December 2003 - cypherpunks-legacy

he's back!!
by Brian D Williams 17 Dec '03

17 Dec '03

They seem to have fixed the problem, I just got a load of mail! Brian Williams

1 0

Re: Valid MacPGP??
by habs＠warwick.com 17 Dec '03

17 Dec '03

> > Distribute "MacPGP 2.3 (1.0.5)" > > There is a 'newer' one out (1.1?), from someone in Germany, but the > source has not been made available (!). Is is signed and if so my who? If not how do we know it isn't cracked?? /hawk

1 0

I'd like to partially correct that..
by Matt Thomlinson 17 Dec '03

17 Dec '03

I did dredge up what appears to be the magic money DOS version at csn.org. Nothing having to do with magic money resides on ftp.netcom.com. For all of those that could like it, check out csn.org:/pub/mpj/I_will_not_export/crypto_?????/pgp_tools and pick up the files mentioned before: mgmny10e.zip and pgptl10d.zip. mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

2 1

RE: My skepticism/promises WAS Re: Mien Beinkpff
by Bill Garland 17 Dec '03

17 Dec '03

Subj: My skepticism/promises WAS Re: Mien Beinkpff From: whitaker(a)dpair.csd.sgi.com (Russell Whitaker) Discussing what >>On May 4, 8:04am, Bill Garland wrote: > >> So what else is on the homework list? >> >> 2. Read Schneier. Heavy into the technical cryptography stuff, to >> be sure, but definitely required reading. Many time units. >> >> 2. b. Do the Errata list. >> > >This last subtask is very important. I remember seeing the first set of >errata, and hearing reports of Bruce's (understandable) dismay at the >publisher's cavalier treatment of the typography of mathematical formulae. > >I've only recently gotten a round tuit myself, having perused the first section >of a housemate's copy, and am convinced I need my own. I'll have my own Friday >afternoon (Stacey's sells it locally), and am wondering if the most recent set >of errata are still available from Bruce. I was on a distribution from Bruce >for these, and am wondering if the mailing list still exists. I seem to remember getting a second Errata List posted here. ... >> 5. Get a Netcom account? Is this possible for a Canadian? I'd >> still have to telnet from some supplier here. I'll go for my >> own service with my own satellite dish. Investors, anyone? >> Ripe market! Send for Prospect-Us. > >Netcom? Only if you're a masochist. If you try dialing in, that is. Or doing >anything involving finger daemons. Or... I guess I don't know much about the _actual_ Netcom... it's just that so many people have addresses at netcom.com. Perpaps I was misusing it as a generic commercial account provider. >> But, isn't Unix full of security holes? When I set up my own >> Netcom company, won't I be hacked? Ray? HELP? Oh yes, I've >> got to get into Pr0duct Cypher's product. What's a firewall? >> > >Um, your own "Netcom company"? Netcom is certainly not the best business model >for an Internet service provider. Look at the load problems! Their pricing >model is very, very poor. You get what you pay for. I have 2 accounts on >Netcom (one business, one personal). Dialing into Netcom is useless, so all my >mail to those accounts is .forward'd to elsewhere. Thanks for this feedback. And this: >If you're seriously contemplating a Netcom-like service, ignore the whiners >("But your service costs too much!") and implement a rational pricing model, >rather than an all-you-can-eat-for-one-low-price dialup policy. ==== >> There's gold in them thar hills ... >> > >I don't know who you are, but it certainly makes it very difficult for anyone >to give you the benefit of the doubt when you publicly admit such a cavalier >attitude toward your own finances. Read what you've written above, and ask >yourself if it inspires confidence. You are certainly correct here. Cavalier, eh! Without wanting to get into this too far as to get off topic and into areas better left alone, this is just me trying to cure a very long case of bad attitude (self transformation into a dynamic optimist, as it were...) and not having succeeded yet. I am cavalier about it because it is public knowledge, even though I don't have to go spreading it around myself - but if the truth were known, I have benefitted from the experience. I think also I must have had a case of the "don't care's" when I injected just a little too much personal stuff into this effort. Folks have been asking for action, and where my personal style has not yet matured enough to be 100% totally professional all the time... I sometimes open my mouth too far, whereby I insert not only my foot, but the whole damn leg as well... >You say, "Fuck 'em... I'm going to do it anyway..." Well, OK. But talk like >that, while a fine display of your Cajones, doesn't inspire me. Perhaps this is a culture thing... >> And please, Tim, We Really Do Need The FAQ. ... >> >I, too, value Tim's postings. Yes, and if I sounded too cavalier in using Tim's name in my harangue, sorry - although I was replying to his post. I'm sure he will let me know if I said anything to offend him. > At the Extro-1 conference this last weekend, in >a discussion on "The Extropians Virtual Community", it was noted (not a new >point) that good posts never draw the responses that objectionable posts do. > Herein lie very large and serious issues of incentive engineering, which will >not be solved anytime soon. Well, never say never. I have seen threads I started (which were't objectionable) go on for weeks long past any input from myself. But, I guess it is true most of the time. I really wish I could have attended Extro 1. ..... snip ..... >If you want this - or anything (desirability aside) - you're going to have to >*convince* the rest of us - part of your potential market - why we should want >it too. Agreed. Absolutely. The single harangue we are discussing now was not this convincing that you and everyone needs. It was not meant to be. It was part dreaming part actual planning part just announcing some goals part training and part just thinking into the