December 2003 - cypherpunks-legacy

Re: Netscape the Big Win
by Peter Trei 17 Dec '03

17 Dec '03

TC May writes: > Frankly, one of the great boons of my current setup is that I can > completely get away from Unix tools and commands [...] >...my fingers are already forgetting the emacs commands! If I forget thee, O Emacs, let my right hand forget her cunning. If I do not remember thee, let my tongue cleave to the roof of my mouth; if I prefer not Emacs above my chief joy. (with apologies to the psalmist) Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Lotus AmiPro doc
by piff＠world-net.sct.fr 17 Dec '03

17 Dec '03

I was recommended to you by a friend who told me that you may be able to help me decrypt or suck the password out of a LotusAmiPro doc. Your help would be greatly appreciated. Please email back me as soon as you can find the time. Thank you.

1 0

Plan 9 OS (NewsClip)
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

AT&T Launches Plan 9 Operating System Murray Hill, NJ, July 19 -- AT&T has announced a new distributed operating system, called Plan 9. The new system was developed by some of the same people who created the Unix operating system, and the terms on which AT&T is making it available are reminiscent of Unix, but the company stressed that Plan 9 is not Unix. Named for the cult science fiction movie Plan 9 From Outer Space, the Plan 9 operating system is designed to work well on networked computers. It has components for "terminals," or desktop systems, for file servers, and for central processing unit (CPU) servers. Plan 9 is designed to deal with multiprocessing systems as CPU servers. It supports four major hardware architectures: Intel Corp.'s x86 line (including the Pentium chip), MIPS Computer Systems Inc. processors, Sun Microsystems Inc. SPARC chips, and Motorola Inc.'s 68020 and 68040 processors. During simultaneous press conferences in Murray Hill and San Francisco, connected by a teleconference link, Rob Pike, one of the Plan 9 developers, said the new system is meant to combine some of the advantages of Unix with some of those of low-cost hardware. "We basically started by noticing some things that we liked and didn't like about Unix and liked and didn't like about workstations," Pike said. Pike stressed that while Plan 9 borrows some ideas from Unix, it is quite different and is not compatible with Unix. He went on to say that AT&T does not expect Plan 9 to compete with major commercial operating systems such as Unix and Microsoft Corp.'s Windows NT. "This is not the next Unix," Pike said. It appears in fact that the most promising commercial market for Plan 9 might be in embedded systems. During the press conference, AT&T researchers and officials repeatedly mentioned the possibility that Plan 9 might be built into consumer devices and other intelligent electronic devices, an area where no standard operating system predominates today. AT&T plans to make Plan 9 available for commercial licensing to other vendors for an initial fee of $200,000, plus per-copy fees that will amount to 20 percent of the resale price of commercial software or two percent of the selling price of hardware with Plan 9 built in, said Paul Fillinich, marketing manager for AT&T's Software Solutions operation. Single copies of Plan 9 will also be available for research and educational use, but Fillinich stressed that the company will not provide technical support. "We will replace the media should it fail," he said. For commercial licensees there may be some sort of support in the future. "We are contemplating this," Fillinich said. "However, we haven't decided what the offering will be." Publisher Harcourt Brace & Co. will distribute Plan 9 for AT&T. The full package, including a CD-ROM, four diskettes, and two manuals, will cost $350. The manuals are available on their own for $125. Apparently wishing to avoid a repeat of the way Unix splintered into many different versions, AT&T is specifying that while source code for Plan 9 will be made available to research and educational users, any changes they make will become AT&T's property so that they can be incorporated in the base code. "We want only one Plan 9," Fillinich said. "We think the industry wants only one Plan 9." The minimum hardware needed to run Plan 9 is an Intel 386 processor with eight megabytes (MB) of memory and 40MB of available hard disk space, said Phil Winterbottom, another of the Plan 9 developers. An optimal arrangement would include a dedicated file server and multiple desktop terminals, he added. Further information about Plan 9 is available on AT&T's Plan 9 home page on the World Wide Web, at http://plan9.att.com/plan9/index.html. --

