December 2003 - cypherpunks-legacy

Re: a desperate plea
by lefty＠apple.com 17 Dec '03

17 Dec '03

Ray faovrs us with > >J. Michael Diehl writes: >> According to rjc(a)gnu.ai.mit.edu: >> > I'm coming to kill your family tommorow with a rusty razor. >> >> This is a bit tasteless, don't you think. Come on, grow up. > > That was sort of an inside joke directed at Perry. (it's the motd >of the Extropian's mail server) However, if it sapped any of LD's bodily >fluids, I'm happy. I'd have to be, since I'm an evil, treasonous >Benedict Arnold of cypherpunks who should be hung by the neck or deported >off the net. No, in point of fact, you're a poorly adjusted infant who finds it amusing to stand at a safe distance and clog up the net with threats which he surely would never dare to make face-to-face. Ray, before you recommend psychological evaluation for others, it might be worth considering looking into some for yourself. You might also want to give Jacoby and Meyers a call and ask them for a quick rundown on the prevailing assault statutes. Please take your cowardly bravado to private email. You're about as impressive as a third-grader sticking out his tongue at the playground bully from behind the safety of his mother's skirt, a situation with which I can't help but feel you have some personal familiarity. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

3 3

DC-nets, up from the basic concept
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

A few pseudonymous questions went astray and landed in my mail box among a few others (without much of a return address too... the problems of anonymity) So I'll volunteer some possible answers, and while doing so will generate more questions :-). Others feel free to elaborate (especially thoses who HAVE read the papers) Still, no mention of detweil(er)ing will be made :-) although I will mention spoofing... 1) "PHYSICAL LAYER" =================== Q: How do you implement the idea that I can see my coin and the coin on the left, but no others? A: You use public key cryptography. You join a "table" by contacting one of the persons already at the "table". He hands you address and public key of (say) his right neighbor, and you hand him your address and your public key. Each time you "toss a coin" you encrypt it and send it to his ex right neighbor (now your right neighbor). You use the same public key protocols to send out to everybody your "different/same" vote, and collect and count everybody elses. It's easy to add and remove individuals, and you can be part of as many "tables" as you want. 2) MORE SPOOFING ================ New question: how do you make sure you are not spoofed to death, and (mis)led to join a "table" of, say, 126 personae of the same three letter entity, and Yourself. In which case, your messages are not very untraceable anymore? Not very satisfying answer: you meet in person your left AND right neighbor at least once to exchange address and keys... Any better answer? 3) GROUP RESPONSIBILITY AND HIGHER LAYERS ========================================= Q: couldn't every member of the group be implicated because they must all participate to produce the bit of information? A: No, when a "table" is established, what you have is a CSMA/CD network in the classical sense (CSMA/CD = Carrier Sense Multiple Access/ Collision Detection) just like Ethernet is one. Your "DC-net physical layer" is now very complicated, and multi-layered itself, but that only affects speed, not much else. You could (maaaybe :-( establish the layering: Coaxial - Ethernet - IP - TCP / Telnet - RFC822 email - PEM - DC-net - IP - TCP / Telnet - RFC822 email - PEM Except that now, your second layer of TCP/IP is untraceable. By the same token (sorry :-), once you have these protocols established for one "table", you can internetwork many "tables" at will. Poof! Inter-DC-net! But, boy, would the above implementations be slow :-) In any case, even though the participants of any network must cooperate for any message to go through (especially true in the case of Usenet, or FIDO, for example), it is hard to hold all the participants responsible for every message just for being part of the infrastructure. It would be different (even with todays networks), if a large proportion of the messages were CLEARLY illegal. Still, even now, it is impossible to tell whether an encrypted message's content is illegal or not (see the previous netnews discussion with respect to FIDO, mail privacy and encryption), and peeking in un-encrypted email is illegal, depending on caller contract. So I would, until contradicted by the legal types among us, consider a DC-net or Inter-DC-net no different legally, than any other cooperative network out there (Usenet, FIDO, internet...), until specifically regulated. Disclaimer: Of course, this is only a technical opinion, legal decisions may or may not consider the technical precedents :-) Reasonable technical arguments have as much weight legally as unreasonable ones (or so it seems at times) (meaning: of course, I'm not a lawuer) Pierre. pierre(a)shell.portal.com

