kggsZgjw== =ciV0 -----END PGP SIGNATURE-----

1 0

Re: Is /dev/random good enough to generate one-time pads?
by Steve Reid 17 Dec '03

17 Dec '03

> > Subj sez it all. > Yes, as a matter of fact it is. /dev/random is based on an entropy pool > taken from hardware interrupts and such, thus is a RNG, not a PRNG I expect it would be "good enough", but it is not _perfectly_ random, and so it wouldn't be a true one-time pad. Because it uses MD5, the bits are not all provably independent. You get (very strong) cryptographic security instead of perfect security. The one-time pad is easy to explain in theory, but implementing it perfectly is extremely difficult. Many people believe that quantum events are the only source of perfect randomness, but most methods for harvesting that randomness could introduce statistical properties. For example, a radioactive substance may have exactly a 50% chance of emitting a particle given a certain amount of time, but what happens if your timer isn't perfect? One-way hashes are good at removing such obvious and not-so-obvious statistical properties, but like a PRNG, you can't prove that the bits it produces are all completely independent. It's definately "good enough", but it's not perfect.

2 1

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Igor Chudov @ home wrote: > > Dale Thorn wrote: > > > The biggest influence on IQ are the so-called "engrams" (fears, super- > > > stitions, anxieties, etc.) planted in your brain early in life. > > > Some of this can be overcome with mental exercise, and awareness of what > > > negative influences are holding you back. Much easier said than done! > > > IQ as they attempt to measure it can probably be most easily explained > > > as pattern matching skills. Unfortunately for testing, and although you > > > can be every bit as intelligent at 70 as at 10, your pattern-matching > > > skills change and evolve over time, so any given tests will only apply > > > (more or less) at the age group they are optimized for. > > > Would you dismiss strong correlations between IQ and success in life > > and academia as something irrelevant? > > Not at all, and I think you could make some interesting equations out of > this if you wanted to spend the time. > > Factors for raw intelligence, i.e., pattern matching skills. > Factors for aggressiveness, assertiveness, self-confidence, etc. > Factors for manipulative ability (to manipulate people, etc.). I don't > know how to properly categorize this last item, but perhaps a professional > psychologist would. > > In sum, I think you could observe successful people and establish most > of the relevant factors, but be aware - if you are not an insider in > several of these "success circles", you might miss one or more key > factors, particularly those that would be denied by successful people, > such as willingness to do things people don't like to talk about openly. Another new error message! Seems like a new one every couple days now.

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

On Thu, 28 Nov 1996 jbugden(a)smtplink.alis.ca wrote: > Another anecdotal example is in the opening chapters of "Surely You're Joking, > Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon > vivant. He describes how his mother introduced a doctor, a general and a > professor with the same respectful tones indicating to him that a career in > academia was as highly valued as any other high position in society. Your lower middle class slip is showing.

1 0

RE: Your Freudian slip is showing
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Bovine Remailer <haystack(a)cow.net> wrote: >On Thu, 28 Nov 1996 jbugden(a)smtplink.alis.ca wrote: > >> Another anecdotal example is in the opening chapters of "Surely You're Joking, >> Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon >> vivant. He describes how his mother introduced a doctor, a general and a >> professor with the same respectful tones indicating to him that a career in >> academia was as highly valued as any other high position in society. > >Your lower middle class slip is showing. Damn right! Everything I have I earned myself. I'm not some pampered child of rich parents. My God, when I think of what my father went through when he was growing up and what he endured to feed our family, I'm amazed that he didn't drop dead in his tracks. The fact that my granfather was a well respected municipal politician didn't insulate them from the effects of the depression. When my father was young he had to walk almost four miles to and from school, and it was uphill both ways. Then when he got home he had to chop wood with a hammer. Of course he could have used an axe, but it was usually dark by this time - they couldn't afford lights - and he found that a miss with the hammer was less likely to cause severe leg trauma. After getting his hand crushed in a printing press as a young man and later, after being layed off after 26 years of hard toil and loyal effort, he wasn't bitter when he was forced to retired on a pension of $650 per year. He was proud to have worked hard all his life and succeeded in his own small but not completely insignificant way. Look where I'm pointing, not at what I'm pointing with. James