keyboard. Part of a Just Do It motivation that seems to have crept into my somewhat defective b-class module cpu-brain (possibly damaged) thing here behind these eyeballs. Having gone out on this limb, however, there remains this task I have set myself to explain all this...which will not be completed before I get some sleep. >> before I can do that, well, you know...homework... >> >> Still, if you want to get the ball rolling, send me $10 and I'll >> deposit it in trust, sticking my own reputation on the line ... > >Who are you? Seriously. Do you have a reputation? With whom? Is this >reputation salable? Well, I guess if I did, it's gone now... Oh well. Not meaning to be flip - you are right, My reputation has definitely taken some well deserved hits, and I don't consider it saleable. In deference to those who dislike smileys, and because I prefer it that way, I have tried to give up using them. >> Actually, I don't know if there are any legal implications to >> that, because my private company Macronic Systems, Inc. is incorporated >> specifically NOT as a bank, because different rules apply to a bank, > >You don't know, yet you make a solicitation of funds? Well, I suppose it really was a solicitation, if taken word for word. I may be a fool in many ways, but I really did have tongue in cheek here. Sorry if I misled or if my lingering depression coloured the tone of my voice - I for one refuse to go seek out prozac, for reasons I won't get into. >Oh, yes: different rules >*do* apply to banks. You really do need to read into North American banking >law. Correct. >> but my INFO_Banque is not incorporated anywhere. It is a virtual >> entity of mine that nobody can get at just yet. > >Do the authorities know where you sleep? This "virtual entity" is *you*. Are >you judgement proof? Well, yes, I think. At least I am well on the way to becoming so... >"Virtual" is such a fashionable buzzword these days. > What do you mean by it? No. Skip that one. I didn't say '"virtual entity"', I said 'virtual entity', using the word virtual in it's normal, non-buzzword meaning. It is not real, yet. It is a set of ideas. Now, I know that ideas are real, but this is too much to quibble over when there is so much else to do... ... >Well, I guess I've answered at least part of my own question... they *do* know >where you sleep. Yeah. I did worry about that, but They Already Know Anyway. I actually thought about encrypting the entire message and only sending it to Customers, because I really should allow some paranoia back into my life...but nobody would have bought it! And wouldn't you know it, just after posting, I got the detweiller mail bomb and the message from Tim updating newbies on that perversion. When Cypherpunks get Extropian/Hawk/Ray code, tmp will be ::exclude'able. >> Yes, this is fine. But we are talking anonymous money, untraceable >> transactions, cryptoanarchy, stuff like that. We know about cheques. >> (I wish you yanks could get your spelling right!) >> > >That's Yanques to you, bub. Sure t'ing, by. Whatever you wants. >> Agreed - of course. We've got to beat VISA/MC/AMEX/Travellers Cheques >> in transaction costs, > >Have fun trying. Do you mean "cost to credit company" or "cost to end user"? I mean in the game of making money, making this workable, profitable, doable. Costs to Customers. Delivering products and services of value to them. >> HEx is now dormant and will be for a little while yet. >> I am expecting to be able to find a place from which to run it >> real soon now. > >The playing field seems to have shifted ... > >Just *which* business do you plan to focus on? Which one is the one you are >chartered as a corporate entity to pursue? If I were a potential investor, I >wouldn't put my money onto a raft of promises. I have had ths very valid criticism before, and I thank you. I am not actually seeking investment capital here through anything I may have said with tongue in cheek. And if a $10 cheque _does_ arrive in the snail, I will do what I said, which is deposit it in trust and honour the fact that it does not belong to me. Of if it looks like the horizons are too far away - Tim says 10 to 20 years? - I will return it. >I'm not trying to squelch your enthusiasm, Whew! > but it's damned difficult for a >smart and energetic polymath (you sound like one; many of us are) to viscerally >accept the necessity of narrow specification and ruthless pursuit of a single >goal. You need to do one thing very well, and see if it flies. Otherwise, you >will accrete a reputation as a dabbler. What can I say - of course ! Focusing on narrow ruthless pursuits has been one of the ongoing problems I have with a sometimes overactive sometimes lethargic b-class module cpu-brain (possibly damaged). This concept of polymath - are you referring to something from a John Brunner novel of many years ago? Is this a word for which I need more clarification ? ... >> run, I may even repay with digital cash royalties. > >Royalties which will buy me how much petrol? Probably some fraction of some small number of litres for each digital dollar you are paid. Or whatever the going rate is. > How many pairs of trousers? How >many copies of the *Economist* or *Playboy*? How many scoops of Baskin >Robbins? Ditto. Actually, the idea of using Girl Guide cookies as exchange medium sounded neat. I order them once a year from my girls, so those of you with INFO_Banque digital cash you want redeemed, get me your order of cookies by, say, the end of January, and you'll have your cookies in April. $2.50 Canadian per box, converted to US dollars. But then again, my girls are soon to be women, so I'll have to switch to bottles of Barleygreen or something. >It has to be cash with backing. Calling it something cool doesn't convince. > There need to be fundamentals in place. Agreed, of course. The plan is to have my digital dollars, if and when etc etc, backed by good ole yanqui dollars. >> Other uses include digital timestamping - when I can get a >> machine and ups and raid box and backup site and security and >> all that other stuff I want - I will start offering services >> like this. What with all the other ambitions I have mentioned >> here in this Mein Beinkpff message/posting, I could easily spend >> a few hundred grand getting this together - if I didn't have >> a full-time job to do to feed my family, etc etc.... > >You've said this a number of times. Are you simply expressing your belief that >you'll never really do anything? No. I do not have this belief, despite whatever attitude I may have projected by thinking out loud. Just some practical realities. >Then why post at all? Why not! Action, jackson. >Do you have that low >an opinion of your own abilities? Do something. Don't complain. Your life is >your own. I will be impressed when you *do* something. First it is noted that I have too high an opinion of myself in that I have claimed many things I want to do and see happen and accomplish along my new-found-land, and now I have too low an opinion of myself because I cannot go out and spend the investment capital I don't have to do what needs to be done to prevent some things from recurring that I ought not to have allowed occur in the first place... Well, perhaps I am a confused individual. I well recognize the fact that I am a scatterbrain and that I mix and match my ideas with those I discover from others, but I am an integrated scatterbrain. B-class probe modules are self-repairing. >> yourself, and soon there will be 700 Cypherpunks and 300 Extropians >> and all 4 IMP-Interest people all having anonymous remailers and mixes >> operating, so any sub-chain of eight INFO_Banque Protocol banks >> will virtually HAVE to be reliable for our commerce... > >You make some interesting assumptions here. Why? Why should all of the people >you list above do these things? They won't, of course. Some might, assuming some of those interesting assumptions, for example that some ber of Cypherpunks and or Extropians and or other people in the world want thave digital cash available on the Internet and trustable chaumian mixes and anonymous transactions and so on. >> account. Maybe it will at first turn out to be merely digital >> cheques, but maybe if Perry lets me in on his secrets and some >> of the stuff he has learned from these six-figure guys at >> Citibank who are out trying to figure out how to capture this >> market, well maybe then we can get somewhere... >Are you willing to pay Perry large amounts of money for consulting? He *might* >consider it, if it's cash up front. (Right, Perry?) Well, yes. Willing and able are not the same. Of course I wouldn't expect someone as astute and knowledgeable as he to simply give away this valuable knowledge. I expect Perry himself is one of these six-figure guys he has warned us about. And he has hinted once in a while that he is working on new business. He is much more adept than most people (read me) at keeping his mouth shut when it really should be kept shut, and is, as far as I can tell, one who knows the difference. Not to mention... >I suggest you simply dive in and start learning basic economics. Start with >Hazlitt's *Economics in One Lesson*, Bastiat's *Economic Sophisms*, anything by >Hayek, Mises, and David (the younger) Friedman, for starters. Don't expect >someone like Perry to open up to you with "revealed knowledge" which will make >it all clear for you. If you're as serious about your Homework as you keep >repeating, learn the fundamentals of how the world works. Yes, this is what it is all about, eh. >You will then have at least some of the tools to acquire more tools. >> But please, sir, can we have more? Please write about Protocol. >> Soon. Like, forget the line-by-line response you were going to >> make to _this_ message... heh heh. (Opps, I almost said ... >> no, I can't repeat it...) And finally, >One of Tim's many graces is that he rarely makes a practice of the line-by-line >response. I know that. He is probably rolling his eyes upwards and groaning at this entire response. He has straightened out some goofy ideas I have harangued about in the past, and, again, not wishing to put words into the mouth of someone who is so eloquent by himself, he has expressed the same skepticism of my scatterbrained overambitious non-focused ideas before. But I have got some of the homework done, and more is in progress. > I wish I could say the same of myself. I also wish I could say the same of yourself - oops, sorry...heh heh, of course I meant my self. >Russell Earl Whitaker whitaker(a)sgi.com >Silicon Graphics Inc. >Technical Assistance Center / Centre D'Assistance Technique Thanks for your feedback and help. I know.... But, friends, I am smiling. I may even draft a new version of the Cypherpunks Quick Code on my next break. There was an interuption in our feed around about that time - I don't really know if it ever got through. And regarding my overambitious, somewhat bubbly stuff about all the miracles my INFO_Banque will accomplish and my other businesses will achieve - I refuse to put limits on what I can do. I've been there and done that and it didn't work. Focus, sure, but limits? That would be non-EC! You want action, so hang on a minute. Meanwhile another few dozen messages have come in...Perhaps I should retire now before sleep deprivation starts a perversion... and keep asbestos pajamas on when I get up. /----------------------------------------------------------------------\ | I am an Extropian. | Macronic Systems, Inc. offers Ideas for Sale ! | | BEST: DO_IT_SO ! | Go for it : Pledge a Digital US Dollar now. | | CryptoAnarchist. | Send PGP key for more information. | | Cypherpunk. | Get in on the ground floor. Invest Now. Trust me! | | Owner : MSInc., |---------------------------------------------------| | HEx, INFO_Banque | Day Job : Bill Garland = bill(a)kean.ucs.mun.ca | \__________________________________o o_________________________________/