2 1

ADMIN: toad.com's mail hicups Tuesday morning...
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

The list mailhost, toad.com, had massive problems today with sendmail queues, resulting in load averages over 90 (on a machine where 6 is high) and other unfun problems for me to chase. To my knowledge no mail was droped on the floor, but some mail did come out of the machine with headders missing. I have no idea what the mail software thought it was doing by droping headers, but I think we will live even so. I am looking at installing some newer software to deal with the problems of today, though the root causes are solved for now, better software (sendmail) is called for. On the other hand better software is ALLWAYS called for... Guess I had better get back to doing that sort of work... ||ugh Daniel Sysadmin of the month hugh(a)toad.com

1 0

shut up, assmunch
by nobody＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

don't make me slap you again, detwiler.

1 0

True Names and nyms
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some people have argued that there is no way to prevent the use of multiple pseudonyms on the net, that it is possible today and that the new crypto technologies will provide even easier techniques tomorrow. This is an oversimplification, as Tim pointed out. "Is-a-person" credentials can be used to determine whether someone is a "True Name" or not, which is really what Larry wanted to know. Here is one way they might work. (To make this clearer, it is best to think in terms of the equation, pseudonym == public key. A pseudonym is a public key. We think of pseudonyms as being names, like "wonderer" or "sam hill", or perhaps as email addresses, like "hacker(a)univ.edu". But from the point of view of cryptography, these are just frills. The important thing is the key. With a public key, a pseudonym can sign his messages, so that nobody else can successfully pretend to be him. He can read messages sent to him, messages which no one else can read. If he has to switch email addresses he can do so and still maintain his identity by continuing to use the same key. It is his key which is his real identity on the net. OK, back to the is-a-person credential:) An is-a-person credential could be structured identically to the digital coins used in Chaum's simple digital cash proposal. You would go to the credentialling agency and provide some unique form of identification, something that no one else could forge. Today this might be a thumbprint, or in the future it could perhaps be a DNA scan. However, you do not have to identify yourself by name. They don't need to know who you are; they only know that you are a living, breathing human being, one whom they have not seen before. (There could be more than one credentialling agency, but they would all share a database of thumbprints or whatever.) You choose a special public key which you will use for all of your True Name activities on the net. This public key will be used to sign messages which you want to prove are from a real person. Any message sent with that signature is known to be from a True Name and not from a nym. Only one True Name exists per person. Note that this True Name doesn't have to be your real name. If you want to always post under John Q. Public and use this special key for that purposes, you can do so. But you won't be able to post under any other name, including your own, as a True Name, not unless you use that same key. And of course if you do, people will be able to know that you are the same as John Q. Public since you are using the same signature key. The way this is established is that you take your True Name key, which we'll call TN, and do as was done for Chaum's cash: pass it through a one-way function f, and blind with a random number r^3: f(TN)*r^3. You give this to the credentiallying agency when you come in with your thumbprint, and they sign it by taking the cube root. This is f(TN)^(1/3) * r. Back home, you divide by r, getting f(TN)^(1/3). This is your True Name certificate. You can submit it to a public key registry along with TN; anyone can calculate f(TN) and verify the credentialling agency's signature. People will therefore know that this key is the only one belonging to some real person which is signed in this way. Only one such key can exist for each person. So, if people claim to be posting under True Names, they can prove it very easily, by using their True Name key, signed by a credentialling agency. People can still post under as many nyms as they want, but only one gets to call itself True. Note that this solution doesn't reveal very much about the person. Because the certificates are blinded by r^3 when they are signed, even the credentialling agency has no way of knowing which thumbprints are associated with which True Name. (So, actually, it wouldn't be a problem if the agency got your name and address when you came in - this still couldn't be linked with your postings if you didn't want it to be.) Nobody is forced to even use a True Name when they post; they could use nothing but nyms. On the other hand, if people want to reserve certain conferences for True Names only, they can. There is tremendous flexibility to have as much or as little use of nyms as people want. So, people should not be so quick to claim that crypto can only be used to increase anonymity. It is a powerful technology that can be used to increase our control over information in many ways. Chaum's papers continue to amaze me with what is possible. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLM3dJ6gTA69YIUw3AQFmfAP/byAqRUt/R3tQBH5Zg+JYV4u6z2CeJ0eM YOrsvXAptTFjS4TpS177spfoDfGm9gtoL1wyEhwD6gsZ2JhssRXT/7w8MEEzPE2U 9CIOXeBZiL8lSPWBxHBr95jlkJjIZe+v5BWPsWdwmSInk0/vbTaQm4emjNNS9WgG H1jPeYECsjA= =sd2V -----END PGP SIGNATURE-----