1 0

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Dr.Dimitri Vulis KOTM wrote: > > Ernest Hua <hua(a)chromatic.com> writes: > > > McNeil & Lehear (sp?) (ok, I know, one of them is gone, but I forgot > > > which) News Hour had a segment on crypto policy. Generally a balanced > > > non-technical report, except that there is no mention of the free > > > speech issue. > > Do you think they should have mentioned that cypherpunks are against free > > speech and that John Gilmore (spit) is a liar and a content-based censor? > > Gilmore is irrelevant and not worth mentioning. > BTW, there's an excellent picture in the Public Domain showing Robert > McNeil (sp?) looking over the fence on the grassy knoll, seconds after > they blew off the president's head. I guess ol' Bob musta been one of > those "extremely few, ignorant, stupid people" who thought shots may > have come from somewhere besides the depository (per O.C. Register). Another new error message! Seems like every other day now.

1 0

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Ernest Hua wrote: > > > > It is truly counter-productive to insist on conspiracy theories and > > > > anti-government rhetoric. Sure, there have been conspiracies in the > > > > past. Sure, there have been more than our fair share of atrocities. > > [mucho snippo] > > The danger in conspiracy theories (and you can check the L.A. Times for > verification of this) is that they are often tied in to anti-Semitism > and other forms of racism, and/or provide an excuse to.... > > The fact is, though, that only government possesses the power to ruin the > lives of masses of people, which they have often done, even in this century. > Anyone who says "the conspiracies aren't true" and "anti-government rhetoric > is automatically bad", etc. is just sticking their head in the sand. > > The militias are a necessary correction to government excess, however > negative the implications of militia power might be. > > As far as the difficulty in creating the infrastructure to monitor every- > one, well, it exists and is growing by the minute. All "they" have to do > is listen in, and have smart programs to sort out what they want to look > at (which they certainly do). Think of it as a percentage deal. The > people the govt. most want to monitor are the ones who are the most > active in their travel and communication, therefore, it greatly reduces > the monitoring load. Another new error message. Every other day, a new error. Who's doing this?