1 0

PKP licensing of RSA
by Bruce C. Dovala 17 Dec '03

17 Dec '03

Hi all, Just what may be a stupid question concerning licensing of the RSA algorithm from PKP. I have friends who would like to use freeware PGP but are hesitant to do so because of _possible_ patent infringement against PKP. On the other hand, they aren't crazy about paying $100 for the ViaCrypt version. (And that price will increase shortly, I believe. Does anyone know if PKP will directly license RSA for single-user use? (In other words, get the freeware version of PGP and then get a license from PKP to use it "legally"). I would imagine the license would cost less than $100 if available (why do I doubt that ViaCrypt is in this for their health?). Yes, I realize that this would mean there would be a record of licensees. And if the government chose to make "non-Clipper" encryption illegal in the future, they would have a list of people to investigate. A LONG list. Included on which would be all cypherpunks and everyone who bought a copy of ViaCrypt PGP. So what are they going to do about it? I think it is well out of their control. It would be politically unsound to investigate all registered ViaCrypt users. Obviously, this question is for the benefit of those who, for whatever reason, must remain "strictly legal". But who don't care to pay $100 for ViaCrypt's version. People who are willing to use the unlicensed freeware version (not like _I_ ever would ;) ), could continue to do so. Maybe I'm way off-base here. Don't flame me, just correct my thinking. (Though I am wearing my Nomex suit!) Thanks for any intelligent replies, Bruce

