December 2003 - cypherpunks-legacy

mailing list software
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

If you really want to block posters and trap unsubscribe messages, cypherpunks is welcome to use the extropian's list software (by the end of next week it should be complete enough for someone else to run it without my help) Here's what it can do: Major: o modular design o mail delivered by custom "user agents" which can filter a user's mail at the distribution site (``remote kill file'') o remote system administraion (optional) o password authentication (optional) o accounting system for commercial "pay for use" subscription mode (optional) o caches messages (user definable) so users who filter a thread can retrieve it later o internalized cron for running time dependent activities (right now, the utilities that come with it generate weekly list statistics (with pretty ascii graphs), back up user list, move and compress logs, send digests, filterlists, and more) o incoming filter interface for doing useful things like decrypting signed messages or remapping anonymous id's into real e-mail addresses (``cryptofilt'' is a utility I wrote to try this out, although it needs lots of work) o user controllable digestification - users can turn digest mode on or off and alter the size of their digests o nightly filter list - when messages are filtered out by your filtering agent, you still get a list of who and what was filtered incase something was killed that you wanted to receive. You can then request to have it resent o anti-spamming routines * small messages can be configured to be trapped (such as 1 liner ``unsubscribes'' which are then forwarded to the list administrator) * large messages are truncated and stored for later retrieval for those who request them (configurable, I have it set to 50k right now) * blacklist - a regexp can be applied to incoming headers to prevent certain addresses getting through * ``members only mode'' - the list software rejects posts from those who are not subscribed o duplicate messages trapped - the list software keeps a recent database of message-ids and their header info o thread tracking via subject and ``in-reply-to:'' o built in help system o automatic sending of welcome/goodbye messages for subscribe/unsubscribe o automated billing (part of the accounting system) o complete logging of almost every list transaction (optional) o cpu cost logging (in case the list is run from a commercial service like the extropians where we have to pay to run the list) o distributed distribution - if your machine can't handle the mail bandwidth, the list software packs up the message and the list of users it is addressed to and sends it off to another machine for delivery The delivery agent which comes with the software supports the following: exclude messages by user exclude messages by thread include messages by user include messages by thread Several people on Extropians leave their agent settings in ``exclude all'' mode. They then view the list of filtered messages and include the threads which interest them. ``exclude user detweiler|sboxx'' would prevent Detweiler's posts from reaching you for example. (assuming he wasn't blacklist or he wasn't a subscriber and the list software was in members only mode) Other agent commands: private - automatically deliver response to a list of users privately and set ``reply-to'' to point to you resend - grab ranges of messages or messages by thread from the message cache sorts them into a digest and sends them to you search - performs an agrep on the cache and sends you a list of messages that match The disadvantages of running it: o command syntax learning curve for new users o documentation sucks (virtually nonexistent) o code needs to be cleaned up a lot. I learned perl at the same time I wrote it. Fortunately, perl is easy to learn and the greatest language in the universe. o cpu hog (5-8 seconds to process a message, only a problem if your list is high volume like extropian's which averages 50 messages per day) (extropians runs multiple agents so our cpu is much higher) o complicated to set up (but easy to administrate) o a little bugged, because I keep extending it however in the two weeks (before classes start) I have been doing nothing but bug killing Requirements o perl o a good dbm library (normal dbm is a little tight, so users won't be able to store that many exclude settings. about 10-15 is the max) I personally recommend the berkeley db/hashing package. I recompiled perl with it and the code is faster and the disk space used is a lot less o about 4 megs disk space * 1 meg for the message cache * 1 meg for the code * 1 meg for the recompiled perl with better libdbm * 1 meg to hold the logs (although you can disable this) you can get away with 2 megs of space or less o patience I would consider leasing it (free) to cypherpunks. Other people will have to wait to get it. The reason is because I am not yet done developing it, documenting it, and I don't own it. (I developed it on a contract with Extropy Institute and they own it.) Cypherpunks has already been given permission to use it if they want (and I wish they would, or atleast run a digest list so I can resubscribe) -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0

