December 2003 - cypherpunks-legacy

(fwd) Articulation of PGP point of view?
by Carl_Ellison＠vos.stratus.com 17 Dec '03

17 Dec '03

>Date: Thu, 21 Oct 1993 10:54:43 -0500 >From: "Robert W. Shirey" <shirey(a)mitre.org> >Subject: Articulation of PGP point of view? >Is there anyone who has, or is able to, articulate >the PGP point of view for public key management and >compentently contrast it to the PEM point of view? >Is there, perhaps, someone who has written on this >subject or spoken publicly in an organized fashion? >I am seeking such a person for a presentation and >panel discussion at an international conference. >I need names ASAP! >Please feel free to forward this message to >appropriate newsgroups. >Regards, -Rob- >SHIREY(a)MITRE.ORG * tel 703.883.7210 * fax 703.883.1397 >Robert W. Shirey, The MITRE Corporation, Mail Stop Z202 >7525 Colshire Drive, McLean, Virginia 22102-3481 USA

1 0

Re:backing
by doug＠netcom.com 17 Dec '03

17 Dec '03

F_GRIFFITH(a)CCSVAX.SFASU.EDU said: >Greshams law: "bad money drives out good" >i.e. where people have a choice (e.g. gold vs greenbacks post Civil >War), in making payments, they will use the lesser value money and >keep the higher value. Thus, the lesser value money will circulate, >the higher value money will not. So in essence you're saying that poorly-backed digital currency will win out over e.g. U.S. dollars? That's an interesting concept. (I mean the above literally, not sarcastically; I don't care to take either one side or the other of this question right this instant, although I will say that there must be some extra caveats to add.) Doug

6 5

cyphrs
by QBOSWT＠grace.tstc.edu 17 Dec '03

17 Dec '03

Longing to be free. Send info encrypting gov't from privacy. Who r cypherpunks? Why a toad?

1 0

Eavedropping techniques revealed!
by Anonymous 17 Dec '03

17 Dec '03

Darn! They publicized a great spoof! excerpted: CA-93:15 CERT Advisory October 21, 1993 /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities The CERT Coordination Center has learned of several vulnerabilities affecting Sun Microsystems, Inc. (Sun) operating systems. Three separate vulnerabilities are described in this advisory. The first and third vulnerabilities affect all versions of SunOS 4.1.x and all versions of Solaris 2.x. The second affects all systems running any version of Solaris 2.x (but does not affect SunOS 4.1.x systems). Patches can be obtained from local Sun Answer Centers worldwide as well as through anonymous FTP from the ftp.uu.net (192.48.96.9) system in the /systems/sun/sun-dist directory. In Europe, these patches are available from ftp.eu.net in the /sun/fixes directory. Information concerning specific patches is outlined below. Please note that Sun sometimes updates patch files. If you find that the checksum is different, please contact Sun. [...] III. /dev/audio Vulnerability This vulnerability affects all Sun systems with microphones. This includes all versions of SunOS 4.1.x including 4.1.1, 4.1.2, 4.1.3, 4.1.3c, and all versions of Solaris 2.x including Solaris 2.1 (SunOS 5.1) and Solaris 2.2 (SunOS 5.2). Sun is addressing this problem in Solaris 2.3. A. Description /dev/audio is set to a default mode of 666. There is also no indication to the user of the system that the microphone is on. B. Impact Any user with access to the system can eavesdrop on conversations held in the vicinity of the microphone. C. Solution To prevent unauthorized listening with the microphone, the permissions of the audio data device (/dev/audio) should allow only the user logged in on the console of the machine to read /dev/audio. To prevent unauthorized changes in playback and record settings, the permissions on /dev/audioctl should be similarly changed. *** Any site seriously concerned about the security risks associated with the microphone should either switch off the microphone, or unplug the microphone to prevent unauthorized listening. *** 1. Restricting access on 4.x systems Use fbtab(5) to restrict the access to these devices. See the man page for more information about this procedure. 2. Restricting access on Solaris 2.x systems To restrict access to these devices to a specific users, the permissions on the device files must be manually changed. As root: # chmod 600 /dev/audio # chown <console user's username>.<desired group> /dev/audio # chmod 600 /dev/audioctl # chown <console user's username>.<desired group> /dev/audio