1 0

Shocked at my reaction
by msattler＠netcom.com 17 Dec '03

17 Dec '03

The following has nothing to do with writing code, but hopefully posting this will get me back on track.... I wrote this several weeks ago and have been sitting on it ever since. L. Detweiler's contributions of late have made me re-examine my feelings on a variety of email- and cyberspace-related issues. I very strongly believe that everyone has an inaliable right to express themselves, as long as that expression doesn't harm others or impede their ability to express *themselves*. Up to now the amount of trash-mail (as I determine it) has been less than ten percent of my mail, an amount I equate with the real-world equivalent of billboards and junk-mail. L. Detweiler's uncanny ability to craft flame-bait and get the CypherPunks to respond has increased the trash-mail percentage to the point where it's entered my awareness. Torn between respect for someone who has a reputation for having made contributions, worry about someone who seems to have a slim grasp on the reality I'm experiencing, and annoyance at getting scores of ranting incoherent messages, I've made a decision that I've never made before: to put someone (L. Detweiler) into my kill-file. This bothers me a great deal. But there it is. ---------------- To L. Detweiler: I'm sorry, but your style, content, and quantity values have gotten to the point where it seems unrewarding to deal with you. The decision to banish you bothers me a great deal, but not as much as reading your mail does. If you're sincere about the biblical amount of pain you are in, I gently suggest (in my capacity as an EMT with some crisis-intervention experience) that you talk about your pain to a qualified person, perhaps an MFCC. If you're doing all this to get a reaction (for maybe a book) like Don Novello's Lazlo character of the last three decades (and several books), then congratulations. ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 621-2903 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) All that is required for evil to triumph is for {wo}men of good will to do nothing.

1 0

help writing code
by Pat Farrell 17 Dec '03

17 Dec '03

I've spent the summer working on a SMTP/POP client that runs under MS-Windows. There are two ideas behind it. First, widespread acceptance of global communication will require that mass market user don't have to learn vi/emacs/... and Second, once the email composing and reading is done on a local, controlled PC, we can trivially pipe messages in and out of PGP, RIPEM, or your favorite encryption algorithm. This second part will allow folks to send all their mail encrypted, which will not only spread the word, but hurt traffic analysis. But, I need help. I've got all the front-end stuff working, and can handle the SMTP/POP protocols. But I can't get Windows to talk reliably with a raw async link. (I don't want to require SLIP or PPP, as lots of sites are too clueless to offer it.) I need a robust communications library. It has to do as well as possible given an inherantly inreliable link. I've bought three commercial sibraries, and none work. Cypherpunks write code. I've been trying. If someone wants to help, please reply, and we can work out detailed specs of the API I have in mind. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

No Subject
by Ian Turton 17 Dec '03

17 Dec '03

Authur Chandler writes: > > Isn't it tough enough to build up a rep under our real names? What is > the point to using a pseudonym? I can think of some bad reasons; but I > can't come up with any good ones, except for "fun" and "just to see what > it feels like to put out opinions not my own." I'm sure I'm missing the > point; so, before you jump on me as a Clueless Newbie, can you run by > the reasons why you want to have alternate personas on the NET? Well the one case that comes to mind for me is a friend I knew at a previous university where I worked. There was a member of the support staff who was responsible for introducing the net/email to new users (amongst other things). He had two personas one for dealing with official things and the other obvoiusly an alias (FoFP) for ranting about the government etc. However new users still regualarly reported this alias to Mike (in his official role) for bringing the university in to disrepute. I'm fairly sure he owned up to them at this point :-). However I'd contend that it was important for him to distinguish official posts from unofficial posts more strongly than just by sticking a disclaimer on the end of unoficial messages - since who really reads them anyway. > Ian Turton - School of Geography, Leeds University 0532 -333309