REMAILER ABUSE: Detweiler Accounts
by an6244＠anon.penet.fi 17 Dec '03

17 Dec '03

------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

No Subject
by css＠netcom.com 17 Dec '03

17 Dec '03

I would like to apologize to the administrator of the cypherpunks mailing list and any readers who were affected by my attempt to get off the list. I admit that I lost my temper and acted inappropriately. I missed the introductory statement probably because it failed to stand out from all the other 50 messages I received on the first day, and got deleted. I also have never subscribed to a mailing list before so was unfamiliar with conventions for unsubscribing. I lost my temper because all my attempts to get off the list seemed totally ineffectual, I was receiving 30-50 messages a day, and I accidentally deleted some of my other mail in the mass deletions I was doing. I would recommend that mailing list administrators include a small signature with all messages describing how to get off the list for people like me who aren't familiar with conventions and may have missed the introductory message. I would also recommend automation for such a high-volume list so that people can get a quick response. I assumed all along that I was dealing with remailer software, not a human administrator. Of course I knew there was a person responsible for the software, but I assumed it was automated and that since I couldn't seem to get the software to respond I would have to take stronger measures. I'm obviously new to the net and don't know things like how to find a phone number or address for the person responsible for a remailer (I now know thanks to the advice of a cypherpunks reader). What I did whan I felt I had no other recourse was set up a file full of UNSUBSCRIBE messages and put in a loop mailing it to three administrative addresses at toad.com. I let it run for 5 or 10 minutes. I hope all these messages did not go to everyone on the list. I was just trying to get the attention of an administrator. It worked. Please accept my apology for the inconvenience I caused. I acted immaturely. I now know how to get off a mailing list thanks to many helpful responses from cypherpunks readers. It is ironic that my initial futile attempts to get some response by bouncing letters drew vicious flames, but whan I crashed the remailer I got many polite and helpful letters on how to get off mailing lists. I must say that the foul-languaged flames I got from some cypherpunks readers played a major role in my losing my temper. All I did was bounce one days worth of messages not knowing what else to do and boy, did some people go through the roof. After I received numerous letters with four-letter words and other verbal attacks, I sent another message to the two cypherpunks addresses I had requesting for the third or fourth time to be withdrawn from the list. I said that if I did not get any response, I would try to shut- down the remailer. I waited several days and got no response. Enough said. I think I am off your list now so I will get out of your hair.

1 0

[mimir@illuminati.io.com: Re: your mail]
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>From: Al Billings <mimir(a)illuminati.io.com> >On Sun, 23 Jan 1994, Chris Schefler wrote: >> As I said, I am still receiving your messages. >Ever try sending mail to cypherpunks-request(a)toad.com? That IS the Admin >address. They took my request and processed it within 24 hours when I had >to switch my membership to another account. I must say that I attempted to subscribe in december and didn't start receiving mail until the second week in january. At that time Eric explained to the list that he had been away for some time. By that time I had subscribed from another address, and suddenly found myself reading the list from two accounts. It had been so long since I subscribed that I had forgotten the cypherpunks-request bit, and just remembered that it was some 'toad' thing. When I saw someone had sent a cancel request to cypherpunks(a)toad.com, I assumed that was correct. My own attempt to unsubscribe from the extra account resulted immediately in 3 mail messages, two of which were somewhat abusive. One person seemed to be under the impression that this is a usenet group, and therefore I shouldn't send unsubscribe messages to it, since only mailing lists are for subscribing/unsubscribing. The next day, Eric sent me mail with the right address for unsubscribe requests.

1 0

Re: subpoenas of personal papers
by Ron Davis 17 Dec '03

17 Dec '03

>I just saw a news story that bears on one of the perpetual questions on >this newsgroup: can you be compelled to turn over your encryption >key? In Doe vs. U.S. (93-523), the Supreme Court declined to rule on >whether or not someone can be forced to turn over his personal >appointment calendar. By doing so, they let stand an Appeals Court >(2nd Circuit) that he could *not* invoke the Fifth Amendment. That >court ruled that ``testimony'' was protected, but not personal papers. >There was a Supreme Court ruling in 1886 protecting such papers, but >that's been eroded over the years, and the Supreme Court has ruled >several times that business records are not protected. And in a >concurring opinion in 1986, O'Connor wrote ``The Fifth Amendment >provides absolutely no protection for the contents of private papers of >any kind''. Being a relative newbie to cypherpunks I realize I'm posting at my own risk... It is my understanding that you can be compelled to at least provide decrypted information. In other words the court can say, "We want your PGP e-mail, deliever it to us in an unencrypted form." A question may be how they could prove you didn't alter the information while decrypting. This could be acomplished by supervising you while you decrypted the info, with attorneys for both parties present. Of course an attorney could still argue you could change it and want the court to do the actual decryption, therefore demanding you turn over your key. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

