December 2003 - cypherpunks-legacy

The L. D. persona...
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

The other day, I noticed that MacPGP seemed to give credit to a person with the initials L. D. He certainly seems unpopular...was he at one time a more positive force? Or is this a dumb question on my part? Regards, Dave

2 1

Re: Detweiler abuse again
by lefty＠apple.com 17 Dec '03

17 Dec '03

Jon 'iain' Boone asks: > > What ever happened to "I hate what you say, but I will fight to the death > for your right to say it?" Sigh. Subscribing to this sentiment does not, in any way, shape or form, require one to start handing out podia and bullhorns to anyone who has an opinion to express. Put it this way: I own a Macintosh, a copy of PageMaker and a laser printer. Should I let anyone who wants to use _my_ equipment to produce a newsletter? In particular, should I allow a person whose views I consider to be heinous and reprehensible to use _my_ equipment to produce a newsletter espousing those views? To me, the obvious answer is "Of course not". Does this mean that I'm censoring that person? Does it make me an opponent of "free speech"? No, and no. I will certainly defend his right to produce a newsletter. I will certainly defend his right to buy, and use, _his_ _own_ equipment to produce a newsletter espousing whatever opinions he likes. People, _please_ learn what "censorship" is! If I submit a manuscript to Addison Wesley, and they return it to me with a rejection note, _that_ _does_ _not_ _constitute_ _censorship_. I am perfectly free to submit it to other publishers, or to publish it myself. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

Re: Detweiler blocking
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Perry E. Metzger wrote: > No one has proposed censoring his Usenet postings. What > people have proposed is that they deny him the use of the > remailers that they set up on their hardware. This is very > different. Its the difference between saying > "Detweiler can't live" and "Detweiler can't live IN MY > LIVING ROOM". Its the difference between saying "I > advocate the right of people to discuss any topic they > want" and saying "I adovacate the right of people to > discuss any topic they want IN MY BEDROOM AT FOUR AM WHILE > I'M TRYING TO SLEEP." > I've seen this analogy before and I think it is a poor analogy and should not be used. I don't mean for this to be a flame, just a comment. The problem with this analogy is that you are comparing a publicly available service that is being abused with a private residence that is being abused. It is the difference between "Everybody can use this remailer except Detweiler" and "Nobody is allowed to shout in my bedroom at 4 AM, and that includes Detweiler". Do you see the difference. The analogy is comparing a service with a non-service. Since remailers are services, the analogies used to discuss them should compare remailers with other services. For example: "Detweiler is a disruptive client and I am within my rights to prevent him from using my service." Right now, remailer services are free, and that generates the impression in some that they are public resources that *must* be available to all. If remailers charged even a small amount for their service, it might make it easier to justify denying service to specific individuals. It's not logical, but people are seldom persuaded by logic alone. > I see nothing wrong with remailer operators taking steps > to prevent Detweiler from using their equipment against > their will. This is not censorship. Mr. Detweiler is > still free to use Usenet any way he sees fit. It is simp y > the act of saying "Mr. Detweiler can't use MY REMAILER any > way he sees fit." > > Perry > >From this I can see that you agree that remailer operators should be able to refuse specific users, when possible. My point with this post is to recommend abandoning the "bedroom" analogy. Jim_Miller(a)suite.com

1 0

Tentacle Contest -- Great!
by Joshua Danowitz 17 Dec '03

17 Dec '03

That contest by SQUISH is great! I think I was laughing halfway through the first paragraph through to the end! Can I become a tentacle? 8) I hope no one takes you TOO seriously -- _____ ____......------'-----`------......_____ -=======================================================- `-----....._________.....-----' ____ \ | / ____ (____) __/_|_\__ (____) \\_________.-'_.-----._`-._________// `---------`.. `-----' ..'---------' `~~~~~~~' /------------------------------------------------------------------\ | If God had wanted us to explore space, he would have given us | | a moon. -- The Discovery Channel | |------------------------------------------------------------------| | The world is moving so fast that the man who says 'it can't be | | is usually interrupted by the man doing it. | |------------------------------------------------------------------| | Joshua Danowitz, Csci Major, Hunter College, City Univ. of NY | | Internet Address -- JODHC(a)CUNYVM.CUNY.EDU | | Bitnet Address -- JODHC(a)CUNYVM.BITNET | | Snail-Mail Address -- 12 E. 86 St./Apt. 605, New York, NY 10028 | \------------------------------------------------------------------/

