December 2003 - cypherpunks-legacy

Re: Dr. Vulis' social engineering experiment
by Mike McNally 17 Dec '03

17 Dec '03

Jane Jefferson wrote: > > That appears to be the main brunt of his efforts, to "push the > envelope" of free speech in order to force it's definition. Well, the irritating part is that I think he's pushing the wrong envelope. Why anyone would expect any particular degree of "freedom" to use a service run for free by a private individual is beyond me. I appreciate the service, but I don't take it for granted and I certainly don't take it as an inalienable right. ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Mike McNally -- Egregiously Pointy -- Tivoli Systems, "IBM" -- Austin mailto:m5@tivoli.com mailto:m101@io.com http://www.io.com/~m101 ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^

1 0

Re: Disseminating public-key crypto source code
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:11 PM 1/20/97 -0500, Jon Orwant wrote: > 2) PKPesque: Using public-key crypto is an infringement, > although disseminating/possessing the source > code is not. Disseminating (and even writing) the source code may be an infringement. 35 USC 271 says: "Infringement of patent (a) Except as otherwise provided in this title, whoever without authority makes, uses, or sells any patented invention, within the United States during the term of the patent therefor, infringes the patent. (b) Whoever actively induces infringement of a patent shall be liable as an infringer. (c) Whoever sells a component of a patented machine, manufacture, combination or composition, or a material or apparatus for use in practicing a patented process, constituting a material part of the invention, knowing the same to be especially made or especially adapted for use in an infringement of such patent, and not a staple article or commodity of commerce suitable for substantial noninfringing use, shall be liable as a contributory infringer. [...]" Sorry. Software/algorithm patents make it difficult to develop and distribute free software. If that pisses you off, tell your congresspeople you don't like software/algorithm patents. Perhaps someday Congress will develop a sensible scheme for "protecting" creators' rights in their software. But they haven't yet. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: "Technical data" exemptions in new crypto regs
by Richard L. Field 17 Dec '03

17 Dec '03

In reply to Solveig Bernstein's First Amendment challenge questions: I read the new regs as permitting: (i) publication of source code in paper form (including publications reproduced on microfilm or on prerecorded phonograph records), or in the form of a motion picture film and soundtrack (section 734.3(b)(2)); and, separately, (ii) teaching or discussion of information "about" cryptography (section 744.9). The export of other encryption materials (including the distribution to non-US persons of source or object code on diskettes) is restricted, even if the materials are publicly available "educational information" for release by instruction in catalog courses and associated teaching laboratories of academic institutions (section 734.9). Technical assistance activities that go beyond "mere" teaching or discussion of information about cryptography are restricted, if they show "intent" to aid a foreign person in the development or manufacture, outside the United States, of controlled encryption commodities and software. This is a General Prohibition (see section 736.2(b)(7)(ii)). I think one question to be resolved is: could the "mere" teaching about cryptography (which is okay), *coupled* with distribution of source code in paper form (which is otherwise okay because it is not, by itself, subject to the EAR - see note to section 734.3(b)(2) and (b)(3)), be considered a violation of the EAR because it demonstrates "intent" to aid a foreign person in the development of encryption software? One would hope not (see Bernstein), but the new 734.9 seems to imply that such a combination may be restricted. Thus, a potental First Amendment challenge to the new regs would be a challenge to a restriction on teaching coupled with paper publication/distribution of source code. Another would be a challenge to the restriction on non-paper publication/distribution, whether or not coupled with teaching. - Richard Field (For discussion purposes only. Not legal advice or a legal opinion.) On Mon, 20 Jan 1997 14:45:44 -0500 (EST) you wrote (to Declan McCullagh): > >What have the new crypto regs done to the "technical data" and the "public >domain" exemptions from ITAR? > >The problem is this: as I understand it, the Commerce Dept. regs exempt >teaching and print presentations generally, but these exemptions do not >apply to "encryption software." > >Does this mean that the exemptions do not apply to *teaching about* >encryption software or *publications about* encryption software? Or *only* >that the exemptions do not apply to diskette-contained source code or object >code. > >In other words, the new regs might completely decontrol teaching and >publication of something like Professor Bernstein's Snuffle. > >On the other hand, the new regs might, like ITAR, restrict teaching and >publication of Snuffle (as well as publication of source code in diskette >format). > >The purpose of the question is to understand whether a First Amendment >challenge to the new regs is a First Amendment challenge to a restriction on >*teaching, publication, and program distribution* or just a challenge to a >restriction on *program distribution.* > > >Solveig Bernstein, Esq. >(202) 789-5274 >(202) 842-3490 (fax) > >Assistant Director of Telecommunications & Technology Studies >Cato Institute >1000 Mass. Ave. NW >Washington, DC 20001