1 0

Re: Netscape the Big Win
by Hal 17 Dec '03

17 Dec '03

From: Adam Shostack <adam(a)bwh.harvard.edu> > Actually, it also supports Kerberos (not relevant to most of > us), and PGP messaging. Although a KCA would be needed before anything > useful came of the PGP support, at least its there. It appears that support for PGP messaging has been removed from the July 1995 SHTTP draft. So it's X.500 all the way. <URL:http://info.internet.isi.edu/in-drafts/files/draft-ietf-wts-shttp-00.txt> From: Steven Champeon - Imonics Development <schampeo(a)imonics.com> > The one "advantage" to SSL that they were pushing over SHTTP was that > SSL is a socket-level encryption mechanism, as opposed to protocol- > level. It doesn't conflict with SHTTP except in terms of adding to > the processing time. > > I guess I don't see why SSL is so awful from a crypto standpoint. > Could someone a bit more educated on the nuts and bolts clue me > in on its weaknesses? As compared to other schemes, perhaps? Frankly I don't think SSL is particularly weak cryptographically. It has gone through several revisions as various problems were pointed out. The one thing I would note is that there is considerable known plaintext being exchanged in the handshake. This helps with key guessing and will be the foundation for the SSL challenge that Adam Back is organising. IMO at least some of this material could have been sent encrypted with the public key so that an eavesdropper couldn't know it. OTOH this might have run afoul of the NSA's rules on export for at least the 40 bit version since you'd have more than 40 bits of secrecy in effect. SSL includes a 16 byte checksum with each packet. IMO this is overkill and wasteful for small packets. One thing about SSL is that it provides both secrecy and immunity to certain kinds of active attacks. These big checksums include a sequence number and key information to prevent replay attacks. For some purposes you might be satisfied with secrecy and not want to pay this overhead. I think a lot of the criticism of SSL was based on the thought that it would be obsoleted by the new IP secure protocols. That may be true eventually but SSL is here today, in use. Order something from Netscape and it is secured with SSL. Buy the domestic version if you want real security. For IP, many of us we will have to wait until the new IP protocols get built into our OS's and other infrastructure. People have also objected to the use of the X.500 certificate approach. But that seems to be de rigeur for any serious Internet standard these days. IMO the real solution is to come up with a PGP-like X.500 certificate maker so people can easily set themselves up as Certificate Authorities and go about their business while the anal hierarchy fans argue about liability. Actually I think there is a PD certificate maker around, possibily from Eric Young down under. Hal

1 0

Re: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "tcmay" == Timothy C May <tcmay(a)sensemedia.net> writes: tcmay> Integration of crypto into Netscape is thus the Big Win. tcmay> I felt this was the case as far back as last fall, but my tcmay> recent experiences tell me this is more important than tcmay> ever. Integration of PGP and other crypto routines into Tin, tcmay> Pine, Elm, Joe, Emacs, etc., is just not as important. Careful here. Deliberately or not, you are marginalizing the hard work of dozens of people, including me. You are suggesting our work should have been done for Netscape instead, a program that a) is not free software (FSF sense); b) has no mail reader; and c) has no extension language. Oh, and d) is horrendous as a news reader. The packages that you implicitly denigrate provide far and away the best interfaces to PGP available today. They are written with the tools available, whether it's a Windows shell, a hacked version of Elm, or an Emacs Lisp package. Maybe Netscape will include a mail reader someday. Maybe Netscape will include Java as an extension language someday. But until that day, the only people who can put crypto into Netscape are the folks at Netscape Communications. tcmay> IBM just paid nearly $3 billion for Lotus, largely for the tcmay> "common platform" of Lotus Notes. I believe Netscape is an tcmay> even more important common platform, and will displace Notes. Netscape is not a platform. It is a browser. It is only useful for viewing content that others have created, with a user interface that any idiot can use. Consequently, yes, it is very popular with the masses and will become more so. tcmay> The relevance for Cypherpunks interested in writing code is tcmay> that, in my carefully considered opinion, writing for Netscape tcmay> and other Web browsers is the Big Win. Even over Windows tcmay> (except Windows browsers, of course). Can you name a platform for which it is possible to write a PGP front end, but for which none has been written? If it is ever feasible to do what you suggest, someone will do it; your musings will have no effect on that. If you want to make a difference, try writing some code yourself... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6Rg3r7ES8bepftAQG4egQA2QFjXo5wgVOCtz2qGkgBbw80F4U80C1p d1noVQN95tFYc1vjgk0ftp8n5stURtuD6MEoHNoKDOQgCIzbPlEC9rIETAzW1kfd GTG8DzRqkcY1YqrTEnLoNiUswIfkVaquf9JrWNSuPKzLZ+IsUto1SxxNjk0fR7pf ou4k3Fo+3yQ= =BpNr -----END PGP SIGNATURE-----