3 2

Re: The Value of Money
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

> >I understand this much: there is some gold and other actual metal >located in a vault, sitting there as a symbolic standard of wealth, >worth, value. Everyone stakes a claim to it, and they exchange that >claim to others in substitution for something else (dog, rifle, gas in >the car, baby-sitting). >Blanc > Actually, there is no connection between the gold and our money. I.e. you cannot take US $ to Fort Knox (or any other government location) and get gold for it. This is why some posters have referred to "fiat money" - the $ is money because the government says it is. Reynolds

2 1

Re: The Value of Money
by lefty＠apple.com 17 Dec '03

17 Dec '03

>On Wed, 4 May 1994 f_griffith(a)ccsvax.sfasu.edu wrote: > >> Actually, there is no connection between the gold and our money. I.e. >> you cannot take US $ to Fort Knox (or any other government location) and >> get gold for it. >> >> This is why some posters have referred to "fiat money" - the $ is money >> because the government says it is. > >Unless of course you have a $ bill that is a specie note. I have a few ten >dollar bills that state that they are redeemable for specie. You'll have much better luck taking them to a numismatist than to Fort Knox. Specie notes are, to the best of my knowledge, no longer redeemable in specie. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Blum-Blum-Shub source?
by Urban Nilsson 17 Dec '03

17 Dec '03

Timothy C. May said something along the lines of: > > Of course, only Americans are allowed to use these random number > generators, and even they face fines of $500,000 and imprisonment for > up to 5 years for inappopriate use of random numbers. What inappropriate use is that? Inhaling? And what could possibly happen to me as a non-American? If some guys in black suits comes looking for me, I would be very surprised. Perhaps not for long, but never the less surprised... Urban Nilsson | Use 'finger' for PGP2.3a public key. d7urban(a)dtek.chalmers.se |------------------------------------- Chalmers University of Technology |A person is just as big as the things Gothenburg, Sweden |that makes him angry.

