December 2003 - cypherpunks-legacy

Message-Id / mail2news gateways.
by Anil Das 17 Dec '03

17 Dec '03

This is for all the volunteers who are working on setting up the distributed cypherpunks mailing lists. 1) Please preserver Message-Ids while resending messages. The Message-Id is intended to be unique to a message and can be used to reject duplicates. Usenet software in particular, detects duplicates by Message-Id. 2) In response to Igor's query, I would very much like at least on of the distributed lists to be set up such that messages sent there will *not* be gatewayed to Usenet. As I mentioned, I will not post to Usenet with my real email address, and if all lists get gatewayed to alt.cypherpunks, I have to set up fake email headers to mail to the lists also. If at least one of the lists can gaurantee that it won't be gatewayed to Usenet, I don't have to do that, and as a nice bonus, Prof. Froomkin can continue to be active on cypherpunks. This can be achieved by the list software adding an "X-Post-to-Usenet: No" or some similar header to every message it sends out. Also a header, such as X-List: should be set to indicate under which mailing list a message first entered the system. This will be worthless unless all the list servers honor these headers. Thanks. -- Anil Das

1 0

Re: Anyone have the complete info on CP list alternatives?
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"reece(a)taz.nceye.net" "Bryan Reece" 17-FEB-1997 23:23:10.06 >> use. However, I do have one problem with this recipe: lack of >> loop prevention if a news2mail gateway is going in the other direction. >All the mailing-list hosts are supposed to check for duplicates before >forwarding anything, so this shouldn't do anything worse than have a >few extra copies of each post get discarded, loading the network and >the hosts a bit more. But posting the list to a widely-distributed Umm... IIRC, the only person who's announced how he's filtering for duplicates is Igor, and he's just checking for messageIDs. Won't those get chunked on going through a mail2news gateway, and thus possibly come back through a news2mail gateway? The filtering mechanism could be improved via MD5 digests, etcetera (someone's already given a recipe for such; thank you), but even so various mungings could still set up a mailing loop. (Yes, I'm paranoid about those; I may have been reading list-managers for too long and seen too many stories on there.) The sensible place to keep track of possible duplicates is at the gateway; it can certainly filter based on that it (or, for that matter, another known bidirectional gateway) sent a message out. >newsgroup seems wrong for noise (both to the list itself and to >posters) and delay reasons. Delay reasons being that mail will go to Usenet, go all over the place there, and then get replied to later than if it were just on the mailing list(s)? A potential problem, yes. But (especially given the options I mentioned below), this would appear to be a matter for individual users to decide by which list they go with and any added control headers. Maximum individual sovreignty (sp?). >> In regards to your later query about whether people want their postings >> going to Usenet, might I suggest that this be individual to the given >> distributed mailing list? In other words, since the recipe is logically >> going to have to not forward to a gateway messages from other mailing >> lists (since it's not a good idea to have multiple copies of the same >> message arriving at the gateway if it can be helped; better to filter >> it out beforehand), >It doesn't seem an especially bad idea, since it Thank you. Were you cut off? >> some of the mailing lists can forward and the >> others cannot. (One could even determine this behavior on application >> of the proper X-header, although I never trust various mailing systems >> to forward such intact.) The same could also be done with gatewaying >> _from_ Usenet - if the news2mail gateway feeds to whatever individual >> lists sign up to it and they _don't_ forward such messages to others, >> people can decide whether or not to receive Usenet postings on >> alt.cypherpunks.* by which list they subscribe to. >The code currently running is a perl script that turns typical email >messages into something INN is happy with. It is probably possible to >get your message rejected by INN if you put obsolete or otherwise >unusual and illegal headers in. This may be a bug. That would probably depend on: A. if any other circumstances other than deliberately sabotaging your message's translation would also disrupt its chances of getting through seriously, particularly if they weren't something you'd spot; and B. if sufficiently bad messages would disrupt INN's operations too much. You'd know a lot more than I would in regard to the latter, and probably the former. I was last a serious participant on USENET on a Vax running VMS (via Bitnet, as a matter of fact... a while back). -Allen

1 0

Re: Anyone have the complete info on CP list alternatives?
by E. Allen Smith 17 Dec '03

