December 2003 - cypherpunks-legacy

Re: "cypherpunks is dead..."
by snow 17 Dec '03

17 Dec '03

> At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > is stil bogged down, for reasons I have to believe have to do with > pressures from somewhere, else why would e-mail packages not make PGP > support painless?) There are several packages that do provide at least some level of PGP integration, but I have 2 very good reasons: 1) The "market place" isn't willing to pay for the additional work. 2) It isn't "sexy" enough to cause a programmer to want to add it to a mailer just for fun.

1 0

Re: "cypherpunks is dead..."
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:37 pm -0500 on 2/20/97, snow wrote: > > At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > > is stil bogged down, for reasons I have to believe have to do with > > pressures from somewhere, else why would e-mail packages not make PGP > > support painless?) Uh, that wasn't me. Sorry... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: DES and RSA crypto hardware from the free world
by Dan Geer 17 Dec '03

17 Dec '03

These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? The critical thing is to get the horse out of the barn before the door is barred. Each and every one of these sorts of vendors has to establish use and distribution on a wide basis before governments of any stripe start locking down on domestic use. There is little time and, yes, I am a paranoid who hopes thereby to survive. --dan

1 0

Translating C++ to Java
by Chris Laffra 17 Dec '03

17 Dec '03

Hi, I hope the following information is of interest, otherwise please ignore... In August 1996 my book "Advanced Java" was published, and it still is one of the only books that is not only absolutely emphatic about the language, but in addition has a critical, honest, and objective look at Java. I am very happy with the reception of the book -- it is one of the Java best-sellers, especially considering the small intended target buyers segment (the more advanced Java programmer). Enclosed with the book is C2J, an automatic C++ to Java translator, written in C++ and requiring specific UNIX tools. My version of C2J was not very useful for a lot of people because of the requirements on the environment. I challenged the online community to look at the software and come up with a full Java version. I am happy to report that has happened. A student at PACE University in New York, Ilya Tilevich, took the challenge and did a really nice job in making C2J a full Java program. For more information, check out my personal home page at America Online: http://members.aol.com/laffra and download the zip file containing the Java class files and source code. I hope this information is useful for you, Chris Laffra.

1 0

Why Digital Video Disks are late to market
by Martin Minow 17 Dec '03

17 Dec '03

http://techweb.cmp.com/eet/news/97/942news/encryp.html To summarize, the Digital Video Disk standard contains an encryption standard for copyright and anti-piracy protection. however, "some U.S. PC and silicon vendors have just about abandoned hope of keeping to their revised launch schedules for DVD-enabled systems." ... as far as anybody knows, "none of the U.S. PC vendors today has a license to use the DVD-decryption algorithm" in software. "We all know the situation; we don't have a license," said Michael Moradzadeh, program manager of Intel's copy-protection task force. A solution may be in the offing within days. Some sources said late last week that Matsushita [who owns license rights] and key U.S. computer companies may resolve the software-licensing issues by the end of this week. The PC industry seeks amendments to the licensing-agreement language that would result in equivalent treatment of software- and hardware-based CSS decryption. ... there apparently has been some speculation among the U.S. PC community that Matsushita may be stonewalling on the software-licensing issue so that it can establish its hardware-based decryption solution in the marketplace. --- Nothing in the article suggests that "national interests" are involved. Martin Minow minow(a)apple.com

1 0

FWD: (CHANGE: NUVUPSY - Against the therapeutic state)
by Robert Hettinga 17 Dec '03

