December 2003 - cypherpunks-legacy

Re: CERT funding
by smb＠research.att.com 17 Dec '03

17 Dec '03

Thanks, Mark, for an interesting posting about CERT. Let me add just one or two comments about the place. That CERT should be interested in software engineering is a very good sign. What do you think causes most security holes? It *isn't* lack of cryptography, for the most part, though this last big incident is an obvious exception. The answer, of course, is bugs in the code -- and to that, software engineering is the only answer from computer science as a whole. (Bob Morris Sr's keynote address at the last UNIX Security Conference was entitled ``if your software is full of bugs, what does that say about its security?'') As for the database stuff -- from what the folks at CERT have told me (and yes, I know some of them quite well), they're having a problem managing the tremendous volume of bug reports, incident reports, etc. They need to do their own tool-building. Finally, there are some folks at CERT who are *extremely* sharp. I don't know who you talked to, but there are people there I'd hire in an instant if they were available.

1 0

FLASH: FBI's Draft Digital Telephony Bill: EFF Summary and Analysis (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

2 1

Re: BIX musings on Zimmermann
by walter kehowski 17 Dec '03

17 Dec '03

################################# peace(a)BIX.com muses on Zimmerman: I think about that, it was Isaac Asimov in his story about an invention which allowed people to see back into time. Suppressed by the Government, it was independently re-invented by a professor who only got curious about the topic when he realised it was classified. The catch; when does time begin? one second ago?, one nano-second ago?. With the invention, privacy became a thing of the past; you could go anywhere, see anything. Its kind of a neat twist on this issue. The government would have us believe encryption is a *bad thing* because bad guys will use it to hide their activities. ################################# You've joggled my memory. The Isaac Asimov story referred to in "BIX musings on Zimmermann" is "The Dead Past". Another twist on this issue is that the government was cast as the good guys actually protecting the rest of the world from the wide spread use of the "neutrino-gravitic" time-viewing technology whereas the scientists were acting out of "misguided" notions of freedom of access to the information and technology. When the scientists are finally apprehended they gloat over the fact that the technology is now freely available. The gov't failed to stop them. (The time-viewing apparatus is easy to build.) When the official makes clear what the consequences are (the past is now dead - anybody with a TV set can now monitor anybody anywhere anywhen), the scientists are ashamed of themselves. However, it's important to note that the government was not above using the technology to suppress the spread of the technology. What such a monitoring agency would become in twenty years or so is clear. Just how paranoid could it get? ("Crisis and Leviathan" - When the crisis has passed, the institutions set up to deal with it remain.) It is interesting to speculate on the analogy between Zimmerman's PGP and Clipper and the "neutrino-gravitic" time-viewing technology which the government is not above using for ostensibly noble ends. Walter A. Kehowski <wak(a)next0.math.pitt.edu>

1 0

Re: Give me your privacy and I will protect you.
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Michael Johnson <mpj(a)csn.org> > > Just say "NO!" to harmful drugs, promiscuous sex, the ITAR's restrictions on ^^^^^^^^^^^^^^^ Please, tell me this is a joke. > strong cryptography, and Key Escrow! Write YOUR Congressional Representative > NOW and express support for Maria Cantwell's bill to ease restrictions on > privacy software! --Dave.

1 0

Net restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

I don't know if this is correct, but from what I have read it seems that the Net needs and will be restructured somtime in the future. I think our biggest concern when it happens will be that Clipper like encryption and monitoring will be implmented as a standard. Who knows maybe the net will be run by the government. Reuben Halper -anger is a gift- rage aginst the machine/Freedom