1 0

Re: Disseminating public-key crypto source code
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Mon, 20 Jan 1997, Jon Orwant wrote: > I've written a few Perl routines for public-key cryptography. I'd > like to freely disseminate the source code (starting with ElGamal) to > as many people as I can, > > It's my understanding that there are two orthogonal restrictions: > > 1) ITAResque: I can't give code to non-U.S. citizens. > 2) PKPesque: Using public-key crypto is an infringement, > although disseminating/possessing the source > code is not. > > While I'm sure these are oversimplifications, it would seem that I can > release my source code over the Internet provided I install a simple > verification mechanism (cf. MIT's PGP distribution) to ensure that > only people claiming to be U.S. citizens have access privileges. > > Am I correct? If so, why aren't more people doing this? Point 2 is the easier one -- you can research, create, and distribute patented algorithms for free. It is just in using or selling them that you need to get a license from the patent holder (directly or indirectly). Point 1 is a bit muddier, but the new EAR (which replace the ITAR) actually defines what you need to do to freely distribute cryptographic software in North America, essentially describing something like MIT's PGP distribution system and my system at http://www.sni.net/~mpj/usa/warning.htm (at least as far as is practical): ____ (ii) The export of encryption source code and object code software controlled for EI reasons under ECCN 5D002 on the Commerce Control List (see Supplement No. 1 to part 774 of the EAR) includes downloading, or causing the downloading of, such software to locations (including electronic bulletin boards, Internet file transfer protocol, and World Wide Web sites) outside the U.S., or making such software available for transfer outside the United States, over wire, cable, radio, electromagnetic, photooptical, photoelectric or other comparable communications facilities accessible to persons outside the United States, including transfers from electronic bulletin boards, Internet file transfer protocol and World Wide Web sites, unless the person making the software available takes precautions adequate to prevent unauthorized transfer of such code outside the United States. Such precautions shall include: (A) Ensuring that the facility from which the software is available controls the access to and transfers of such software through such measures as: (1) The access control system, either through automated means or human intervention, checks the address of every system requesting or receiving a transfer and verifies that such systems are located within the United States; (2) The access control system, provides every requesting or receiving party with notice that the transfer includes or would include cryptographic software subject to export controls under the Export Administration Act, and that anyone receiving such a transfer cannot export the software without a license; and (3) Every party requesting or receiving a transfer of such software must acknowledge affirmatively that he or she understands that the cryptographic software is subject to export controls under the Export Administration Act and that anyone receiving the transfer cannot export the software without a license; or (B) Taking other precautions, approved in writing by the Bureau of Export Administration, to prevent transfer of such software outside the U.S. without a license. ____ Point (1) above is done at my site, to something of an approximation, by using a .htaccess file. I'm working on improving this, some, due to some server problems, but I think that it is close enough to meet the "such measures as" criteria, especially since (2) and (3) are met pretty literally by the mechanism that routinely breaks links that attempt to bypass the warning page. Of course, this isn't perfect, and no coderpunk worth his salt would have difficulty bypassing the system if he or she were inclined to break the law, but it does allow me to post strong cryptographic software without worrying about breaking the law. Why don't more people do this? Probably because the law has usually been even more muddy than the above, and at least as irrational, and because it is more of a pain than just posting the stuff, which few people want to flaunt their disregard for the law so publicly. There is another, better way, to comply with the above using CGI scripting, but my ISP is reluctant to let me do so, so far. By the way, there is no automated way to add files to my crypto site, but if you are interested in posting quality crypto software, libraries, and documentation (like maybe some DES challenge code or RC5 cracker code), please email me at mpj(a)csn.net. Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

