December 2003 - cypherpunks-legacy

Re: fingerd
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Hi, These messages have been sent about fingerd. My preference for fiddling with remote fingers is to leave fingerd as supplied by the vendor (run by "nobody") and replace the finger program itself. It can be made to recognise when it is being run by "nobody" and behave differently from when run by another user. Source at the end of this file. (Bashed out fairly quickly starting from a utmp-eraser I made for a luser who wouldn't tolerate wall messages from shutdown.) I have (among other things) an extension to TCP-wrappers (a new hosts_access.c file), and a prog to find disk space wasted by duplicated files. (mail me with Subject: "send goodies" for these.) -- Peter Allan peter.allan(a)aeat.co.uk Date: 23 Jan 1997 17:22:10 -0800 From: Steven L Baur <steve(a)miranova.com> > cfingerd is not a safe program. It must run as root, and has some big > problems. > On Tue, 17 Sep 1996, Administrador da Rede wrote: > > I use the newest version of cfinger, setted to not allow general finger, just > > specific ones. Does anyone knows how this person did that ? I hope I can > > find out, otherwise, bye bye finger service. > Badly. > I have sent the author a letter, but never got any reply back (it's 3 > months later now!), so I just take the opportunity to warn the public > against its use. /* * * compile and test myfinger * * cc -C -o myfinger myfinger.c * * * (assuming the standard finger is /usr/ucb/finger) * cp /usr/ucb/finger /usr/ucb/finger.real * cp myfinger /usr/ucb/finger * * * (if using TCP wrapper reverse-fingers, make them NOT nobody, * but another id such as nobody2.) * * I disclaim any disasters........ * */ /* * * my finger program - local only, to be less informative than /usr/ucb/finger * */ #undef _utmp_h #define TRUE 1 #define FALSE 0 #define FAKE 1 #define WIPE 2 #define UTMP "/etc/utmp" #include <stdio.h> #include <pwd.h> #include "utmp.h" #include <lastlog.h> main(argc, argv, env) int argc; char **argv; char **env; { int i, listed; struct passwd *pwent; if (argc < 1) exit(0); /* beat sneaks */ /* If run by "nobody" (uid=65534) assume this is a remote finger */ /* otherwise run the standard finger command */ if (65534!=getuid()) { execv("/usr/ucb/finger.real", argv); /** if we get here exec failed, so we default to my finger **/ } printf("Login Name Where\n"); listed = 1; while ((pwent = getpwent()) != NULL) { if (argc > 1) { /* * if there are args, and name is NOT one of them, we skip * it */ listed = 0; for (i = 1; (!listed) && (i < argc); i++) { if (!strcmp(argv[i], pwent->pw_name)) listed = 1; } } if (listed) info(pwent); } } info(pwent) struct passwd *pwent; { long lpos; FILE *fp; int i; struct utmp *sp; struct utmp utmpentry; char *login,*gecos; login=pwent->pw_name; gecos=pwent->pw_gecos; sp = &utmpentry; if ((fp = fopen(UTMP, "r")) == NULL) { fprintf(stderr, "failed to open utmp for reading\n"); exit(1); } i = fseek(fp, 0, 0); if (i) { puts("failed to fseek start of file"); exit(2); } do { /* get current pos in file using ftell */ lpos = ftell(fp); /* fread the struct */ fread(sp, sizeof utmpentry, 1, fp); if (!feof(fp)) { if (!strcmp(login, sp->ut_name)) { if (!nonuser(utmpentry)) { utmpentry.ut_host[15]='\0'; printf("%s\t%s\t%s\t%s\n",login,gecos,sp->ut_line,sp->ut_host); } } } /* on error we close & exit */ if (ferror(fp)) { fprintf(stderr, " file error! so failed to find our session in utmp\n"); fclose(fp); exit(3); } } while (!feof(fp)); fclose(fp); } /* end */