17 Dec '03

Tell me what this has to do with cryptography, and I'll give you a nickle. Or, maybe not... ;-). Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 20 Feb 1997 09:48:47 -0600 Reply-To: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Sender: NEW-LIST - New List Announcements <NEW-LIST(a)LISTSERV.NODAK.EDU> From: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Organization: The American University Subject: CHANGE: NUVUPSY - Against the therapeutic state To: NEW-LIST(a)LISTSERV.NODAK.EDU NVVUPSY has moved to a new server and has a new E-mail address. NUVUPSY on LISTSERV(a)MAELSTROM.STJOHNS.EDU "Although we may not know it, we have, in our day, witnessed the birth of the Therapeutic State. This is perhaps the major implication of psychiatry as an institution of social control." (Thomas Szasz, 1963) NUVUPSY is a forum to share points of view critical of the "therapeutic state" and institutional psychiatry, and those supportive of contractual psychotherapy and psychiatry. We're interested in discussions concerning the relationship between liberty and responsibility and its implications for clinical, legal, and public policy. The list will serve to promote alternative views to explaining unwanted behaviors. Sociological perspectives on the medicalization of deviant behavior are welcome. Other topics for discussion include but are not limited to: The myth of addiction as a disease; the ideology of biological determinism; the obsolescence of the schizophrenia hypothesis; coerced treatment for addiction and First Amendment rights; criticism of psychiatric drug prescriptions; etc. NUVUPSY Board of Advisors include: Bruce K. Alexander, Phil Brown, Robert C. Carson, David J. Essex, Louis B. Fierman, Robert E. Haskell, Reid Klion, James C. Mancuso, Roberta Russell, Theodore R. Sarbin, Jeffrey A. Schaler, and Richard E. Vatz. Archives of NUVUPSY mail items are kept in monthly files. You may obtain a list of files in the archives by sending the command INDEX NUVUPSY in the BODY of e-mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU (NUVU as in "new view", V=vee) To subscribe, send the following command in the BODY of mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU SUBSCRIBE NUVUPSY yourfirstname yourlastname Owner: Jeffrey A. Schaler, Ph.D. jschale(a)american.edu Martin W. Smith mws(a)metis.no NUVUPSY List Coordinators ------- Use this information at your own risk. For more information and disclaimer send E-mail to LISTSERV(a)LISTSERV.NODAK.EDU with the command INFO NEW-LIST in the body. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

No Subject
by Scott A. Hommel 17 Dec '03

17 Dec '03

For those of you who haven't seen this... "fake-web" document. A way hackers may easily get around things like SSL. http://www.cs.princeton.edu/sip/pub/spoofingDocumentWithLongUntypeableName.… ********************************* Scott A. Hommel President, New Paradigm Design, Inc. PGP key available at: http://paradigm-2.com/scott.html *********************************

1 0

RRE: crime and technology
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 20-FEB-1997 07:55:48.58 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 19 Feb 1997 18:51:34 -0500 From: Belinda Juran <juran(a)law.harvard.edu> [...] Harvard Journal of Law & Technology Symposium: Crime & Technology Law Enforcement Technology - Cybercrime - Electronic Commerce Saturday, March 15, 1997 Ames Courtroom, Austin Hall at Harvard Law School in Cambridge, MA. Registration: 9:30 A.M. Tentative Schedule, including Confirmed and Tentative Panelists: 9:30-9:45 Registration & coffee 9:45-10 Introduction 10-12 Panel: "Search, Seizure, and Surveillance Technology" (searching of technology & the technology of searching) Moderator: Stephen Heymann assistant United States attorney in Boston who teaches at HLS and was involved with the first wiretap laid on the Internet. Panelists: o Tony West AUSA in San Jose who helped investigate the creator of PGP and is now prosecuting the "Orchid Club" cases against an international child pornography ring that distributed through the Internet. o Chris Slobogin UFlorida professor who is the reporter for the ABA Task Force on Technology and Law Enforcement o Andy Good a Boston defense attorney who has defended computer searches including US v. Steve Jackson Games o Marc Goodman a Los Angeles Police Department sargeant who has investigated computer crimes and has pursued the impact of technology on police departments during his year at the Kennedy School of Government o Elizabeth Marsh a Quinnipiac Law School professor who has done work on encryption and the danger of the federal government's "key" proposal 12 Lunch: box lunch provided 12:45-1:15 Keynote: invited (tentative) keynote speaker: Bob Kahn Corporation for National Research Initiatives 1:15-3:15 Panel: "The Risks of Electronic Banking &Commerce" (content security & payment/banking security) Moderator: Charles Nesson professor at Harvard Law School specializing in legal implications of digital technologies o Marc Rotenberg EPIC (Electronic Privacy & Information Center) o Kelly Frey Copyright Clearance Center o David Byer partner, Testa Hurwitz & Thibeault, Boston, MA o Philip Bane counsel, First Virtual 3:15 end Admission to the Symposium is free to all Harvard affiliates (with valid Harvard ID), $15 for all other students, $30 for public sector professionals, and $100 for private sector professionals. ADVANCE REGISTRATION IS STRONGLY SUGGESTED. - ------------------------Registration Form------------------------------- Harvard Journal of Law & Technology Symposium on Crime & Technology; March 15, 1997; registration begins at 9:30 a.m.; program begins at 10:00 a.m. Ames Courtroom, Austin Hall, Harvard Law School, Cambridge MA Name:____________________________________________________ Affiliation _________________________________________________ Address __________________________________________________ __________________________________________________ Telephone:________________________________________________ Email:____________________________________________________ Check One: _____ Private Sector Professional: $100 _____ Public Sector Professional: $ 30 _____ Student: $ 15 _____ Harvard student (valid ID must be presented at the door): free Make checks payable to: Harvard Journal of Law & Technology Mail the completed registration form with check to: Symposium Registration Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 - ------------------------------Cut Here-------------------------------------- The Symposium is sponsored by Hale and Dorr L.L.P., Boston, MA. The Spring Issue of the Journal will include articles covering the broad topic of "Crime and Technology." For additional information about the Symposium, contact Symposium Editor Belinda Juran, by e-mail at juran(a)law.harvard.edu, or by phone at the Harvard Journal of Law & Technology offices at 617-495-3606 or 617-493-7949. ABOUT THE JOURNAL: The Harvard Journal of Law & Technology is a leading scholarly publication for articles addressing the many diverse interstices of science and technology with law and society. We have published articles by law professors, practitioners, business leaders, and politicians on varied topics including biotechnology, computers, international trade, technology transfer, intellectual property, medical technologies, and telecommunications. These and other subjects are some of the most exciting and rapidly developing areas of the law, and we believe that the dialogue provided by the Harvard Journal of Law & Technology will help to shape the future of this important field. We welcome submissions of articles, case comments, or book reviews addressing the relationship of law and technology. SUBSCRIPTION INFORMATION: For additional information, please contact the Journal at the address below. The Journal publishes three issues each year. To subscribe to the Journal's upcoming issues in Volume 10, please send the Journal a check for U.S. $45.00 (foreign orders $50.00) to the address below. To obtain the issue discussed above or back issues, please send the Journal a check for $35.00 with a note indicating the desired issue (i.e., "Vol. 9 No. 2"). ************************************************************************* Harvard Journal of Law & Technology Publications Center Harvard Law School Cambridge, MA 02138 Telephone: (617) 495-3606 Fax: (617) 495-8828 E-Mail: jolt(a)law.harvard.edu WWW: http://www.law.harvard.edu/home/jolt/ *************************************************************************