1 0

RE: Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 3:18 PM 7/20/95, Pat Farrell wrote: >The current trend is to bundle all types of functionality into huge >monolithic programs. Add mail to netscape, add encryption, add ... > >Yet most of the computers people use are multi-windows, and soon most >will even be multi-tasking. > >Why are all-in-one programs so preferable to using the windowing >capabilities that are built into every X-window, Mac or Windows system? > >Why not use the best mail client, another best webcrawler, and yet another >news reader? Speaking for myself, consistency of user interface. To that extent, Netscape (or Lotus Notes, in a different context) becomes the "operating environment" for the user, the place where he does his work. The News reader in Netscape 1.1N is as good as the main "separate" news reader, NewsWatcher, for the Macintosh, and has some added benefits. For example, URLs in News postings automatically show up as clickable items, which can be jumped to immediately. (Other News programs _could_ do this, and maybe some of them do, but not on the Macintosh, at this moment.) >Microsoft has been preaching the use of OLE and component programs as its >development vision for 2+ years, Macs have been popular for ten years, >why is the trend still towards adding every possible bell and whistle >to single programs? I don't know why "componentware" has not taken off. But it hasn't. OpenDoc and OLE 2 are coming, but slowly. Big programs tend to grow because they can increase market share by adding capabilities, by pulling in more customers. We might prefer a world of smaller apps, with componentware pieces, but it rarely happens. And I'm not going to use half a dozen small programs, each doing slightly different things and having different commands, when one will do nicely. (I could list other pluses and minuses, a la my outline FAQ, but here's just one more important item: cross-compatibility. Namely, with N smaller programs in use, of varying versions, incompatibilities and even crashes can result all too often ("We have discovered that MailMuncher 2.12 does not work with NewsNabber 1.1."). At lest with something like Netscape, a certain amound of cross-operability is likely, for various reasons.) In any case, while I respect the views Pat is expressing, about componentware and "small is better" approaches, the market is voting with its feet for apps like Netscape, which are becoming the main programs folks will use for communication, News reading, and Web surfing. >With components, it wouldn't be hard to have a universal >Encryption/Signature module. It would get arround any propriatary >restriction that vendors may or may not try to enforce ("can Netscape be >extended or not" becomes moot). So go ahead and do it! I've been waiting for many years for such things. To state an obvious non-crypto use of such "modules," why do all major word processing and page layout apps have their own "dictionaries"? Why do I have to train the dictionaries of Word, Nisus, FrameMaker, MORE, etc.? That there have not been "dictionary modules," for many and sundry reasons, is telling. (Before anyone mentions it, one can on the Mac use things like "Thunder" instead of the local dictionaries...this is not the same as a module usable by all programs, but instead is a user choice to bypass the local dictionaries. We could quibble for hours about whether this is in fact a universal module or not. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