1 0

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 12:12 PM 11/26/96 +0000, Matthew J. Miszewski wrote: >> 2. Users of programs like PGP today already get at least a fairly decent >> RNG already. Would they want better? (I'm not suggesting a total >> replacement; I assume that the output of any hardware RNG would be hashed >> with more "traditional" PC sources, like disk timings, keyboard timings, >> etc, which should deter attempts to attack just the hardware part.) > >Why would you hash good RNG output? Re-read (read?) Applied Cryptography. Hardware RNG's contain biases, even though they may only be tiny ones. For example, a RNG based on radioactive decay and a geiger counter has a certain minimum "dead time" between decays that introduces a slight bias. Most electronic circuits naively intended to generate random numbers contain similar biases. If I build a device to generate ones and zeroes based on electronic noise, I must assume that there there will be some non-randomness in the output, however small. This is somewhat equivalent to saying that there is somewhat less than 1.000000 bit of entropy in each bit of the RNG output. If I recall correctly, a data stream with 0.5 bits of entropy per bit might be one that contains uncorrelated bits which are "0" 3/4s of the time, "1" 1/4 of the time. Fortunately, as I recall it is possible to, in effect, "distill" the randomness of the sample using hashing. Start out with 200 bits with 0.5 bits per bit of entropy, and you can produce 100 bits with 1.0000 bit per bit of entropy. (Condensing the thing even further can't put more than 1 bit of entropy into each bit; but what it does do is provide some margin for entropy sources whose biases may vary somewhat.) The advantage, however, is that it is probably far easier to distinguish 0.2 bits per bit of entropy from 0.1 bits, compared with distinguishing 0.99 bits from 1.000 bits. If you know you have at least 0.2 bits per bit, hashing down a factor of 10 would produce a solidly random output. If I understand the process correctly, this means that the "figure of merit" of any RNG should be the number of bits of randomized output it can successfully create per second. 100,000 bits per second of output with 0.5 bits of entropy per bit is, therefore, better than 10,000 bits with 1.000 bits per bit, because the former can be converted to 50,000 bits of unbiased output per second. This result may not be exactly counter-intuitive, but it is at least NON-intuitive. But what this does do is to provide an opportunity: Build a circuit that generates reasonably random output at 10x rate, hash it down to 1x, and you can be reasonably certain that the result is cryptographically random. The software could monitor the input to ensure that it remains substantially better than needed to guarantee random output. >I understand your desire to >deter hardware only attacks. I just think it might be an >overreaction. Of course mine could be an under-reaction 8-) I think if the hardware RNG could be corrupted and that would compromise the security appreciably, it WOULD be compromised in important-enough situations. However, adding hashing with more "traditional" sources of randomness would make the job futile. Corrupting the hardware RNG device would merely make the system fall back to the current level of security. >> 3. Even hardware RNG's aren't "perfect": they could be subverted, >> replaced, or perhaps influenced. Would someone who was sufficiently >> sophisticated as to recognize the need for it actually accept a real, >> functioning device? > >It would have to go through rigorous testing in the crypto community. > RNGs v. PRNGs goes through a yearly debate here on cpunks. There >have been some good discussions on the use of white noise and other >potential hardware sources. Im not sure if hks is back up or not, >but you might look there. Well, we have a chicken-and-egg problem. Until a commonly-used program (like PGP, maybe) easily gives the public the option to include a hardware RNG as part of its sources of randomness, few people will be inclined to implement such devices and they will remain atrociously expensive...so nobody will buy them. >If an independant entity could certify the product with a good >reputation for dedication to the community, you would get much >milage. PGP, Inc. might be interested for instance. I mean I have >used PGP for years but have not had the time to go through the code, >etc. I trust it because Phil's reputation precedes him. Well, with all due respect, if Phil hesitates to install a hardware random source link into a piece of software simply because he thinks that to do so puts his reputation on the line, he's placing a high hurdle in front of the development of good, economical hardware randomizers. There's plenty that software can do to protect itself from a compromised hardware RNG; monitoring the biases of the input and hashing it more than adequately is a good start. It should be possible to ensure that a hardware RNG can only improve security, not reduce it. Jim Bell jimbell(a)pacifier.com

1 0

Buy your COMPUTER parts direct from any wholesaler!
by daniel＠earthstar.com 17 Dec '03

17 Dec '03

BUY QUALITY COMPUTERS AND COMPUTER PARTS DIRT CHEAP!!! YOU'RE THROWING YOUR HARD-EARNED MONEY AWAY, if you're not buying your computer parts direct from wholesalers, using my method. Stop relying on unethical computer salesmen to sell you your computer and all its ancillary parts. Why pay full retail. With my method, you can not only PAY WHOLESALE PRICES, but your purchases will be TAX FREE, coming from out of state! You could be buying computer parts for your friends, neighbors, family, coworkers, employers and anyone else. You choose if you add a profit for yourself or not. I was the purchasing agent for over six years with a multimillion dollar computer company. I've been in the business for myself for the last four years. Believe me, I know what I'm talking about. And I'm willing to share my secrets, along with a list of hundreds of contacts in the wholesale computer business for just $4.95. If you still need convincing, E-Mail me at daniel(a)earthstar.com. If you're already convinced that my nominal fee is well worth the fantastic savings you can begin enjoying on your computer parts, send $5.00 to Daniel Decker,11904 Blueway Ave. , OKC, OK 73162 Be sure and include your e-mail address I will immediately e-mail you my secret, oh-so-easy method to getting wholesale costs, tax free, and the list of wholesale computer companies. The list includes the contact names and phone numbers that will help you find any part you need, from RAM chips to CD ROM burners. I'm so confident that this information will pay for itself many times over, I'll refund the COMPLETE purchase price if your not 100 percent satisfied. No questions asked, no hard feelings, period. WHAT ARE YOU WAITING FOR? The longer you wait, the more money you could be wasting. Contact me immediately. I'm ready to help you save money. Daniel Decker daniel(a)earthstar.com