2 1

Re: Airport security [no such thing]
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

ichudov(a)algebra.com writes: > Dr.Dimitry Vulius K.O.T.M. wrote: > > Dale Thorn <dthorn(a)gte.net> writes: > > > > > Igor Chudov @ home wrote: > > > > Dr.D. Vulius K.O.T.M. wrote: > > > > > Nurdane Oksas <oksas(a)asimov.montclair.edu> writes: > > > > > > > But think about this: suppose there is a couple, bob(a)household.com, > > > > and alice(a)household.com. Suppose that Rev. Mallory does not like bob. > > > > Mallory forges a lot of emails like "I can still taste your sperm > > > > on my lips", that appear to originate from Cindy(a)phonesex.org. > > > > Then, promptly, Mallory sends an anonymous alert to alice(a)household.com > > > > warning her about naughty email activities of bob. Alice gets mad at hi > > > > and divorces him. > > > > How would bob protect himself against such developments? > > > > > > Frame-ups are as old as time. The ones that work the best are those > > > that are the most believable. O.J., for example. Unless Alice is > > > unusually flaky or paranoid, she'll consider her options against the > > > time she has invested in Bob. > > > > Here's an interesting twist of Sandfort's moderation policy. > > > > My article was crypto-relevant and flame-free and was tossed to > > cypherpunks-flames. > > > > Igor's response to my article was also crypto-relevant and flame-free > > and was tossed to cypherpunks-flames. > > > > Dale's response did not quote me, so it made it to the censored list. > > Is it really true that my response was tossed out as flames? Yes. > It was crypto-relevant. So was my original article. They did not contain any flames or personal attacks, contrary to what Sandy claims. > BTW, this is a more than perfect illustration why rejections > based on "shitstrings" are completely inappropriate for moderating. > > I have nothing again "grey lists", when moderators are alerted when a > message containing certain suspicious word arrives (the way it's done in > STUMP), but am opposed to autorejections (unless mods are mailbombed). It's ironic that Igor's article which I'm quoting ALSO got tossed into cypherpunks-flames, even though it wasn't a flame. Apparently the only comments on moderation that Sandy passes to the censored list are the ones praising him. This way he'll be able to report unanymous support for his moderation policies. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

RE: If you were unable to download UDCM V2.0 before....
by Mullen, Patrick 17 Dec '03

17 Dec '03

>From: DataETRsch@aol.com[SMTP:DataETRsch@aol.com] >o Includes time and date locking features. How do you implement this feature? Where is the time/date information stored? Is this in that header you were talking about before? Is there some method which is designed to thwart simply changing the CMOS time? Thanks! ~ Patrick >---------- >From: DataETRsch@aol.com[SMTP:DataETRsch@aol.com] >Sent: Thursday, January 23, 1997 9:35 PM >To: cypherpunks(a)toad.com >Subject: If you were unable to download UDCM V2.0 before.... > >{If you were unable to download UDCM V2.0 before, we're extremely sorry.} >{UDCM's web site may have been under construction during the time you >visited.} >{UDCM's web site has finished undergoing its changes and will operate >correctly.} >{UDCM V2.0 has been extensively modified from its previous variation.} >{Digital signaturing and public key cryptosystem capabilities have been >added.} >{UDCM's DS and PKCS techniques do NOT make use of conventional PN factoring.} >{UDCM's source code is currently unavailable. PLEASE DO NOT REQUEST IT.} >{UDCM's on-line help documentation has also been extensively modified.} >{This advertisement has also been modified.} > >Hello, > >Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data >Engineering Technologies. I am sending you this message to let you know that >DataET Research has recently initiated the distribution of UDCM, Universal >Data Cryptography Module. UDCM implements a revolutionarily new, extremely >advanced and sophisticated, digital data encryption algorithm named IMDMP, >Integrated Mathematical Data Manipulation and Positioning. > >UDCM (the IMDMP algorithm)... > >o Is a royalty-free Windows DLL module featuring advanced cryptography. >o Contains more than 150 procedures and functions. >o Is a very cost-effective size of only 60 kilobytes. >o Implements the IMDMP encryption algorithm. >o Allows encryption keys as large as 2048 bits. >o Includes 18 sub-algorithms. >o Processes all forms of binary and ASCII files. >o Allows multiple encryption layer levels. >o Has absolutely no back-doors or magical keys. >o Includes time and date locking features. >o Includes file specific unique encryption features. >o Includes file authentication guard features. >o Includes digital signaturing capabilities. >o Implements the public key cryptosystem method of security. >o Includes data importance and sensitivity stamping features. > >UDCM, being a Windows DLL module, can be accessed through programs developed >with popular application and database programming languages and environments >such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo >Pascal, dBase, Paradox, Access, Sybase, Oracle, etc. > >DataET Research has released a shareware version of UDCM named UDCM V2.0. > >To download UDCM V2.0 for free, please go to: >http://members.aol.com/dataetrsch/udcm.html. > >I hope you will consider applying UDCM in the software you develop. Thank-you >very much for your time. > >Sincerely, > >Jeremy K.Yu-Ramos >President >DataET Research >Data Engineering Technologies > >