1 0

the termination of wild "deteiler" accounts
by an6244＠anon.penet.fi 17 Dec '03

17 Dec '03

Hi all, I suspect that after was related to me via the BlackNet(a)cyperspace.nil key and anonymous remailer block that come monday we will find that our problem with LD has evaporated temporarily. On The subject of "MEDUSA".... I didnt realize until I got a few responses back that there are a few of you that post under that pseudonym and typically ALL CAPS posting... monotonous to read but great fun, you realize all 6 of you, that you and the tentacles probably have driven that poor soul buggy... great fun.... but its 2-3 of that latest series that I was convinced that was coming from the same person... and quickly realized that due to syntactical habits and patterns that you are at least 2 if not 3 people.... and checking over blacknet archives I find good evidence of at least 4-6 additional people..... bout those non-responses from BlackNet(a)cyberspace.nil.... I am sorry we have to occasionally turn down requests from our growing subscriber base but we do have to be careful with what falls into our virtual hands and act as middleman for... you know who you are... and to the "spooks" we dont do business for or with police/govermental/TLA's of any types.... sorry... but you guys really dont pay your bills in the specified payment methods too well... if you have something to trade again take it somewhere else... I heard basically from one of those MEDUSA's that there was a booby trap in the posting itself by the Original MEDUSA poster that would at least result in all the nis accounts that MEDUSA paid us to publish being temporarily if not permanently revoked... I promised not to tell.... (for one wweek) the only way we will know is when Detweiller arranges for yet another account "someplace else" and finds another way to get on the net to belabor the tentacles for the MEDUSAs actions... I hope source filtering for remailers is implemented by then... At least one of the MEDUSA posting made reference to AARM of richard depew fame would that MEDUSA send it to our penet account for archiving? Thanx in advance.... Regards Sam Hill - BlackNet researcher p.s. thanks Perry for your actions regarding the sysadmin... it worked and coordinated beautifully with the various MEDUSAs that have corresponded and done business with BlackNet(a)cyberspace.nil ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Re: REMAIL: Cover traffic
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

There's a subtle difference between the "send bogus messages thru random set of remailers back to yourself" protocol versus the "round-robin send bogus message to remailer peers" protocol. I don't know if it matters, but it's worth pointing out. In a simple round-robin protocol, bogus messages won't be contained within nested digital envelopes. When a remailer receives a bogus message from one of its peers, it will unwrap the outermost digital envelope, and, walla, a bogus message. You could modify the round-robin protocol to create more complex, multi-hop bogus messages (first hop is the next remailer peer, all other hops randomly chosen), but then your basically back to the first protocol. Is it important that your remailer peers know when you send them bogus messages? I suppose it depends on how many of your remailer peers are really operated by the Bad Guys. <shrug> Jim_Miller(a)suite.com

1 0

Re: The Digital Barter Economy
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