1 0

RSA encryption
by Christopher Kotze 17 Dec '03

17 Dec '03

Does anyone know anything about RSA encryption, if so, please tell me about it ! cheers, chris

1 0

blacknet international offers DOSSIERS for SALE
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

blacknet international is pleased to offer the following materials for sale: DOSSIERS: on the current participants in the Cypherpunks Mailing List Flame war PRICES: Prices and delivery terms upon request via encrypted anonymous return address. SUBJECTS: Perry Metzger <pmetzger(a)lehman.com> Duncan Frissell <frissell(a)panix.com> S. Boxx <an12070(a)anon.penet.fi> L. Detweiler<ld231782(a)longs.lance.colostate.edu> Timothy C. May <tcmay(a)netcom.com> Ray Cromwell <rjc(a)gnu.ai.mit.edu> David Sternlight <strnlght(a)netcom.com> These are available now via PGP encrypted return anonymous mail. To reply to I/We please use the enclosed public key to encrypt your message back to us. The anonymous remailer encrypted return block may be used for now but if current(known to be good) paths are needed look for the latest in cypherpunks(a)toad.com. Please encrypt ALL mail sent to us... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAizMFlcAAAEEALPYHDpT3OhTyO0qfEcqnbwY30pZb3ET6JUP70jfIQPiTrkA i7WJFYnDWv0FBk3aMxfH2DpI0fauCQKLnJJrc0/WHi5AgZVJh7KTwfCyAS+Zr2xM 7xjFZlwd9Q0Ow5k3hLfO4LQpTOW8IBMATV8or1g/+Zv3m87WjLgMmjAEwDypAAUR tDxibGluZHBpcGUgPHVzZSBjdXJyZW50IHJlbWFpbGVyIGJsb2NrIHBvc3RlZCB0 byBjeXBoZXJwdW5rcz4= =IHVG -----END PGP PUBLIC KEY BLOCK----- --------8<--cut here-->8-------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.3a hEwClqx1g6tk6KcBAf9Nly0MsbjTHys9iZwvkew2KEls/4T+4uXG+Ri8gtJnA9P0 5NvGZYIU0A40CHeHWttwE+cjwVyREWWcCPUVeMqcpgAAAYWHYP4OYPHDdUFKrs1i FW2F5lMQ1m4pU475xcLJH+NqQUYToSqmTlyH5dlOLmkC0s97n2OMQKJyDkUHkIbZ nqEg42KQkjAWotu85dBuXFjgLyShkACvah/VBXYcKHMsgfO41tCbCQiWVkg022/F TheZmlX5mPj0pgLFlpd+nYYIsGcH2memKLXWuhaY4yThRPYCu5OEYBlQEE1TtQTs glC6926Nu1RHvs4ivD3OabzeLdl2Kh2wZI2IcznUKOIKhH3nsXgI9ZvuHVkrKkmw 5ABXnhj2rgWW6/SxOT6XejUKH6WHu82HBjnEi6dDviB5pnGL8D2ayxw+ySwjNZ94 lJyrGVeq40XVG4HywxUbmrSbM/a6OOvH2f5zmXQAccoj2iwWa0khPJ0kjlndV/I9 FSLeIP8BZZSHU1tA9/genoDd3auQDAregfuzA10KjVr96+TcLdlh/7eM9TfQDaPz VtCrLR+X/n2J083WtmyzbZhpeI2qzjL7YqPXNlRsofenVucl3E1k0A== =WPI/ -----END PGP MESSAGE----- <To reply, save everything below the "cut here" marks above <into another file. Type your reply here (below the blank <line three lines above!) and mail to remailer(a)utter.dis.org ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 3