1 0

Re: [ANNOUNCEMENT] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Tim C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. _ {~} ( V-) Tim C[reep] May '|Y|' _|||_

1 0

Re: wealth and property rights
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 15:00:36 -0800 (PST), Dave Kinchlea wrote: >On Wed, 27 Nov 1996, snow wrote: >You are clearly an angry young man. I am sorry you have such a poor >opinion of people, I am even more sorry if it is justified. You can >believe me or not, but what you describe is *not* the ordinary case in >this country. Of course, in this country we have a disgusting 10+% >unemployment rate. Even if people DO want to work, there are no jobs. > >All that aside, I can tell you do not have a family if you thing that >$6.50/hr is a living! Even accounting for the difference in our dollar, >I would say that is barely subsistence income for a single person. Are >we *all* not worthy of more than that? > Yes, there are maany angry young men in this country. Unions prevent young men from compeating in the market place. Unemployment Insurance artificialy increases the unemployment rate by 2% (this is a figure that many people more knowledgable than me have stated) welfare increases the unemployment rate by another 1%. The Canadian Pension Plan is out of money and yet I am still forced to contribute and for what??? Will it still exist when I retire? Not bloody likely. Fortunatly NAFTA has forced some of our companies to compeat or die. Take a look at Canadian. Are they gone? I didn't get to watch the news today...... I'll bet that most of the employees would gladly take a 10% wage cut to save to company but the union leaders won't let them vote on it. Why? Because they would loose power. Look at what the govn't do. Most of them just contribute to the problem by offering hand outs. They don't need hand outs! ONE gov't (Alberta) offered to lower the fuel taxes. YAAAAA RALPH!!! (Who's ecinomic reforms incidentally (sp) was hearalded by the Post as a model for govn't across North America) Cut taxes and kill the union leaders. Sorry for siting my sources..... mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

2 1

Re[2]: Sound card as a random number source ??
by Pavel Korensky 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk wrote: > > I`m not entirely sure about the possibility of correlations in any of > these sources but they aren`t really a good idea because all can be > accessed by someone else. eg. Steal your random noise audio tape, > sample dolby decoded sound at the same time as you etc. And what if I will use FM receiver, tuned on some channel where is the noise. If the potentional attacker don't know the what channel was tuned, he is not able to reproduce this IMHO. Of course, maybe it is possible to record the whole spectrum to tapes, but I think that the noise will change when recorded and played back from tape. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

1 0

Re: Whitehouse Releases Blueprint...
by Will Rodger 17 Dec '03

17 Dec '03

At 04:08 AM 11/29/96 +0000, you wrote: > > Notably, the emphasis is on the needs of business, not "people." > > We are in an excellent position to observe and document the process whereby > "business" -- that is, organizations motivated primarily, if not exclusively, > by the desire for short-term profits accruing to vested interests -- comes > to dominate and control a technology. The auto and television industries come > to mind as two prior examples. We are about to see the net go the same way. > Take notes. > > "I have to praise the administration and Ira for > reaching out to the private sector for > comments," Computers and Communication > Industry Association President Ed Black said. > "There's a great emphasis on the needs of > business here." > > Even so, privacy activists remained > disappointed with many of the document's > features. "This isn't anything new," said David > Banisar, counsel to the Electronic Privacy and > Information Center. "The privacy stuff is > terrible. They say it's market driven, but > markets don't work with privacy. It's like what > happened with P-Trak." > You bring up a point that is implied - but not explicit - in the article. And it's a good one. Funny thing is, two of the _industry_ folks suggested individuals probably needed to be included in the document more than they were. Neither was keen on being quoted on the record regarding non-business interests, of course. Given the attitude of the folks I talked to, I suspect non-business interests are still fairly important to the White House on this one. And remember: Ira Magaziner won no friends in industry with his health care proposals a couple of years back; some folks think he's leaning in favor of industry at least initially to make sure what happened then doesn't happen again. If Netizens find suggestions from the administration too heavy-handed, my guess is there's still time to move the discussion. Cheers. Will Rodger Washington Bureau Chief Inter@ctive Week