RE: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "pfarrell" == Pat Farrell <pfarrell(a)netcom.com> writes: pfarrell> Why are all-in-one programs so preferable to using the pfarrell> windowing capabilities that are built into every X-window, pfarrell> Mac or Windows system? pfarrell> Why not use the best mail client, another best webcrawler, pfarrell> and yet another news reader? The problem is that existing operating environments do not, in general, provide good facilities for the kind of tight integration you really want. Besides, there is nothing wrong with a monolithic application, as long as it provides a sufficiently rich extension language. Take Emacs, for example. Emacs is a monolithic application, but I use different Lisp packages to read news, handle mail, and develop software. (I occasionally even just edit text.) Moreover, I have co-authored a Lisp package to hook PGP functions into *every* Emacs mail and news package, without ever talking to the authors of those packages. In general, any package can be written to seamlessly integrate with any other. In addition, all of these packages work without modification on every variant of Unix, on VMS, on Windows NT, and sometimes even on DOS. I can write in beautiful (and safe) Lisp, and let the Emacs maintainers worry about the idiosynchracies of each operating system. The problem with Netscape currently is that all of their packages are *built in* by Netscape Communications. That is why they have no mail handler, and why their news reader sucks, and why it is impossible for any of us to fix these things or add a PGP front end. Java looks somewhat promising; with it, perhaps Netscape can become a platform-independent system for writing packages to manipulate and display hypertext. It would be like an Emacs for hypertext, but with a crufty extension syntax and no source code. And a user base 1000 times as large... pfarrell> Microsoft has been preaching the use of OLE and component pfarrell> programs as its development vision for 2+ years, Macs have pfarrell> been popular for ten years, why is the trend still towards pfarrell> adding every possible bell and whistle to single programs? These approaches suffer for two reasons. First, it's a pain to incorporate the same basic display code into every package. Second, it's a pain to rewrite the same basic display code for every window system. (Especially when "every window system" means Microsoft, Macintosh, and X.) Other subsystems than display have similar problems (networking comes to mind), but I think display is the major pain in the groin. What Netscape could do is provide the engine for hypertext display, with a sufficiently rich and simple extension language that it would be easy to write new modules. Someone would probably write a decent news reader. Someone else would write a mail handling package. Someone else would write a PGP interface. And so on. Netscape would need to provide other functions across platforms, like TCP sockets, but that isn't impossible: Emacs has done all of this (save graphical display) for over a decade. Gosh, we might find ourselves using 1980 technology by the year 2000. I don't know enough about Netscape's plans for using Java to know whether any of this is likely to happen. I'm not even sure I want to see it happen. But it would be interesting. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6aLHr7ES8bepftAQEIVgP9G8p4lV1+Uc+6cpLZW4hMF+k7CYYp2Jp6 xh0qZXW0Sd7STPn+sP/fGPvErauGTlDiyIoW5bTJ9srITtFN8U1Yr7QollQZPqUa 5Rhbu7LjFTmixpdo0wiDTuUiRObnoE4Pj+/27EiamEqG160TjGiHDyCodh/eyFWS 8+R/yT5RCPw= =pja4 -----END PGP SIGNATURE-----

2 1

Re: cypherpunk "Zen" victories
by Mike Calligaro 17 Dec '03

17 Dec '03

<Though I'm not on the list, I read Cypherpunks through the extreme filter of a friend who forwards all the good stuff to me.> Vladimir's post was very good. I only take issue with the last bit. <<So the next time that you rant about how some bill or another means the Death of the Net, or the police investigating a remailer means the downfall of cryptoanarchy, or a lousy article with a zillion distortions comes out, think again. The greatest cypherpunk victories are emerging through what would appear at first to be the "blackest" moments.>> So long as you remember that when these things come out we still need to scream and yell about them. The Rimm Job is not a victory simply because Rimm was crazy. It's a victory because many people took the time to criticize it and many others took the time to inform the masses of that criticism. These attacks may go in our favor, so long as we direct them in the right direction. There's something Zen in that as well. Don't punch your charging opponent. Instead misdirect hir energy a bit and let hir run into that wall behind you...

1 0

Re: cypherpunk "Zen" victories
by Rich Salz 17 Dec '03

17 Dec '03

The Boston Globe has a weekly "magazine review" column. In yesterday's column they wrote about the Rimm piece, Time's followup, how the Internet got the story right, and fast, and how HotWired has a really good page on it. The column then reviewed the current Wired and said the magazine is now behind the times. In particular, contrasting it to the second(?) issue, "when they covered the Cypherpunks (sic) and their privacy agenda."

1 0

Re: Java (was Netscape: the big win)
by cman＠communities.com 17 Dec '03

17 Dec '03

>Does anyone here have any figures on how much memory Java takes up >when running its typical tasks? > These are real ball-park figures based on looking at "free memory" from vmstat from several instances of launching, running, then exiting from the listed programs: Java compiler (written in Java), compiling big program: 2.5 MB HotJava browser (written in Java), after running some applets: 4.0 MB "Hello world" Java program (no GUI): 800K

1 0