1 0

Re: THE NEW YORKER on the V-Chip
by Toto 17 Dec '03

17 Dec '03

> From: IN%"abostick(a)netcom.com" "Alan Bostick" 23-JAN-1997 23:09:54.72 > > >In the Jan. 20, 1997, issue of THE NEW YORKER, the "Comment", written by > >Malcolm Gladwell, makes a powerful arguement about the unintended > >consequences of the V-Chip I noticed that when my nephews buy video games, the first ones they check out are the ones plastered with the 'protective' ratings-symbols that proclaim that the game is the 'baddest of the bad' in terms of violence, etc. Thanks to the violence-rating system, they no longer have to waste time checking out 'dweeb' programs that contain absolutely no blood and gore. Toto

1 0

Re: Fighting the cybercensor. (fwd)
by Toto 17 Dec '03

17 Dec '03

Jim Choate wrote: > Typical modern American attitude, getting it right is too much work so let's > lower the benchmark so anyone can be 'right'. Are you referring to the CypherPunks 'censored' list? Toto

1 0

Rejection policy of the Cypherpunks maiing list
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

I would like to start a thread to discuss the moderation and rejection policy. My perfectly crypto-relevant article regarding possible attacks on human relationships with the use of forged mail and anonymous remailers, has been tossed out (sorted) into cypherpunks-flames mailing list. You can receive a copy of my article by an email request. The explanation that Sandy Sandfort gave me mentioned that he rejected my message because it continued a thread where Sandy noticed instances of "flaming". Note that my message was free of any flames, including its quoted part. Sandy also states rather plainly that crypto-relevance is not the criterion by which he moderates this list. I question this policy. I would like to hear your opinions as to whether such policies satisfy the current readership. - Igor.

1 0

Re: If you were unable to download UDCM V2.0 before...
by Krenn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > {If you were unable to download UDCM V2.0 before, we're extremely sorry.} > {UDCM's web site may have been under construction during the time you > visited.} > {UDCM's web site has finished undergoing its changes and will operate > correctly.} > {UDCM V2.0 has been extensively modified from its previous variation.} > {Digital signaturing and public key cryptosystem capabilities have been > added.} > {UDCM's DS and PKCS techniques do NOT make use of conventional PN factoring.} > {UDCM's source code is currently unavailable. PLEASE DO NOT REQUEST IT.} > {UDCM's on-line help documentation has also been extensively modified.} > {This advertisement has also been modified.} Well halellujah. > Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data > Engineering Technologies. I am sending you this message to let you know that > DataET Research has recently initiated the distribution of UDCM, Universal > Data Cryptography Module. UDCM implements a revolutionarily new, extremely > advanced and sophisticated, digital data encryption algorithm named IMDMP, > Integrated Mathematical Data Manipulation and Positioning. > > UDCM (the IMDMP algorithm)... OH! OF COURSE! IMDMP! COOL!! > > o Is a royalty-free Windows DLL module featuring advanced cryptography. > o Contains more than 150 procedures and functions. WOW!! 150!!! > o Is a very cost-effective size of only 60 kilobytes. > o Implements the IMDMP encryption algorithm. Of course, who doesn't?! > o Allows encryption keys as large as 2048 bits. > o Includes 18 sub-algorithms. 18?! HOLY COW!! > o Processes all forms of binary and ASCII files. What a breakthrough! Astounding!! > o Allows multiple encryption layer levels. > o Has absolutely no back-doors or magical keys. Of course not, it's IMDMP!! > o Includes time and date locking features. > o Includes file specific unique encryption features. Specific unique encryption features!! NO WAY!! COOL!!! > o Includes file authentication guard features. > o Includes digital signaturing capabilities. > o Implements the public key cryptosystem method of security. Of course, everyone knows the public key cryptosystem method is the best! Excellent! > o Includes data importance and sensitivity stamping features. > > UDCM, being a Windows DLL module, can be accessed through programs developed > with popular application and database programming languages and environments > such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo > Pascal, dBase, Paradox, Access, Sybase, Oracle, etc. > > DataET Research has released a shareware version of UDCM named UDCM V2.0. Hey, v2.0, neat name, where'd you come up with it?! > > To download UDCM V2.0 for free, please go to: > http://members.aol.com/dataetrsch/udcm.html. AOL!! Oh YES! Cool! > > I hope you will consider applying UDCM in the software you develop. Thank-you > very much for your time. Oh most certainly! I'm gonna run out and implement EVERYTHING in UDCM!! Thanks man!! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMuhyVUnqfwPpt/QVAQFM4wQAymizJEI/F5SFcWILNfGNoIsxxYza6Bfo yadEF9BnlcXujq0ZFZiRv7SddXjTS5TgVZLutZdEIx/NYPESkH7MXh18CyI/EXo6 NSyAiE0pFFRIrAgV4FWVVS9jsTWKucfI7NbWKSLEWTK8e6fdywAlXzlvbPT+1v6C b4vWK4akrBs= =74mf -----END PGP SIGNATURE-----