1 0

cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf vulnerability? cheers, -paul

3 2

Re: Counterproductive Dorothy Denning Flames
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, they feel compelled to harrass anyone who's smarter / more > knowledgeable than they are (sometimes using the anonymous remailers) in > an effort to drive all intelligent discussion off their "private mailing > list", so ignoramuses like Bradley can sound like "local experts". I think you might be missing the very succinct and subtle point that all you ever contributed to this list (despite your knowledge of cryptography) was rants about sovok jews and Tim Mays sexual orientation. I happen to be knowledgable about cryptography but even if I`m not an expert I do tend to post things that are of value and interest as opposed to worthless flames. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

First Contact
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Is there anything in First Contact to do with Crypto at all? Just that it opened out here today, and I'm going to see it. Yours Sincerely, Benjamin Grosman ------------------------------------------------------------- bgrosman(a)healey.com.au -- http://www.healey.com.au/~bgrosman/ PGP Encrypted Mail Preferred -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzKNX9oAAAEEAOIx4HkRU4vckgguzERhVCxgy5psmngHUoW10Xl8kBkjnuc/ ACysH1K98UXlGfet9zjn/XN4RMnGq64EHXvJu56H7OHhwhoerTpVIW5MUYt+QExk KKnRNrdq8WVGoaMywSM4qKbaJr8aNMBWkldUKR4NElvAjIEEO9z0msNPp33RAAUR tClCZW5qYW1pbiBHcm9zbWFuIDxiZ3Jvc21hbkBoZWFsZXkuY29tLmF1PokAlQMF EDKNX9vc9JrDT6d90QEBxVYEAL5nw1NiyaPpG8R2x7lNcqOcavj/cCmDYT8swT02 Z0AO0C7PGpgp9V38Yyki0FB3yaiJhIQ3Kw6xCtuI8f1F4Vfql/nZebzQERl8kTa4 sI/4xSKRT/Riw/wSGupagU1F1wYIPlXOCdUilIfLzVf4IOsxKjJMdm7aKladSxkV N7Yg =Yapx -----END PGP PUBLIC KEY BLOCK-----