1 0

Goodbye, Xenon
by Peter Nestor 17 Dec '03

17 Dec '03

Goodbye Xenon! Some parting thoughts: (1) Stealth PGP -- while the idea is laudable, the "thousand year technology" won't last as long as the "thousand year reich" in the proposed implementation. Steganographically hiding messages in "noisy" channels like JPEG files is easily thwarted by the powers that be. They merely need identify those channels, intercept them, and retransmit the noisy data with their own random noise added, effectively jamming the channel. (2) Anonymous Remailers -- This world is made up of many different types of people, including tight-assed control freaks. If they want to carve out a little nook of cyberspace and control it, why shouldn't theybe able to? Why shouldn't they have their privacy there too, and be allowed to dictate who can and cannot come in? Its all very well to tell them they need locks; but unless and until it is easier for them to install those locks than to raise hell, they will solve the problem of inappropriate posting by raising hell.

1 0

ATM ftp?
by Ophir Ronen 17 Dec '03

17 Dec '03

<faint shimmering gradually solidifying into...> Me. Well friends and neighbors, due to the high demand for the ATM tutorial, who has an anonymous ftp site that I can put the text file into? Enclosed is my public key for anyone that needs it. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi1iOIYAAAEEAOXOAx5F0UOp24wwEZTKBfGDSRPO+DbVsKGr8B/8Kic4zsQE nJiAS95NHIEvFSBhndztgZVYWPCqrh6rlMlzjIC/LM28JLvAouswlPhZLOM7uR5C SUQRVzeOckpu5OMwC5SRwpaBOYkJ/m2Tb0huASiZBk7X1nrmZI/5gSeVVP8FAAUR tCRPcGhpciBSb25lbiA8YS1vcGhpcnJAbWljcm9zb2Z0LmNvbT4= =ymZt -----END PGP PUBLIC KEY BLOCK----- <solid form dissolving into shimmering flecks of light> -Ophir o) Ophir Ronen <a-ophirr(a)microsoft.com> KeyID 1024/54FF05 1994/02/16 Key fingerprint = EA BF 5C 85 F6 C3 A7 8E AA 48 2A AC B9 BC 4B D2 "So long and thanks for all the phish"