17 Dec '03

From: ichudov(a)algebra.com (Igor Chudov @ home) >Bryan Reece wrote: >> >> It receives some Big Usenet groups, but only for local users. >> alt.cypherpunks is open, but there will be long delays, on the >> order of a day, for articles there (unless someone better connected to >> Usenet wants to feed me alt.cypherpunks.*---any volunteers?). Well, Lance Cottrell would appear to be a good person to ask on this matter, but... >I just set up a recipe for using mail2news gateways like this: >:0 c >| formail -I "Newsgroups: alt.cypherpunks,misc.misc" | \ > sendmail mail2news(a)anon.lcs.mit.edu mail2news(a)utopia.hacktic.nl >Any objections? given that mail2news(a)anon.lcs.mit.edu gets one of its USENET feeds via cyberpass.net, it would appear to be unnecessary if this recipe is in use. However, I do have one problem with this recipe: lack of loop prevention if a news2mail gateway is going in the other direction. I don't know, but the mail2news gateway folks may not be too happy with this idea either, given massively increased load; this is particularly true since IIRC misc.misc is _not_ the proper place to crosspost stuff from & to; it's only for stuff that _really_ doesn't fall under any other category. (I've crossposted this message to the remailer-operators mailing list to make sure it gets to the operators of the gateways in question.) In regards to your later query about whether people want their postings going to Usenet, might I suggest that this be individual to the given distributed mailing list? In other words, since the recipe is logically going to have to not forward to a gateway messages from other mailing lists (since it's not a good idea to have multiple copies of the same message arriving at the gateway if it can be helped; better to filter it out beforehand), some of the mailing lists can forward and the others cannot. (One could even determine this behavior on application of the proper X-header, although I never trust various mailing systems to forward such intact.) The same could also be done with gatewaying _from_ Usenet - if the news2mail gateway feeds to whatever individual lists sign up to it and they _don't_ forward such messages to others, people can decide whether or not to receive Usenet postings on alt.cypherpunks.* by which list they subscribe to. -Allen P.S. A thank you to Reece for setting up a gateway; I had looked at the program and did _not_ much like the idea of having to maintain it on my limited knowledge of C/C++ and mailing software.

1 0

Re: Anyone have the complete info on CP list alternatives?
by Bryan Reece 17 Dec '03

17 Dec '03

Date: Mon, 17 Feb 1997 22:55 EDT From: "E. Allen Smith" <EALLENSMITH(a)ocelot.Rutgers.EDU> Well, Lance Cottrell would appear to be a good person to ask on this matter, but... >I just set up a recipe for using mail2news gateways like this: >:0 c >| formail -I "Newsgroups: alt.cypherpunks,misc.misc" | \ > sendmail mail2news(a)anon.lcs.mit.edu mail2news(a)utopia.hacktic.nl >Any objections? given that mail2news(a)anon.lcs.mit.edu gets one of its USENET feeds via cyberpass.net, it would appear to be unnecessary if this recipe is in use. However, I do have one problem with this recipe: lack of loop prevention if a news2mail gateway is going in the other direction. All the mailing-list hosts are supposed to check for duplicates before forwarding anything, so this shouldn't do anything worse than have a few extra copies of each post get discarded, loading the network and the hosts a bit more. But posting the list to a widely-distributed newsgroup seems wrong for noise (both to the list itself and to posters) and delay reasons. (I've crossposted this message to the remailer-operators mailing list to make sure it gets to the operators of the gateways in question.) In regards to your later query about whether people want their postings going to Usenet, might I suggest that this be individual to the given distributed mailing list? In other words, since the recipe is logically going to have to not forward to a gateway messages from other mailing lists (since it's not a good idea to have multiple copies of the same message arriving at the gateway if it can be helped; better to filter it out beforehand), It doesn't seem an especially bad idea, since it some of the mailing lists can forward and the others cannot. (One could even determine this behavior on application of the proper X-header, although I never trust various mailing systems to forward such intact.) The same could also be done with gatewaying _from_ Usenet - if the news2mail gateway feeds to whatever individual lists sign up to it and they _don't_ forward such messages to others, people can decide whether or not to receive Usenet postings on alt.cypherpunks.* by which list they subscribe to. -Allen P.S. A thank you to Reece for setting up a gateway; I had looked at the program and did _not_ much like the idea of having to maintain it on my limited knowledge of C/C++ and mailing software. The code currently running is a perl script that turns typical email messages into something INN is happy with. It is probably possible to get your message rejected by INN if you put obsolete or otherwise unusual and illegal headers in. This may be a bug.