2 1

Re: backing
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Perry wrote: > > A digital currency can be backed by gold held in some secure location > > like the Zurich Free Transit Warehouse. U.S. Dollars are backed by > > absolutely nothing other than blind faith in the U.S. Governement. > > Who's kidding whom? Banks are contractually obligated to turn over mortgage notes in exchange for U.S. dollars. These contracts are valid over approximately 30 years, and provide unencumbered title to valuable property. These and similar contracts may be said to give value to dollars independent of government promises. Hal

2 1

Articulation of PGP point of view?
by Peter G. Trei 17 Dec '03

17 Dec '03

Robert W. Shirey writes: >Date: Thu, 21 Oct 1993 10:54:43 -0500 >From: "Robert W. Shirey" <shirey(a)mitre.org> >Is there anyone who has, or is able to, articulate the PGP point of >view for public key management and compentently contrast it to the PEM >point of view? >Is there, perhaps, someone who has written on this subject or spoken >publicly in an organized fashion? >I am seeking such a person for a presentation and panel discussion at >an international conference. >I need names ASAP! >Please feel free to forward this message to appropriate newsgroups. >Regards, -Rob- >SHIREY(a)MITRE.ORG * tel 703.883.7210 * fax 703.883.1397 >Robert W. Shirey, The MITRE Corporation, Mail Stop Z202 >7525 Colshire Drive, McLean, Virginia 22102-3481 USA I talked to Rob about this. What he's really looking for is not really so much a spokesman for the PGP vs "Big Brother" type of discussion, but rather someone who can discuss PGP key management issues from a technical standpoint. He'd really like to find someone who has dealt with managing a PGP key-server, thoroughly understands the "web of trust" model used in PGP (contrasting it to the certification authority hierarchy used in PEM) and is a good and articulate public speaker. Being partisan for PGP is fine, but you'd better be able to argue from a technical standpoint, not just an ideological one. Peter Trei ptrei(a)mitre.org

1 0

Re: re:700 Club etc.
by djw＠eff.org 17 Dec '03

17 Dec '03

At 4:21 PM 10/21/93 -0500, F_GRIFFITH(a)CCSVAX.SFASU.EDU wrote: >The right to encryption and the "right" to abortion don't have the same >basis - encryption kills no one. I'm not sure that the FBI would agree with the second half of your statement... ................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 1001 G St, NW Suite 950 East Washington, DC 20001 202-347-5400 (v) 202-393-5509 (f)

1 0

Re: Gold in them thar Bills...
by lefty＠apple.com 17 Dec '03

17 Dec '03

>> Have you ever heard of doing an assay? > >Yes, but that would be at the expense of the owner, and if it looks like >gold, feels heavy in the hand like gold, and if it has the word Canada and >the number .999 stamped on it, then people (bankers) might take it at face >value (or might not, depending on the stability of that country). The "expense" of doing an assay is minimal. As another poster has pointed out, assaying is essentially trivial, given the right materials. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Metaverse info (was: Introducing digital cash in a MOO)
by plaz＠netcom.com 17 Dec '03

17 Dec '03

>can you send me info on how to gain access to metaverse? I've had a couple of requests to this effect. I originally tried to keep it off the list, but have decided that by sending business thier way I was actually contributing to one of the few digital cash startups in existance. Illuminatus wizards feel free to correct any mistakes. you can access the metaverse via: 'telnet metaverse.io.com 7777' That is domain name: metaverse.io.com port: 7777. To login, type as instructed: 'connect guest' At this point you can browse around with one of the pre-made characters. To get your own character, you'll have to sign up for an account @io.com. You can do this by: 'telnet io.com' ...and following instructions. Have a credit card ready. The base fees are $10/month for telnet access only. Other structures are available. Once you have an account, send mail to mentor(a)io.com from your io.com account with character name and password. You can find me in the 'verse as PlasticBeethoven. I am currently setting up a branch office of the Extropians Institute (Freegate Virtual Branch). Feel free to drop by and offer encouragement/suggestions/criticisms. ('go to ExI' will get you there.) Forward, upward, outward, onward, and every which way but loose! _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "We are the shock troops of reality." - Voice of the Friends (Wild Palms)

1 0

Re: Eavedropping techniques revealed!
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

>/dev/audio is set to a default mode of 666 NeXT had the same problem; a few years ago users eavesdropped over the Internet. The next release of the NeXT OS plugged the hole by limiting access to whoever was logged into the console. Paul E. Baclace peb(a)procase.com

1 0