1 0

Re: Dr. Vulis' social engineering "experiment"
by Toto 17 Dec '03

17 Dec '03

Bill Campbell wrote: > While many of you think that the ability of a list to withstand > constant spamming is an important issue; the government is busily > working to outlaw encryption and privacy, and I fear that much > is lost by the side issue of the "how easily can I kill a list". The "About Cypherpunks" intro to the list states, "Cypherpunks know how to attack a system and how to defend it." "Cypherpunks love to practice." If I choose to join the "Venemous Snakes" list, I'm not going to complain about getting bit every now and again. > I feel we at a *critical* crossroads in this debate, and one of the > more important voices has *very* effectively been silenced. Dr. Vulis? There was an 'attempt' to silence him, but it hasn't worked, to date. > I cannot understand why you think that > the attempt to disrupt and destroy this list a necessary step > in the task of resisting this governmental effort. I haven't seen any evidence of an attempt to destroy this list. I've seen many attempts to manipulate the list's direction, but that is another matter. > Again, I can't understand why "killing the messenger" is advancing > the issues of privacy and crypto issues. There was a crypto-messenger named DataETRetch that 'advanced' their version of crypto on this list, and they left their heads on the chopping block on their way out. If your team can't even make it through the scrimmages, then they don't belong in the game. And if you find yourself suggesting, "Why don't we just play 'touch', instead of 'tackle'.", then you're probably getting too old and tired to play in the major leagues. > How does the posting of numerous crude anti-Tim May messages promote > personal privacy? It doesn't. 'Stopping' the annoyance of these messages promotes personal privacy. > > > "In peacetime, a warlike man sets upon himself." -- Nietzsche > > "In times of war, a peacelike man sets upon others." > > Bubba Rom Dos > > This seems horribly to describe the current situation. No shit, Sherlock. Toto

1 0

Re: Dr. Vulis' social engineering "experiment"
by Dale Thorn 17 Dec '03

17 Dec '03

Bill Campbell wrote: > Toto <toto(a)sk.sympatico.ca wrote: Good points all, Bill. Now, just turn the pointed finger around slightly so that (for some of the issues at least) it points towards the providers/managers/moderators, etc. Wouldn't it be a gas if this were part of the Grand Plan, waiting only for the provocation? They can argue that one person's posts have worse content than others (or argue the Spam motive), but really, what's it all about besides control? All of you long-time guys survived the war without the moderator's help, am I right? > As a long time lurker (much longer than many of the numerous > relatively recent vociferous posters) I *must* speak up. > If the dear "Doctor's" posting are indeed a "grand" experiment > in newsgroup (or maillist) sociology, then it seems they are akin to > experiments in recent history; if the patient dies, so what? There are > other lists... > While many of you think that the ability of a list to withstand > constant spamming is an important issue; the government is busily > working to outlaw encryption and privacy, and I fear that much > is lost by the side issue of the "how easily can I kill a list". > I feel we at a *critical* crossroads in this debate, and one of the > more important voices has *very* effectively been silenced.[snip] > This is very true, but I cannot understand why you think that > the attempt to disrupt and destroy this list a necessary step > in the task of resisting this governmental effort.[mo' snip] > Again, I can't understand why "killing the messenger" is advancing > the issues of privacy and crypto issues. How does the posting of > numerous crude anti-Tim May messages promote personal privacy?

1 0

Re: GSM technology
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Nurdane Oksas <oksas(a)asimov.montclair.edu> writes: > > > ADSL will be the best for movies... i can't wait . What kind of movies? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Dr. Vulis' social engineering experiment
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Jane Jefferson <gotagun(a)liii.com> writes: > The heart and soul of the problem is that "sin", "freedom", "good", > and "evil" are abstract concepts which fluctuate from individual to > individual. If Dr. Vulis is indeed an adjunct professor at Fordham > University, I think that perhaps he has been hanging out and drinking > too many beers with my former philosophy professor Quentin Lauer. ;-7 I haven't been teaching at Fordham for a few years. (It's too far and the pay's too low. :-) --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Numbers we cannot talk about
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > I know that Standard mathematical axioms yields lots of interesting > > results, but when it talks of the infinite and we are dealing > > with a practical subject like cryptography or even physics it > > should not be taken too seriously. (With respect to uncountable sets.) > > Some of the applications of these theories are very relevant. For > example, a theorem that proves that it is impossible to write a program > that would determine if any other program would stop or loop forever, is > very relevant and interesting. Absolutely, something does not have to be practical to be interesting, Igor`s example of Cantors double slash argument (useful for example in AI research) is something that seems very abstract until we find a use for it, and most abstract mathematical concepts and theorems of this kind do eventually come into use by some other class of scientists. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> wrote in article <5bp18k$1cc(a)life.ai.mit.edu>... > GSM encrypts only the links to the station - the traffic goes in the > clear through the station. Plus A5 (crypto algorithm used in GSM) is > weak, 40 bits of effective key space. > > It could be worse to have poor crypto, than no crypto, I disagree for two reasons, first there is a big difference between having poor locks and no locks. Most locks can be picked by an expert, they are effective against many theifs however. Second if everyone in the world was using 40 bit email encryption it would prevent most of the "promiscuous" interception of communications. The danger in weak crypto is thinking that it is strong crypto. GSM is weak crypto but stops the type of snooping the Martins engaged in. If you know not to talk about something secret on one then low crypto is better than having a signal anyone can pick up on a device from radio shack. Phill

2 1