3 2

The House Rules At The Permanent Virtual Cypherpunks Party
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is a document I just hacked. I am breaking several of the Rules by posting it, since I am not actually subscribed to cypherpunks right now. Enjoy. Bryce - ------- 0. Hello Welcome to the cypherpunks mailing list! Starting now, you will receive hundreds of email letters every week on the subject of privacy and social change in an age of cryptographic networks. PLEASE, for everyone's sake, SAVE THIS MESSAGE! If you ever want to remove yourself from this mailing list, you can send mail to <majordomo(a)toad.com> (NOT <cypherpunks(a)toad.com>) with the following command (correctly spelled) in the body of your e-mail message: unsubscribe cypherpunks Their Name <them(a)theiraddress.xxx> Here's the general information for the list you've subscribed to, in case you don't already have it: I. Etiquette -- The House Rules At The Virtual Cypherpunks Party The Meta-Rule: It's John Gilmore's virtual house. He is the sole owner of the computer (toad.com) that hosts cypherpunks and the sole authority over what the users of that computer (you) can do with it. Rule 1: Do not _ever_ send email to the list <cypherpunks(a)toad.com> asking how to accomplish some administrative task like unsubscribing yourself. If you do, you will be roundly flamed, and nobody will answer your question. Instead, send email to <majordomo(a)toad.com>, or read the "Administrivia" section below. Rule 2: Don't forward articles from other forums to cypherpunks. We can find it ourselves the same place you did if we want to read it. If you have something useful to say about the article, then consider writing a review of the article or a response to it and posting _your_ article along with a pointer to the original article. Rule 3: Don't cross-post articles to cypherpunks as well as to other lists. Rule 4: Read before you post. If you are new, don't post at _all_ until you have read a few weeks of discussion. Rule 5: When replying to a message, ask yourself if more than a thousand other subscribers really need to see your response, or if is more appropriate to reply privately. Rule 6: Don't ask questions which are already answered in the resources described below. How can you know whether your question is already answered in those resources? Simple: read them. Rule 7: Don't publically reply to someone just to flame him/her because it makes you feel better. We are not here to make you feel better; we are here to read quality discussion about certain issues. Some people actually _specialize_ in tempting their adversaries into publically flaming them. Don't be a stooge by falling for it. Advice: The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQs referenced below. These documents are a good introduction. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. We've noticed that people who post a lot usually have less to say. Refrain from contributing too much. Re-read your article before your send it. Then re-read it again. I'm serious-- go back over it _twice_. Really. It helps. Assume any message from you to the list, no matter how insignificant or casual, is archived somewhere for eternity for future employers and acquaintances to read (it probably is). You may even wish to unsubscribe right now and then re-subscribe under a "nym," rather than using your true name, if your views are especially controversial or your job prospects are sensitive. II. Administrivia -- How To Unsubscribe And Stuff If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net (Is Eric still doing this?) This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The majordomo address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. [There is no digest version available.] (We should put in info here about subscribing to Alan's digest at gateway.com and the 2(?) filtered versions of the list here. Does someone have all that?) There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. III. About Other Forums There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as it says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. If you are beginning to use PGP and have questions, you can also subscribe to the PGPusers list by sending mail to pgp-users-request(a)rivertown.net with a subject of subscribe, or as an alternative way to subscribe use their Web Mailing List Gateway at http://pgp.rivertown.net/#Subscribe IV. About Net.Loons On cypherpunks The cypherpunks list has attracted a fair number of net.loons in its day. If you see an inflammatory article that seems too crazy to be serious, then it probably is. The hallmark of these loons is rudeness, and the preferred policy in just to ignore their postings (tempting as it is to respond). Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. V. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. D. For a more technical, lower volume, and much less policy-politics oriented list, you might try to subscribe to the coderpunks list, which branched off of cypherpunks some time ago, due to frustration with loons. It also runs at toad, and you can be considered for subscription by sending mail to Majordomo(a)toad.com with these words in the body of the message: subscribe coderpunks Their Name <them(a)theiraddress.xxx> E. The Snake Oil FAQ, by Matt Curtin & others, located at: http://www.research.megasoft.com/people/cmcurtin/snake-oil-faq.html Has some useful warning signs to keep in mind. "Snake Oil," here, means "weak cryptography," which brings us to... F. An incomplete cypherpunks translation list: PGP -- Pretty Good Privacy software. PRZ -- Philip R. Zimmermann, PGP's author. GAK -- Government Access to Keys (for crypto, but it might as well be for your front door). KRAP -- Key Recovery Access Program (a brand new flavor of GAK). TLAs -- Three Letter Agencies (the alphabet soup of the US government -- FBI, DEA, IRS, CIA, DIA, NRO, ATF, NSA -- all your favorites). NSA -- the US National Security Agency in Fort Meade, Maryland, responsible for encryption codes and computer security for the entire US government. LEAs -- Law Enforcement Agencies (see above, at least when they're not busy breaking the law themselves...). ITAR -- International Traffic in Arms Regulations. A silly US government regulation outlawing the "export" of strong cryptography software which is all over the planet anyway. [Please suggest other resources and acronyms.] IV. Famous last words My preferred e-mail address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric [From here on I changed/added nothing (it's gospel, after all:). -- JMR] - ---------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated 11/28/95] -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMp2nikjbHy8sKZitAQGoiQMAgAfvKA0751PAW6ivMQ0+KQfa19cuueFY VqPWxJSMXBE+8v37+sx6nn7FN/qFYkoccaBkOJdOZb7zu2kX+ptV/T153F6cFFFT 6RULRhMKQOiWB7JV+fdr2QV136hR8U/1 =AKDO -----END PGP SIGNATURE-----