1 0

[CODE] Pay-per-use WWW & Mosaic?
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I want to make a crossbreed between NCSA's httpd 1.1- which already supports passing PGP signed/encrypted messages between client and server- and Magic Money. The result: a pay-to-view information service. It is uncertain about when I'll get around to it, since my free time is already being spent working on the Mac version of Nautilus. If anyone's interested, or if any of our protocolmeisters (yes, that's you, Eric & Hal!) have ideas, bring 'em on. - -Paul - -- Paul Robichaux, KD4JZG | "Let he who is without sin cast the first perobich(a)ingr.com | pointer." - Owen Harnett Intergraph Federal Systems | Be a cryptography user- ask me how. Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWzp7yA78To+806NAQHj/QP9HttikpI7rwtk//J/azu4P+KB1BM9Fa/2 JrIAsUt7yY3fpuJSeuHHq9919zx8kBdApYDfmcs8rr1Q5BQM2ABWZprQktBDUKop LcMIPh/+Tv2vav15Nbb2I2OoCwmJLb8Qc9YG+HRvzNfX7Xn92ihjleh0h/TJZXaE GACHMCMHCLE= =iWcr -----END PGP SIGNATURE-----

1 0

STEALTH OCEAN
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt Thomlinson asks: >I can see how a stealth-PGP would allow you to hide messages on >your disk in "wiped" filespace -- it'd look like garbage (maybe -- >see Aside), if anyone took a look. What does this buy you, though, >if you've got a telltale TSR hanging around? Why not "Parasitize" your program on to Command.com like many viruses do? The "Stealth" viruses also employ code that will not reveal the change in size to either MEM or CHKDSK, such code can also restore the timestamp. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWzS19CcBnAsu2t1AQFyQgP9GpJQcB4TNSxzcBdKh+MWOWl6uHcEEM5I QEU7NpmegvNBAoTLuH4at8CMGqqIjol0LwIFjpKO9pkWsXUldNLHx1nl2m/Ur1iA BbPYH6ajDjuV+i/OHvNVt+ZaS1R+zZKkrW+FzA1mzM1iGn2JE5HWIdGS9r2mShRC diQXI87CWmg= =+0ln -----END PGP SIGNATURE-----

2 1

New mailing list?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

I am interested in starting a mailing list (digest, moderated) on encryption uses/abuses and possibilities in the real world. It would be like RISKS, but would concentrate on cases where encryption is currently being used and cases where it should but isn't. No discussions of this-asshole-actually-asked-for-my-SSN or the like. The idea is to expose to the public where crypto is useful and hopefully get more people to understand what will be lost if the gov't succeeds in keeping crypto tech under its thumb. However, a list is only as good as the material submitted to it. So, I ask the members of this list whether you would be interested in: (a) reading such a list and (b) contributing to it. --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 an53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1

Re: Net Restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

> This doesn't dtop ordinary [or extraordinary] people from running their > own net. This net, with in and out ports to other nets, would follow none of the rules enforced upon our current net. If they try to cut us out we simply change out location. I don't think that is logical or feasible, and my point is that the net is becoming something for the masses now. The masses won't be as crafty as you . I feel that if or when it is restructured the people logging on won't be aware of the lack of security or they will have false security. Reuben Halper

2 1

from the mouth of <the FBI>...
by Ophir Ronen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello all, This seminar might be of interest. I am going and will post any pertinent info. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Open to Microsoft employees, vendors, contractors, temps - until we reach room capacity. WHAT: BROWNBAG SEMINAR Sponsored by ITG WW Network Security WHEN: Thursday, 24 FEBRUARY 1994, 12:00 NOON-1:00PM SPEAKER: Kevin Brock from the FBI will be our guest. FORMAT: Short briefing open to questions. SUBJ: -FBI concerns about security of intellectual property. -Economic espionage vs Industrial espionage. -If Microsoft is a target: Who is collecting information? Where is it being collected? How is it being collected? -Responsible self-defense *********************************************************************** Ophir Ronen <a-ophirr(a)microsoft.com> KeyID 1024/54FF05 1994/02/16 Key fingerprint = EA BF 5C 85 F6 C3 A7 8E AA 48 2A AC B9 BC 4B D2 "did gyre and gimbel yet did not inhale"

1 0