As Mike Berch pointed out, an economy can grow just fine without increasing the supply of whatever money is being used - as long as the currency is easy enough to divide into smaller quantities. That's one reason gold and silver are quite good, though paper money and numbers in a ledger do quite well also. Yes, there are difficulties with a fixed money supply in a growing economy - money that you save keeps increasing in value, and money that you borrow becomes harder to pay back. That's ok - markets adjust the interest rates on borrowed money to accomodate people's expectations. It's certainly better than having one group of people decide that there should be more money in the market, print it, and force everybody to accept it from them. On the other hand, in an international free market, no single government's fiat currency is mandated, and if the bank or its customers want to hedge their bets by using multiple currencies, it may be worthwhile to offer them, and any banking protocols we develop should probably accommodate that. Banks have to be more careful in a multi-currency environment - if gold or yen go way up in value, people can do a run on gold or yen accounts even though the dollar accounts aren't getting hit. (e.g. gold prices jumped about 20% at the beginning of the Yankee-UN-Iraqi War, and anything slumps in value after *I* buy much of it.:-) If a bank has all its assets in dollars, and Clinton decides to inflate the currency to pay for Nationalized Health Care, same problem, unless all its acocunts are in dollars and it has to convert when trading with people who use other currencies. As far as inflationary effects go, if you're a government and print lots of fiat currency, the value of that currency goes down. Same thing if you're issuing a private currency, except you can't force your citizens to accept your zorkmids in exchange for real stuff. So either you don't print more zorkmids than you can back with something, or your accountholders get upset, withdraw their money, and you're in big trouble unless you've got insurance - and insurance companies tend to make sure you have a reasonable audit program before they're willing to risk their money insuring you. Private deposit insurance *is* available - a credit union down the street from me insures accounts to $350K, which is $100K federal and $250K private insurance. The only reason it's not more widespread is that people have tended to believe government insurance was enough. Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Did NSA know about Public Key before Diffie and Hellman did?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Did the National Security Agency and its crew of mathematicians know about public key cryptography before Diffie, Hellman, and Merkle made their mid-70s discovery? There have long been rumors that they did, but others say it hit them like a ton of bricks, that is, it surprised them. This question came up again on sci.crypt recently, and I cautiously offered the comments of a "source with deep ties to the public key community." This was Whit Diffe, who told us about this at a Cypherpunks meeting several months back, but I wasn't sure how public the information was or if Whit wanted his name attached to this revelation. In any case, Steve Bellovin, who of course is on this list himself, wrote the attached article for sci.crypt. I think it's pretty interesting and helps to clarify the history of public key crypto, a topic of some interest here on this list. Enjoy! --Tim Newsgroups: sci.crypt From: smb(a)research.att.com (Steven Bellovin) Subject: Re: HELP! National Security Decision Directive 145 Message-ID: <1994Jan15.192102.26379(a)ulysses.att.com> Date: Sat, 15 Jan 1994 19:21:02 GMT Distribution: usa Organization: AT&T Bell Laboratories In article <tcmayCJKzyn.CDt(a)netcom.com>, tcmay(a)netcom.com (Timothy C. May) writes: > Lucien Van Elsen (lucien(a)watson.ibm.com) wrote: > : >>>>> Matt Blaze writes: > : > I recently got a copy of NSAM #160, dealing with requirements for > : > permissive action links on weapons systems, just by asking the JFK library > : > to initiate a declassification review. > > : So, does it shed any light on the rumor that came up at the ACM security > : conference that the NSA (or some other government body) knew about public > : key encrytion back then? > > A source with deep ties to the public key community says that Gus > Simmons, heavily involved in the creation of PALs while at Sandia > until recently, told him that the mid-70s announcement of public key > hit them like a ton of bricks, as something completely unexpected. You don't need to cite anonymous sources; at the Festcolloquium in his honor at the Fairfax conference, Simmons said it publicly. He said that he was on a plane to Australia, to give a talk, when he read the famous Martin Gardener column. He promptly tore up his slides and wrote up a new talk. On the other hand -- when a retiree from NSA alluded to NSAM 160, Simmons was the one who supplied the memo number. Both of them agreed that it was (at the least) the forerunner of public key systems. Did the NSA have PK in the mid-60's? The memo doesn't indicate that, at least in the declassified portions. A device meeting the requirements spelled out in the memo could have been constructed without PK, using hardware available back then. Envision a device with a core memory holding a key, an input line, a set of output lines, and some transistor and/or SSI comparator circuitry, all embedded in epoxy. You get exactly *one* chance to enter the right input value, since core memory uses destructive read-out, and there would be no reason to include writeback circuits. This isn't a design that would have been proof against a sophisticated enemy (let's be precise: against the USSR), but that was not a design goal. It would have stopped random maniacs, deranged weapons officers, and immediate battlefield use by enemy forces -- and those were the threats to be guarded against. I'm quite skeptical that -- with 1963 technology -- a high-reliabilty PK design could have been built. And high reliability was an explicit design goal. Now -- there was a portion of the memo, near the end, that wasn't released. In the context of the memo, that section *could* have spelled out long- term research efforts that would have led to public-key cryptography. And frankly, given the number and caliber of mathematicians who worked for NSA, if the right question was asked I think there's no doubt that they would have found an answer. According to Diffie's paper, it took just two years from the initial conception to when RSA was developed. Would NSA have taken much longer? I doubt it. As for why Simmons didn't know of it -- it does strike me as believable that NSA regarded the technique as too sensitive to use for PALs. After all, I claim that a secure (enough) nuclear command and control system could have been built without PK -- so why discuss it with someone who (to NSA) didn't have ``need to know''. Granted, PK would have strengthened the guarantees -- but security is a matter of engineering against a whole spectrum of risks, and balancing the tradeoffs; there's nothing that says you should favor one threat over others because the solution is sexier. You or I might have made different choices -- but I don't think my scenario is out of the question. --Steve Bellovin -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Could I possibly be deleted, please...
by Thure 17 Dec '03

17 Dec '03

The volume is far too high for mee. Thanx. / Bjoern

1 0