1 0

Re: The Science Generations, II
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Mon, 17 Feb 1997, Jeremiah A Blatz wrote: > You neglect things like the interstate commerce provision, which means > that if it crosses state lines, the feds can regualte it. In addition, > the court (in its infinite wisdom), decided that "the people" meant > the states, then the people. So, as long as it isn't meantioned in the > constitution, the states can do whatever they want. The 10th amendment states: "The powers not delegated to the United States by the Constitution, nor prohibited by it to the states, are reserved to the states respectively, or to the people." This sounds pretty clear to me. Theoretically, the states can do whatever they want as long as they don't infringe on the rights of the people. The 9th amendment protects all rights not explicitly stated in the constitution. The 5th and 14th amendments both protect people from losing life, liberty, or property without due process. I believe that the 14th was used as justification for Roe vs. Wade, since the court decided that abortion is a liberty and any law forbidding it deprives a woman of liberty without due process. Of course, in practice, we know that the situation is much different... Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMwkjwSzIPc7jvyFpAQE9QwgAj+op9T6AT858eS89RyAiYnwP02APgr3I 1ZkguMV5JiJWOKrhXu54/k7sVam4sxCftvC3Poon9K4yCQ+rtTUL3bF81+ppdXMr cCfEMU5RNZVDU5sddR5nWkOHagXFatSYK6v7IUqYfquWgq1/9m6NQIO25+RleHmv nz9ZjaeWdljPx0SWjg77Ul8/8fJkNn/sHn3rTBUdNeGBLkipAY82vv4hZFC2A8uf zAjbD+GEYl4Vbu+GpOPkb+RDkECZ762zVQ2DX4yHeGq58Ejs/a4+XHXT6MqYs8Xy phnluL347m/OrDCPekCT4nOgt0zHGoDQ8PYinxbDUjxLHC7rOzKe9g== =5iIy -----END PGP SIGNATURE-----

1 0

Removal from newsgroup listing
by Terry L. Davis 17 Dec '03

17 Dec '03

I'm not certain how I got on the cypherpunks newlist, but it's way over my head. Please removed terryld(a)earthlink.com from cypherpunks(a)toad.com Thanks

