December 2003 - cypherpunks-legacy

Re: BofA+Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

[Welcome to the list, Marc. Great to have you here!] Marc Andreessen wrote >In article <9412111647.AA23311(a)tadpole.tadpole.com>, db(a)Tadpole.COM (Doug >Barnes) wrote: > >> I'll throw in that from the perspective of someone running a server, >> their approach of requesting all graphics simultaneously over >> different sockets in the name of client performance is disastrous. >> This causes most servers to fork N times more per page, where N is >> the avg. # of graphics. > >That's just plain not true. Servers don't fork any more often >with Netscape than they do with other clients -- EVER. > >> but some have speculated that this was done deliberately in order >> sabotage server software other than their own. > >That's also just plain not true, and completely unsubstantiated. Marc, have you ever been in an empty lab with an htpd server - late at night? You can HEAR it when Mozzilla hits the site. Two or three Mozzilla users at the same time will kill your server. Unless, I understand, it uses your server software for which you charge money. Can you be surprised that there are a significant number of people out there who are wondering if your "selfless" deed of giving away your client software for free was really all that selfless? -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Storm Brewing Over Forged Bob Rae Posting?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >In yet another piece of news, Netcom has apparently been >hacked/attacked rather badly. The "netcom.general" discussion group >(local to Netcom) is filled with garbage posts, forged posts, >cancelled articles, etc. Messages about "root" being forged appeared, >then disappeared. Netcom is quiet on this, but has been running >"crack" on all of their machines for the last several days--apparently >to (somehow?) help to find security flaws....I have no idea why >running crack to find weak passwords of users is such a high priority. >Maybe the apparent attack is related, maybe not. Netcom has unauthorized access problems for the longest time. My account has been deleted three times in as many months. Neither sysadmin nor accounting had any explanation or record of the deletion. No, I didn't owe them money. This has not been an isolated incident (see the article about Netcom under the fitting title "Sysadmins without a clue" in the Summer '94 issue of 2600). Netcom states in their announcement in netcom.announce that the passwords compromised were of a type that could be found in a dictionary attack. This would explain why they are running crack. Seems someone else has run crack before them. It also seems that root(a)netcom.com made the mistake of choosing a pw that is subject to a dictionary attack. Well, sysadmins without a clue. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: BofA+Netscape
by marca＠neon.mcom.com 17 Dec '03

17 Dec '03

>have you ever been in an empty lab with an htpd server - late at night? You >can HEAR it when Mozzilla hits the site. Two or three Mozzilla users at the >same time will kill your server. Unless, I understand, it uses your server >software for which you charge money. Wrong wrong wrong, not true, false, unsubstantiated, in error. Attached is a note from the author of WinHTTPD that answers a similar accusation made in news last month. Marc > Newsgroups: comp.infosystems.www.users > Path: flop.mcom.com!news.Stanford.EDU!agate!howland.reston.ans.net!ix.netcom.com!netcom.com!rdenny > From: rdenny(a)netcom.com (Robert Denny) > Subject: Use WinHTTPD 1.3e! (was: Everyone Please Read!...) > Message-ID: <rdennyD027tJ.528(a)netcom.com> > Organization: NETCOM On-line Communication Services (408 261-4700 guest) > References: <3bcqc1$s7e(a)news.doit.wisc.edu> <3bfkrg$4a4(a)huron.eel.ufl.edu> > Date: Wed, 30 Nov 1994 02:48:54 GMT > Lines: 21 > > In <3bfkrg$4a4(a)huron.eel.ufl.edu> chris(a)surgery.ufl.edu (Chris Barnett) writes: > > >There must be something wrong with your server. I'm running WinHTTPD1.3e > >on a 486-33 w/8MB o' ram and I don't have any problems with Netscape. I > >use Netscape all the time and I've had lots of people using Netscape > >access my server without any problems at all. Granted, there is practically > >nothing on my site (people that said they would write homepages for their > >divisions haven't yet), but I do have a pretty steady load of users and I > >haven't had any problems. Asking everyone else on the Net to change simply > >won't work. > > The irritating thing about this affair is that I have been very vocal about > the latent problems that Netscape uncovered in my server, and I fixed them > as fast as anyone could possibly hope for... I posted an announcement here, > and most every day I reply to some message with the URL of the Windows > HTTPD server's home page. My mail address is all over the docs, and I > have no record of the gentleman asking me about the problem... > > I know, "quit whining and get a life!"... :-) > > -- Bob -- Marc Andreessen Netscape Communications Corporation Mountain View, CA marca(a)mcom.com