1 0

DOJ Clipper documents scheduled for summer release under FOIA
by gnu 17 Dec '03

17 Dec '03

As you know, there has been much debate about the Clipper Chip initiative, but relatively little hard information. John Gilmore, member of the board of directors of the Electronic Frontier Foundation, filed FOIA requests to numerous government agencies last April after the Clipper plan was announced. In June 1993, he filed a FOIA lawsuit against the Justice Department ("DOJ") and the Federal Bureau of Investigation ("FBI"). Gilmore v. FBI, et al, C-93-2117, U.S. District Judge Charles Legge, Northern District of California. As a result of this lawsuit, the Justice Department has agreed to a staggered release of some documents about Clipper and Digital Telephony. The Justice Department and Gilmore signed a joint stipulation and agreement on Friday, April 29, 1994, in which the Justice Department and several other federal agencies agreed to release documents over the next several months: a) DOJ's Office of Information and Privacy ("OIP") will transmit all documents recovered in its search for responsive documents that it has identified as requiring referrals or consultations to the appropriate agencies or DOJ components by May 31, 1994. OIP will complete processing of all documents that it has identified as not requiring referrals or consultations to other agencies or DOJ components by June 20, 1994. b) DOJ's Justice Management Division ("JMD") will complete processing of all documents recovered in its search for responsive documents, excluding documents which have been referred for processing to other agencies, by July 30, 1994. c) The Office of Management and Budget ("OMB") will respond to all DOJ consultation requests which OMB had received as of April 20, 1994 by May 20, 1994. d) The National Security Agency ("NSA") will respond to all DOJ consultation requests which it had received as of April 20, 1994 by July 18, 1994. NSA will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by July 18, 1994. e) The National Security Council ("NSC") will respond to all DOJ consultation requests which NBC had received as of April 20, 1994 by July 29, 1994. f) The Department of Commerce and National Institute of Standards and Technology (collectively "Commerce") will respond to all DOJ consultation requests which Commerce had received as of April 20, 1994 by August 7, 1994. Commerce will complete processing of all documents which had been referred to it by DOJ as of April 20, 1994 for direct response to plaintiff by August 7, 1994. The documents being processed by the NSC include the Presidential Review Directive and Presidential Decision Directive which started the Clipper initiative. We have been informed that NSC is processing the two final versions as well as 68 draft versions. We have also been informed that documents produced in the course of the OMB legislative clearance process for the Digital Telephony Bill are being processed. This should provide insight into how the government decided to proceed with this bill. We have also been informed that there are approximately 25 documents produced in the course of the government's solicitation of industry views on Clipper. Obviously, we do not know how much useful information will be released. It is probable that the documents will be heavily redacted. Given the recent directives from the President and the Attorney General that all possible discretionary disclosures of information should be made, we hope, optimistically, that these disclosures will prove illuminating. Unfortunately, the FBI is not a party to this agreement. We are in the process of attempting to obtain the release of about 3000 pages of FBI records. FBI has told the Court that it will be approximately 2 years and 8 months before it will even begin processing Gilmore's request, and that actual processing will take about a year, if not more. We believe that this delay is unlawful and cannot be countenanced. The FBI offered to complete its processing a year from when we sign an agreement; we believe they should process these documents in a maximum of six months (which would be a year and a half from our original FOIA request). Note that this processing time only includes their initial response to us; they will undoubtedly withhold many documents and parts of documents which we will contest the withholding of. This will take additional time, probably years. Because we and the FBI have been unable to agree, we have presented this controversy to the Court, and Judge Legge will decide what deadlines to impose on the FBI. The agreement mentioned above does not include NSA except to the extent that NSA is reviewing documents submitted to it by the Department of Justice. We also filed a FOIA request with NSA for all of its documents on Clipper, and have received no response after a year. We have an existing lawsuit against NSA's pattern and practice of delay in responding to FOIA requests. Depending on how that suit develops, we will take some kind of legal action to force them to respond. Lee Tien (Attorney for John Gilmore) and John Gilmore tien(a)well.sf.ca.us gnu(a)toad.com PLEASE REDISTRIBUTE IF YOU LIKE.

1 0

Re: Hiding data in gzip files (forwarded)
by sander＠ankh-morpork.hacktic.nl 17 Dec '03

17 Dec '03

kafka(a)desert.hacktic.nl (-=[ Patrick Oonk ]=-) writes: >The attached patches will allow you to hide information inside GZIP >compressed files. [...] >HOW IT'S DONE > >gzip uses LZ77 which compresses data by storing length/offset pairs >that refer back in the uncompressed data stream to previous >occurrences of the information being compressed. gzip considers a >length of 3 to be the shortest acceptable length. We allow gzip to >find the length/offset pairs and then do the following. > >If the length is at least 5 then we subtract 1 and set bit 0 to the >value of the bit that we need to hide. We have now hidden information >in the length without pushing it beyond a valid value. Drawbacks are >a slight decrease in compression (very slight) since we have to ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >disallow lengths of 4 and some of our meddling will decrease the >actual matched length by 1. The hidden file is totally invisible to >the normal operation of gzip, gunzip et al and (if encrypted) will >only be visible to those in the know. When the "-s" flag is not used >gzip performs as normal. Doesn't this mean everyone can detect that data is hidden by decompressing and recompressing? If the recompressed file is smaller, you know data was hidden and it can be extracted using gunzip -s. In contrast, data hidden in the LSB of sound samples or pictures cannot be detected. The reason seems to be that gzip compression is non-lossy, while most stego-tricks work by introducing a sight amount of noise-like `damage' to the data used as hiding place. You need to loose a bit information to make room for the secret data. So it's a nice idea but it doesn't really work....

2 1