1 0

Re: Commerce Sec. Hearings and Encryption
by Toto 17 Dec '03

17 Dec '03

Bill Campbell wrote: > > toto(a)sk.sympatico.ca wrote: > > Bill Campbell wrote: > This "freely available overseas" concept is a bit overstated. > France and other countries are beginning to come down hard > on encryption. True. Perhaps I should have said "freely available, but it might cost you more than you expect." > Cynic or realist, you make the call. <G> The average Joe > doesn't even know *why* he needs encryption...at least > not yet. The average joe is quickly becoming aware of the issue of data security (and therefore being exposed to the 'concept' of encryption as something that will impact his life). Of course, this is coming about as a result of commercial pressures to make him feel safe about handing over his Visa number, etc. To me, this indicates that this is the opportune time to inject a deeper level of understanding into the issue of crypto, at a time when the average joe has his attention directed toward the crypto arena. Toto

1 0

Re: No Dimitri??
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

"Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> writes: > "William H. Geiger III" <whgiii(a)amaranth.com> writes: > > > I have noticed that there has not been any post from Dimitri in a couple of > > days. > > > > I am assuming that this means that the list moderation has now started? > > Yes - anything I say is junked irrespective of content. I see that Moderator Sandfort has allowed this article through (to prove me wrong) but has tossed all my other articles into cypherpunks-flames. Most of them were crypto-relevant, on-topic, and contained no flames. I bet he's going to toss this one too. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Rejection policy of the Cypherpunks maiing list
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

ichudov(a)algebra.com (Igor Chudov @ home) writes: > I would like to start a thread to discuss the moderation and rejection > policy. I predict that Sandy won't allow any posts on the censored list that question his moderation poilicy - only the unanymous praises. > My perfectly crypto-relevant article regarding possible attacks > on human relationships with the use of forged mail and anonymous > remailers, has been tossed out (sorted) into cypherpunks-flames > mailing list. A dishonorable act. > You can receive a copy of my article by an email request. Perhaps you want to start putting up rejected articles on a Web page? > The explanation that Sandy Sandfort gave me mentioned that he rejected > my message because it continued a thread where Sandy noticed instances > of "flaming". Note that my message was free of any flames, including > its quoted part. That's correct. > Sandy also states rather plainly that crypto-relevance is not the > criterion by which he moderates this list. I question this policy. Sandy's personal likes and dislikes of certain posters are the criterion. > I would like to hear your opinions as to whether such policies satisfy > the current readership. You won't be allowed to on this censored mailing list. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0