1 0

Re: Storm Brewing Over Forged Bob Rae Posting?
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sun, 11 Dec 1994, Mark Terka wrote: > Here's an idea. Someone mentioned trying to set up an anon remailer on the > North American Freenets, but it seemed there were software compatibility > problems. > > Would this be practical? Sounds like it would be worth a shot. But again, I > guess it comes down to the software compatibility problem. Yep, if you get info on Freeport (the most common Freenet software) they tell you up front that you will need a Unix programmer and network type to install and maintain it. And it isn't freeware, regardless of the name. It is a time-period license which you have to renew every few years... - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuupQyoZzwIn1bdtAQFD2gGAlu98f5K0uCamNSj9MGxNYZ3hjp8c4kLf 7a4B4ZhyI77vYtwdZ0PMtB9SjS3QDmPk =JA0O -----END PGP SIGNATURE-----

1 0

Re: Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Mon, 12 Dec 1994, Ian Farquhar wrote: > Even so, I really wonder if the export of cryptography ON PAPER but in a > machine-readable form would be in violation of ITAR? If anyone has one of > these old scanner, it might very well be worth trying. And what about using MICR ink? Paper-floppy (sort of)? - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuprCoZzwIn1bdtAQE1fQF+KJn5Hfh3guv4/ElbppMv6RkkZCGjBKSn PvzVDBCbvdueYJwp5AAbZBI2ycCFQizh =ZxaK -----END PGP SIGNATURE-----

1 0

Re: Real-time surveillance of the police
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:14 PM 12/11/94 -0800, Timothy C. May wrote: >I don't plan to say much more, and won't be playing the "Twenty >Questions" game, but the system does _not_ use satellites or anything >of that sort. Satellites up the ante considerably, and aren't even >needed. No invitatation to twenty questions intended. You could have sat quietly and let me make a fool of myself (or not) without futher comment. Since you have... I believe if you reread what I wrote, I said that the accuracy with satelites was considerable using a pretty small box to begin with (for instance, the Geostar satellite-based system's predicted accuracy was about 6 inches in two dimensions and two meters in three dimensions), but that with local antennae (say every block or so) you could have pretty phenomenal accuracy the the signal was possible. If you put embedded antennae in the walls (we put wires in walls already, yes?) you could get accuracy enough to precision mill with ;-). So, given your reference to ground-based radio, I think we're in "violent agreement here". The application of this to physical commerce has been discussed here before. Just pick up a tagged item and walk out of a store with it. It could be made anonymous, I bet. > >Radio is enough to get 1% positional accuracy (or better) and radio >can have better coverage in many places that GPS-like systems can't reach. > >> the backs of commerce. The only thing which saved GPS for mere mortals like >> us was the MIC's usual severe understimate of Grove's Law and the > ^^^^^^^^^^^ >> exponential cost effectiveness of integrated circuits over time. >A minor nit, but that's "Moore's Law, A major nit, in my book, and one I'm standing on the wrong side of. I got Andy Grove confused with Gordon Moore. It must because they look so much alike. :-). Grovelling in your general direction as always, Bob Hettinga ;-) <I seem to be downwind as usual...> ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Broadcasts and the Rendezvous Problem
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <v01510103ab114c09dd73(a)[192.0.2.1]>, Lucky Green <shamrock(a)netcom.com> wrote: >Which brings us back to the news -> mail gateway. There has to be a better >way. I don't see a problem. Broadly put, news is broadcast e-mail. There are many sites which in fact do not distinguish between the two, the most notable of which is CMU's Andrew Message System: the admins of such systems believe the "experiment" to be an all-around success. If you want message A to get from site B to site C without a clear trail, you've got to broadcast. It's that simple. It isn't a very big problem that site B put something into the flow, so mail to news isn't a weak point: an article can be injected at the remailer's site without compromising the channel to traffic analysis. - -- Todd Masco | It's difficult to be loud about keeping your enumerated cactus(a)hks.net | rights when you're busy exercising your unenumerated ones. cactus(a)bb.com | http://www.hks.net/~cactus/cactus.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuu/KyoZzwIn1bdtAQHDbwGAgkIM2IZ3W1NtzzgNbpCkjpfJwPMVCMG2 ed0TnOHKU7ws4oUrHpddC6pAjzmk22uO =2zh3 -----END PGP SIGNATURE-----

1 0

re: real time surveillances
by Mark Hittinger 17 Dec '03

17 Dec '03

Some thoughts on this: Will the people *believe* the electronic position data? Nope. When you are busted not only will you be frisked but you will also be bulk erased :-) (to get TC's DAT tape!) The technology to fabricate video evidence is there is it not? There was a relatively recent sad case of two officers that had a video camera installed in their patrol car. They had pulled over a speeding car. While obtaining the license the occupants of the car murdered the policemen and the *entire* scene was obtained on video tape. When the tape was later reviewed, searching for a clue as to what happened, the individual had to watch the officers slowly die - all captured on video. It is possible that they might have been saved had this been real-time video rather than taped. Consider the next level here folks? Will just having archived knowledge of where certain people are be adequate? Will there not ultimately be a call for real time monitoring of these officers? Will that be something that would be cool with them? Another great idea would be anonymous real-time monitoring of vital signs along with position data. Auto-911 if you will. We know somebody at this corner had a heart attack 5 minutes ago where is he? Cheers mark.h