1 0

Re: European crypto export policy
by Martin Minow 17 Dec '03

17 Dec '03

At 02:39 +0100 1997.02.18, Ulf Möller wrote: >Swedish Datateknik 97-02 features an article about how COCOM/ Wassenaar >Arrangement effects Swedish crypto exports. > >I wonder if someone whose Swedish is better than mine could summarize >the article? It is at http://www.et.se/datateknik/arkiv/97-02/5.html > This is a sloppy and probably inaccurate translation. Martin Minow minow(a)apple.com Datateknik 97-02 97-01-30 EEC countries forbidden for Swedish crypto-export. The export control agreement that governs Sweden's export of sensitive high-technology even stops sale of encryption software to several EEC countries. Security-political considerations from cold war days are a serious barrier for integration in the EEC. In international regulation of high-technology commerce, crytographic equipment and crypto-software is either directly considered "war material" or counted as dual-use products -- i.e. products with both civil and military use. Twenty-eight industrial countries, including Sweden, stand behind the rules ... called "Wassenaar Agreement" after the suburb to Den Haag in the Netherlands where they were written. ... The Wassenaar Agreement is a continuation of COCOM (the West's embargo of high-technology to the Eastern block). After COCOM was lifted in 1993, there were discussions about what should be included in future controls. The USA, for example, would not accept Russian involvement while Russia exported weapons to Iran. Eventually, Russia and the other Eastern-Bloc countries accepted Wassenaar [this is probably a poor translation] and, today, 33 states are partners in the agreement, including even South Korea, Bulgaria, and Turkey. ... Encryption equipment is included in the group "information security" in the goods-list and regulations that control Swedish high-tech export. (SFS 1994:2060, lastest revision December 1996). [SFS is the national registry of all Swedish laws, proclamations, and similar.] This control includes essentially all digital encryption systems. Export may not take place without approval of the "Inspectorate for Strategic Products" (ISP) at the Foreign Office. Following the rules, a Swedish resident would break the law by carrying a portable computer with a "trivial encryption program (that is not commercially available)" on the ferry boat across Oresund to Denmark without a specific export license! A bank ATM card with an encrypted password can be carried, but not a "smarter" bank or ID card. While licenses are available, they require special testing. The product must be "strength-classified" which, in complicated cases, would be done by the the Defense Radio Service (FRA) [the Swedish equivalent to NSA]. Also, the destination land and the importer's technical knowledge will also be examined closely. For Swedish exporters to Europe, this is often experienced as a "terrorising bureaucracy." ''We who are major exporters of encryption equipment to telephone [service] operators in, for example, Germany, must let every delivery be individually examined by ISP despite the fact that the same products are often repeated,'' says Haakan Persson at Swedish AU-system. The explanation is that not every EU land fulfills the Wassanaar requirements. The point of the rules, explains Egon Svensson at ISP, is that we do not spread advanced technology to countries that have not had it previously. Thus, certain countries are excluded. For encryption equipment, only England, France, Holland, Sweden, Germany, and perhaps a few others, are considered to have sufficicent capacity and knowledge to be recipient countries. They say that the restrictions within EU are temporary, but there is no immediate sign that they will be eased. Author: Christer Akerman, christer.akerman(a)datateknik.se Original Copyright Datateknik ----- ps: the same issue of DataTeknik has a review of a Swedish biography of Arne Beurling, a Swedish cryptographer who broke a German World War II telegram (teletype?) encryption machine "Geheimschreiber T52a/b." After Germany occupied Norway, all German communication passed through neutral Swedish telegraph cables, and the Swedes didn't pass up the chance to sample the traffic. Breaking the code was described by David Kahn as "one of the great feats of crytoanalysis" of the Second World War. The book is Svenska kryptobedrifter" by Bengt Backman. Bonniers, ISBN 91-0-056229-7

1 0

Security alert!!!
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

WARNING: There's a rogue trojan horse out there on the internet known as the "stronghold web server". It's actually a hacked-up version of Apache with a backdoor, which allows hackers (or whoever knows the backdoor) to steal credit card numbers and other confidentil information on the Internet. Be careful! Always use encryption. Do not send confidential information (such as passwords and credit card numbers) to any site running the trojan horse "stronghold". In general, beware of "snake oil" security products and hacked-up versions of free software. Please repost this warning to all relevant computer security forums.

1 0

Re: PDAs as alternatives to smart cards?
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:49 PM 2/17/97 -0800, Steve Schear <azur(a)netcom.com> wrote: >With the widespread adoption of an industry standard IR link between PDA >type devices, networks and PCs might this not present an opportunity for >their use as more user-configurable and application agile financial and >communiation privacy instruments? PDAs are becoming somewhat widespread among technical and sales people, but there are a lot of different varieties and horsepowers, and some are generally programmable with near-free-ware while others aren't. Newtons have horsepower, but aren't that common; most of the others have 8086en or so, including the easily-programmable DOS HPs, the cool objecty Psion OS, a few different GeoWorks based systems (is Pilot one of those?), etc. Then there are a huge number of totally non-programmable Rolodex/Calendar widgets. Any of the interesting ones cost too much to go after the retail market, and they're owned by people who can use email. For the broad market you want a <=$10 device, and stores grumble if you charge more than $200 for a really complete reader system - which means smartcards. Perhaps once pager capability in PDAs becomes widespread and cheap, the retail/wholesale pharmaceutical trading set could get interested :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Security alert!!!
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

WARNING: There's a rogue trojan horse out there on the internet known as the "stronghold web server". It's actually a hacked-up version of Apache with a backdoor, which allows hackers (or whoever knows the backdoor) to steal credit card numbers and other confidentil information on the Internet. Be careful! Always use encryption. Do not send confidential information (such as passwords and credit card numbers) to any site running the trojan horse "stronghold". In general, beware of "snake oil" security products and hacked-up versions of free software. Please repost this warning to all relevant computer security forums.

2 1