2 1

Dos Stego
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bruce C Dovala asks: Does anyone know of a Stego program for Dos? Well, the only Stego program I've seen other than Mistress Romana's for the Mac is by Black Wolf, here's the readme file; Black Wolf's Picture Encoder (for 320x200x256 ONLY!!!!) Version 0.90a Released into the Public Domain All Code Written By Black Wolf Disclaimer: This program is hereby released into the public domain. I take no responsibilities for any damages it might cause. Use it at your own risk. Description: This picture encoder consists of a group of programs designed to let you capture a picture, encode a message in it, and display it so that it may be captured again into another format with a third-party program, then recapture it and decode the message previously place inside it. It is at a bare-bones stage right now, and includes source code if you would like to tailor it to your own needs. Uses: If you have a need to send sensitive data, but don't want it to be obvious that that is what you are doing, this might be a good program for you. The sender can encode anything he/she wants into the picture and then convert it to .GIF format, .PCX format, or whatever (using a third part program). Not many people will look twice if you receive a picture, whereas an encrypted message might raise an eyebrow or two. Then, the receiver is free to decode it at will. Anything under about 8k can be recorded into one picture - - important letters, lists, small programs (viruses), or just about anything else. If you are sending text, my recommendation is to encrypt with via PGP or some similar program, then encode it ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Ya gotta love this guy! into the picture for added security. Tech: The programs encodes data into the LSB's (least significant bits) of the picture file - thus, roughly 50% of the colors are changed, but if they are it is only by one pallette value (0-255). If the picture's pallette is based on gradients, then this will most likely be undetectable. Also - ENCODE will put an EOF at the end of the message, so that while there will be garbage at the end of the decoded message it will not be displayed if the file is opened with edit or typed, etc.... The files are as follows: GETSCR - Captures a picture into MESSAGE.SCR when you press PRINTSCREEN while in graphics mode 13h (320x200x256). PUTSCR - Puts the picture in MESSAGE.SCR onto the screen, generally so that it may be re-captured into another program. ENCODE - Encodes the data in the file MESSAGE.DAT into the picture in MESSAGE.SCR. DECODE - Decode the message in the picture MESSAGE.SCR and puts it into NEWMESS.DAT. Example: Say you want to send text to someone, but you don't want it to "appear" that way to anyone who may intercept the message. First, what you'd want to do is find a picture file (like a GIF). Then, run GETSCR and pop the picture up into any picture viewer. While the picture is on the screen, hit PRINTSCREEN and GETSCR will create a file called MESSAGE.SCR for you containing that picture. Then, write your message and save it as MESSAGE.DAT. Run ENCODE - this will take your message and encode it into the picture file. At this point, you need to find a third-party screen capture program that wil work with the format that you wish to use. Run it to make it go memory resident, then run PUTSCR and capture the picture it puts onto the screen. Now you can send the picture to your friend. When he receives it, he can display it, showing that it is, indeed, just a picture file. When he wants to decode it, all he has to do is run GETSCR and display the file - hitting PRINTSCREEN while it is displayed. Then, he should run DECODE and it will create a file called NEWMESS.DAT that includes the message you originally put into the file. I can send this to anyone interested UUencoded, It's about 30k. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWPgvdCcBnAsu2t1AQE5zAP9FV1EaJoCJA71LRA5WAmImQG7CrjTo9iW XgqkdfL4sgNQwk0X+jWTel3P8FGSPgQ9CIjRAH8+LVAeFjnQ1X+7ZN6dijcGm09v si6zQQzVWqlM2zcQmep4Gl+wUMNvMUoOShaaYvfbiKBksxTgTHYcVRyjBuCND9fE R02BDtjeDv0= =F/RU -----END PGP SIGNATURE-----

1 0

SENDMAIL: a tutorial on how to add + to your addressing
by hughes＠ah.com 17 Dec '03

17 Dec '03

Here's a little tutorial I just wrote on how to get + syntax in your email addresses. It's a more reliable way of inserting aliases into a remailer than using the comment capability of the address format. This way mail to, say, hh+joebob(a)soda.berkeley.edu could get delivered to whoever was behind the joebob name, by whatever arrangements have been made. The document is written in such a way that you can send this to your sysadmin intact and ask them to install it for you. Eric ----------------------------------------------------------------------------- How to add + to your email syntax --------------------------------- Ever wanted one of those cool <user+@domain> addresses? So you can use <user+loud_mailing_list@domain> and get a filter to easily move the list out from your regular mail? Now you can. This tutorial works if you're running a fairly standard version of sendmail. It requires some hacking to sendmail.cf, so you need the permission to do that; that's usually root. The modifications are fairly straightforward. I. Add + to the list of operator symbols. The sendmail 'o' macro determines how to break up strings in sendmail.cf rules into tokens. In order to be able to recognize + specially, you'll have to add to the operator symbols to make it separately recognizable. So, first do a % grep -n ^Do sendmail.cf 116:Do.:%@!^=/[] Now, go in and edit line 116 and add a + sign at the end: Do.:%@!^=/[]+ That's all. Now sendmail will not include + inside of its tokens. II. Duplicate local delivery rules to accept + syntax. Sendmail is a delivery multiplexer. You want to change the syntax for local deilvery, so all you need to change is the local mail specifications. First, make sure your local mailer is called 'local'. You can search for the mailer definition as follows: % grep ^Mlocal sendmail.cf Mlocal, P=/usr/libexec/mail.local, F=lsDFMmn, [...] I've elided the tail end of the line, because all you really need to ascertain is that the local mailer has the right name. Now you want to search for all the delivery rules that deliver mail to the local mailer: % grep -n '#local' sendmail.cf 563:R$-<@$w> $#local$:$1 585:R$-<@$D> $#local$:$1 user(a)ah.com 614:R$+ $#local$:$1 everything else I have three rules for local delivery. (The second one is custom, and allows for delivery to a domain address for which no IP address exists.) All you do now is to add a rule for '+' delivery for each kind of existing local delivery. After I changed mine, it said: % grep -n '#local' sendmail.cf 563:R$-<@$w> $#local$:$1 564:R$-+$*<@$w> $#local$:$1 586:R$-<@$D> $#local$:$1 user(a)ah.com 587:R$-+$*<@$D> $#local$:$1 user(a)ah.com 616:R$-+$* $#local$:$1 everything else 617:R$+ $#local$:$1 everything else Rules that matched "$-", a single token, I changed to match "$-+$*", a single token followed by "+" followed by zero or more tokens. Rules that matched "$+", one or more tokens, I changed to match "$-+$*", same as above. I added the changed rule _before_ the original rule because otherwise the $+ would swallow up everything. The $1 in the second column refers to the first macro to match in the pattern in column one. That's the username the mail gets to delivered to. If you have more complicated usernames, you're likely already a seasoned sendmail trooper. III. Install and Test You should probably increment the version number when you make the change. It's in the 'Z' macro, do % grep -n ^DZ sendmail.cf 104:DZ2.06 Freeze the sendmail configuration with sendmail -bz otherwise your changes won't take effect. Now send yourself some test mail and make sure it works. Eric Hughes hughes(a)ah.com 17 February 1994