1 0

RE: Real-time surveillance of the police
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Michael Crawford wrote about my article in the December '94 issue of Wired, ("Watching the Detectives", p. 141): ... The advantage for society is that the cop's behaviour, such as billy-club swinging velocity, can be monitored. It could detect gunfire, too, ... This would work to the extent that the equipment is actually mounted on the cop it claims to belong to, so some manner of authentication would be needed. Fleming told me that the localizers would also take biometric readings to monitor the cop's physical status. It turns out that individual biometric readings vary significantly from person to person. It would be very hard for one cop (or a dog, suspect, whatever) to pose as someone else by wearing his localizer. ... Yes, that's right - keep surveillance cameras going on _yourself_. If you're not doing anything illegal, you've got nothing to fear from taping everything you do. I don't like this idea one bit. I agree with Tim that it is the first step on a very slippery slope. ... I expect that it will be difficult to convince our Nation's Finest to adopt this new technology - though I'm sure they'd be happy to apply it to parolees and those serving on probation.... It would be difficult for the cops to reject it. After all, it definitely benefits vast majority of good cops. It only hurts that teensy-tiny minority who violate people's rights. Right? Michael also argued that it might be more easily sold to private security firms for legal liability reasons. This argument is even more persuasive for police officers. Cities routinely pay astronomical settlements, or fight expensive law suits, arising out of alleged incidents of police misconduct. Frivolous lawsuits would be quickly thrown out of court. Rogue cops would be identified and thrown off the force. Works for me. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Hal Finney & Bob Rae and Ontario's Parliament
by FRODO＠uhura.trinity.toronto.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- All lines between this and the PGP header may be suspect. This is what I posted to Ont.general this evening. Those who are interested in getting more information about the kerfuffle in Toronto over the posting through an anonymous remailer might want to check out http://www.earth.org/~newsbites (I believe that's it. You might want to try without the directory.) Which contains muchos information, including the discussion going through the newsgroups, and the Globe and Mail article.) The article below is what I posted to ont.general myself this evening. Seemed a good chance to proselytize... ;) It was signed, as below, with my shame-facedly new PGP key, though the signature file was slightly different. (I've managed to grab the real .sig off my unix account. As I noted, one of my e-mail sites is currently not sending mail.) Article begins: Short note. Mike Harris' behavior in the legislature is the symptom of either malevolence or incompetence or both. Either way, he won't be getting my vote. On the other hand, there are ways of protecting yourself from forgeries such as this. You can't stop people from sending such mail, but you *can* make mail that you write unique. PGP, a fully legal encryption program which the Ontario government could use FOR FREE, has a signing protocol so that recipients can check to make sure that your mail did indeed come from you. If you make it a standard that you don't send unsigned mail, and don't post to newsgroups without signing what you send, unsigned mail will be suspect. In this case, the mail went through the cypherpunks anonymous remailer at portal.com. I trust that whoever sent the mail had enough computer sense to have chained it through several remailers, if little else. We've been through the arguments about "yes there was a disclaimer," but people seem to be ignorant of the fact that there are already ways of protecting yourself from misrepresentation on the net. The University of Toronto's CDF facility is currently having a little problem with sending mail (ie, it can't), so I'm posting this instead of sending it directly to Bob Rae. Perhaps we should send him PGP for Christmas? Richard - -- Richard Martin ChemPhysCompSci 9T7+PEY = 9T8 g4frodo@cdf Trinity College University of Toronto SVW92 martinrd(a)gpu.utcc My opinions, when not poached. (or fried) frodo(a)uhura.trinity [Tack a "toronto.edu" on the end of each e-mail address. I'm faced with a mailing program with draconian margin policies.] -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBLuvVl6+lG3+zwTCVAQFPdwQAtX0fh0aJuhPC1mCUAlNDDi9tV0QB0yy8 cSNIlBxVgEzTl6K0geu25CSXSGh2N4dFdh6rHMPjkMkOsfcVPFI5nXb8+zHtfFgd UxkU0mwhunyFzLCN4tm0UVKruzWmfV8bGV9EezSsRrmAeAsZwT9s5hJ3qdOnf3mn twbGIn1Eadg= =UI1+ -----END PGP SIGNATURE-----

1 0