9 23

Counterproductive Dorothy Denning Flames
by mpd＠netcom.com 17 Dec '03

17 Dec '03

William H. Geiger III writes: > Dorthy Denning is a boot-licking fasicist!!! > William Reinsch is a lying bastard. Fucking politions!! > Fucking goverment!! They all deserve a long rope!! It is perhaps a point in Dr. Denning's favor that her most vitriolic detractors can spell neither "Dorothy" nor "fascist". I must admit that I am at a loss to understand the heat which Dorothy Denning generates on the Cypherpunks list, which seems to be second only to the heat generated by posting recipes for roast feline in rec.pets.cats. All of the people I know who have met her find her to be a pleasant person, and the occasional Email messages we have exchanged have certainly been positive and friendly. While she tends to view the Four Horsemen of the Infocolypse as a bit more threatening than the typical Cypherpunk, I don't think her views are so extreme as to justify the continuous screams of "crypto toady", "government suckup", and "wicked witch" which seem to pop up in response to her every utterance. I would even go so far as to say that this list would be a lot more entertaining if she were contributing to it, and sci.crypt is certainly a less interesting place now than it was in bygone days when she was posting there. Perhaps Tim can add his own thoughts to this thread. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 10

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 06:08 AM 11/26/96 -0800, Paul Pomes wrote: >There are some commercial products worth studying. See ><http://rainbow.rmi.net/~comscire/> for one. Thanks for the reference. However, I was very unimpressed with their price of $295 dollars. I don't doubt that there are certain organizations (banks?) which would have no problem affording them, but that's well out of the range of ordinary consumer items. I just bought a 10x CDROM drive for $100; somehow I think that a hardware RNG should cost less than that. Volume is a big issue, I suppose. Jim Bell jimbell(a)pacifier.com

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

I would say that depends on -where- &/or -how- you store the premaster/master, and is dependent on platform threat models rather than attacks on the wire. These are different problem spaces with different solutions, which some contemplated changes to SSL may help address: some tweaks may be useful to support more secure secret management on the platforms. But I would not go so far as to say that these issues make SSL or an implementation insecure per-se, until I did the complete job. If my platform is compromised such that the master or premaster secret can be subverted, then I have problems that go way deeper than SSL or a particular implementation of it. Would you like to propose some fixes? We would be very interested. Ben Laurie wrote .... >SSL requires the keying material to be available at all times. This is rather >different from many applications of cryptography, where one can keep keying >material safely locked away except when it is needed. > >This is the inherent vulnerability. > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

Well, then, tanslation: "I say SSLEAY is not secure - but to actually do the homework to back my assertion then someone has to pay me." Hmmmph. Not very useful. Nor credible. >I think I would discuss this with the author before going public, to give >him the usual opportunity to clean up before all hell breaks loose. However, >that is what I'd call "work" rather than "fun", so I'd want paying for it. > >No doubt I'll take it up with Eric at some point, when neither of us has >anything better to do. > >My impression is that Eric is more interested in speed and functionality than >strict security (and considering the incredible vulnerability that is more or >less inherent in an SSL implementation, I feel the same). I could be wrong, of >course. > >I will say that I'm not aware of any problems that a good firewall and physical >security don't take care of. That isn't to say there aren't any - I haven't >looked that hard. > >Cheers, > >Ben. > >> >> >I've never seen a security review of SSLeay, and if anyone gave it a clean >> bill >> >of health, they didn't have their eye on the ball. Note, I'm not knocking >> >SSLeay here, it is a wonderful lump of code, but it hasn't been written with >> >security in mind (IMHO). >> > >> >Cheers, >> > >> >Ben. >> > >> >-- >> >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >> >Freelance Consultant and Fax: +44 (181) 994 6472 >> >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >> >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >> >London, England. Apache-SSL author >> > >> > > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