1 0

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Re: Constitution and a Right to Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: Dale Thorn <dthorn(a)gte.net> >Greg Broiles wrote: >> At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >> >It's good if you don't read the L.A. Times. One of their lead editor- >> >ializers (whores), a professor at USC law school named Erwin Chemerinsky, >> >writes in relation to this subject "The federal government is an inde- >> >pendent sovereign that cannot have its powers diminished by a state >> >government's actions." (exact quote, 2/7/97). Either that's a load of >> >BS doubletalk, or it's one of the more fascistic commentaries from the >> >Times, which is usually bad enough. >> Hey, don't forget to shoot the messenger. Chemerinsky's statement is a >> concise summary of at least the last 70 years of double jeopardy >> jurisprudence. The only thing that's unusual about the use of the "dual >> sovereign" doctrine against the cops who beat King was that it's usually >> used against ordinary citizens, not cops. Do you suppose it's possible >I understood clearly the (supposed) intent of the feds in retrying >the Whites in the South who were beating up on Blacks and getting >off with White juries - I just believe they would have served the >people better by declaring mistrials or something instead of using >the "dual sovereignty" BS, since a study of the Constitution and >its preparatory papers shows the fathers clearly would have balked >at this. I had understood the basic reasons for the double jeopardy limit to be two: A. to prevent government from tormenting innocent individuals with repeated trials; and B. to prevent convictions of innocents by simple repeated trials until a jury made a mistake. The latter can be analogized in statistics to the consideration that a test with a p value of .05 will turn out false positive results 1 time in 20 by the nature of it; thus, if you look at two different studies/trials with an independent (an oversimplifying assumption for trials, admittedly) 5% chance of an incorrect conviction, the chance is 1-((19/20)(19/20)) or 9.75% for _either_ of them turning out a false positive instead of a 5% chance. In a system partially based on the principle that it's better to let the guilty go free than to punish the innocent, this result is not acceptable. While the founding fathers probably didn't realize the mathematics behind the second, I suspect that they had some intuition of its nature. I can see an argument, however, for using it in the case of state employees, particularly police - the state judicial/prosecutorial system can hardly be said not to be biased in favor of them. A better solution, however, would be to simply do the trial in a federal court to begin with. (Having trials of federal employees in the courts of the state of their alleged victims would be a correspondingly good idea, although multiple possible states for this could be a problem.) I'd appreciate comments from persons with more legal knowledge than I have; I am simply going by logic here. -Allen

1 0