1 0

Source Level
by Greg - Kucharo 17 Dec '03

17 Dec '03

Eric, In your idea to give usenet users a chance to have competing moderated groups with unmoderated ones.Don't you think that the large numbers who want a moderated group will kill all demand for the unmoderated ones?Then we would be left with only moderated groups,who grated would have more signal to noise but less lively debate.People post so much to groups because they know they can in a free manner,moderation would slow the onslaught of banal posts and plenty of posts from folks who think thier ideas too wild for the moderator.Remember the root of moderator is moderate.As in,"This food is moderately good." Greg. kryten(a)shell.portal.com "This space available"

2 1

STEALTH OCEANS
by Gary Jeffers 17 Dec '03

17 Dec '03

note: This letter is composed of 2 different ideas: FIRST GREAT IDEA & SECOND GREAT IDEA. Firstly, congratulations to the cypherpunks that are realizing that strong civilian crypt needs "stealth". For some time I have thought that a crypt file with a crypt header on it was like saying "yes, I am in contempt for refusing to give a password" or "yes, I do require surveillance". A crypt file should look like random bits. The only problem is that files of random bits are not usual & might look a little suspicious. The cypherpunk needs to be able to deny having crypt files even if he is found with random bite files. So how do we do that? Then an idea came into my head! Why not make random bit files rather popular? Then, we would be like stealth fish swimming in stealth oceans. So, how do we make these files popular? Some may find the following ideas foolish. Others may find them unethical. Still others may find them both foolish & unethical. 1. Write a "wipe" program & put it in the public domain. The wipe program uses md-5 to generate random numbers over the user file & then delete the file. A very nice wipe program. However a bug is put into the program: a random number generator is used to decide that in a small number of cases, the new random number file is not deleted! This would leave around a lot of random number files if the program were to become popular. 2. Modify existing programs to generate random number files on occasion. Programs to be found on boards; loose diskettes; etc.. 3. Viruses that generate small numbers of random number files per disk partition or diskette. 4. send random files anonymously over the internet. 5. think up some of your own. note: in all the above, the file lengths should vary randomly & should be well tuned to avoid extremes. SECOND GREAT IDEA (self extracting encrypt/decrypt programs) (when an encryption program is itself an embarrassment.) A self extracting encrypt/decrypt program. That is,like, change PGP so that it looks like a random number file. But with a few cycles would start to unravel itself. Suggestion: 2 "random Number" files that when XOR'ed yields PGP. Probably nothing quite this bare bones & simple. Although something this simple could save your ass if your interrogators were technically unsophisticated, lazy, short of time or short of investigation funds. To do this very nicely would mean some tricky programming & would make the reputation of the programmer/ cypherpunk who did it. IMPORTANT NOTE: I am not a lawyer & do not know the law. In no case do I advocate breaking any law. I see that great idea first may be of questionable legal value. The cypherpunk is urged to consult with local, state, & federal authorities before pursuing these suggestions. Admittedly, that idea could also just be dumb & improper. Think about it. I heap big blessings on the heads of my fellow cypherpunks. Yours truly, Gary Jeffers

2 1