News Release (USCIB): Tuesday, November 26, 1996 Banks Making Sweeping Changes in Operations to Meet Challenges of International Markets Study finds international banks applying mix of reengineering and new technology to improve operations. In an effort to reduce costs and boost productivity, international banks are reengineering their operations departments and updating technology at increased rates, according to a two-year study of top international banking operations officers conducted by the U.S. Council on International Banking (USCIB) and the USCIB Foundation. Operations departments, which generally maintain activity other than retail banking or customer service, are becoming increasingly critical in international banking, due to the explosive growth of transnational business and the convergence of commercial and investment bank activities. Such industry developments have left many corporate clients looking for "one-stop shopping" for their banking matters as an easier way to meet their financing needs. At the USCIB Annual Conference in mid-November, it was noted that banks are going to have to employ more agility in order to satisfy their corporate clients' escalating demands for simplicity. The increasing cost of running an operations department is also forcing executives to take a sharper look at where they can trim their budgets. According to the USCIB study the annual operations department budget is now $ 15 million, compared with $ 9 million in 1995, an increase of more than sixty-six (66%) percent. In more than half (52%) of the operations departments surveyed, labor costs accounted for fifty (50%) percent or more of their budgets. To reduce costs, executives have turned to reengineering and downsizing. Thirty six (36%) percent have reengineered their departments, and of those, sixty-three (63%) percent reported the action had reduced costs and improved productivity. Nearly one-half (49%) of operations executives have either downsized their departments in the past year or plan to in the one to come. In addition, all of the executives surveyed plan to invest in technology over the next 12 months in order to speed up operations and handle the increase in international transaction banking. Ninety-six (96%) percent of respondents say they will invest in technology, up from eighty-nine (89%) percent in 1995. Just under half of surveyed operations departments use a technology system that is over three years old, and sixty-three (63%) percent of prospective buyers expect to spend more than $100,000 to replace or upgrade aging equipment in the next year. The U.S. Council on International Banking (USCIB) is a national association representing more than 320 U.S. and foreign-based financial institutions with operations or subsidiaries in the United States. One of the oldest U.S. banking associations, the USCIB works to standardize international banking rules and practices, serves as advocate to U.S. and international regulatory bodies on policy issues that affect its membership, and provides training and information to bankers throughout the United States. This study included 55 of its members and other executives and was conducted in late July and August, 1996.

1 0

Re: cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i think that i understand what you are trying to say, however, my purpose in asking for this information has nothing to do with what i know. i am pulling together a series of tests for our firewall, and am not satisfied that the entries/cracks that i know are the only ones that exist, therefore, i ask others for their input. seems reasonable, doesn't it? thanks for you response. cheers, -paul > From deviant(a)pooh-corner.com Fri Nov 29 12:55:52 1996 > Date: Fri, 29 Nov 1996 17:54:10 +0000 (GMT) > From: The Deviant <deviant(a)pooh-corner.com> > X-Sender: deviant(a)random.sp.org > To: pjb(a)ny.ubs.com > cc: cypherpunks(a)toad.com > Subject: Re: cgi-bin vulnerability > Organization: The Silicon Pirates > MIME-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Content-Length: 1025 > > -----BEGIN PGP SIGNED MESSAGE----- > > On Fri, 29 Nov 1996 pjb(a)ny.ubs.com wrote: > > > does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf > > vulnerability? > > > > cheers, > > -paul > > > > If you can't figure out how, you probably don't need to know. (actually, > its so simple the average high school student could probablyfigure it out, > if they knew what %0A meant... oops.. wasn't supposed to tell you that... > ;) > > --Deviant > PGP KeyID = E820F015 Fingerprint = 3D6AAB628E3DFAA9 F7D35736ABC56D39 > > "All in all is all we are." > -- Kurt Cobain > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQEVAwUBMp8jSjCdEh3oIPAVAQFkoAf+Nu62ObHyWHgDvkWAqqH7QTw4svfkELTB > d5E8S1ghkyxL1219LwGljelQ+uHaZt4EGB/nnDfQo7H2J9fMDR1CLJRC+h95xxKM > mKuAVbVT1W3nPm4+WP5DIplMvF/xVmextdbGLmAfYQksXQ4uGNRuaawS9G2ffYLP > erBEN9XuxvVY0AnTYCErnpDdOhh4BNTi2+os86Ea+mXt2FG3D8y0pdfRSnOJm2YU > yvQ7pUrMfhl9DGauc+lvb42B8OXWElnjYIFloxWr+rxACzS6NCbGF3izjfTv+2HX > tRZUuwYNee3j+p7kDY9ebANJqWUcMtR9To5za1/vlA4QAtPl5HsaVw== > =3/ok > -----END PGP SIGNATURE----- > >

1 0