December 2003 - cypherpunks-legacy

Let Me Repeat, the Raids Must Be Stopped! A PROFOUND THREAT TO FREEDOM OF SPEECH ON THE INTERNET
by syrinx＠c2.org 17 Dec '03

17 Dec '03

PLEASE FORWARD TO ORGANIZATIONS AND INDIVIDUALS SUPPORTING FREEDOM OF SPEECH ON THE INTERNET AND TO CIVIL LIBERTIES GROUPS. As many of you may know, the Church of Scientology (CoS), represented by the Religious Technology Center (RTC), whose primary function is to defend their copyrights and trade secrets, performed their third raid/seizure today against an Internet user for alleged copyright infringement. The prior two were against Arnie Lerma last week, and Dennis Erlich back in February. This raid was against FactNet, an organization dedicated to public awareness of various groups it labels as 'cults', including the Church of Scientology, and one of its leaders, Larry Wollersheim. [It is interesting to note that CoS owes $4 million to Larry Wollersheim based on an award by the courts, and affirmed by the Supreme Court. CoS has refused for whatever reason to pay this judgement, and did very questionable moving of assets out of California to avoid paying. Wollersheim has currently deposed the leader of CoS, David Miscavige, to ask him in court what happened to the assets of the California branch of CoS. Mr. Miscavige went into hiding over a year ago and so has not yet been served with this subpoena.] This raid and seizure is technically allowed under current U.S. civil copyright law when certain conditions are met. Congress originally allowed such raids to deal with copyright infringement involving bootleg material, where seizing the equipment used to produce the bootleg materials would effectively halt production until a court could assess the claims of the copyright holder. I am not sure if the Constitutionality of this law has been ruled upon, but in my opinion it oversteps the bounds of the intent of the U.S. Constitution regarding the bounds of search and seizure. Congress passed this law allowing seizure (in 1976) well before the advent of computer networks. The rationale that CoS used in convincing a judge to issue a Writ of Seizure is that seizing the computer equipment will halt the continued duplication of the copyright material, allegedly in violation of the rights of the copyright owner. This rationale does not hold any water when considering the Internet. Once the material is electronically disseminated on the Internet, seizing the computer equipment used to disseminate the material, as well as copies of the material itself, serves no useful purpose to stop the continued dissemination of the material. For example, the perpetrator of the alleged copyright infringement could, if they want to, simply purchase/rent/use a computer with Internet access, copy the material from another site on the Internet (which observation shows exists all around the world regarding the CoS materials), and redisseminate it as before. The only effective remedy is a Temporary Restraining Order (TRO) and a lawsuit against the individual ALLEGED to have infringed on the copyrighted material in excess of Fair Use. Thus, these three raids by CoS were clearly unnecessary. Furthermore, regarding civil liberties, they are even more troubling. In all three raids, the entire computer, related equipment and tapes were seized by CoS for their erasure of the alleged copyright materials, but without ANY court oversight which would filter out data which has no relevance to the matter at hand and which is protected by the right to privacy and other protections. There may also be further protection under the Electronic Privacy Act (or whatever it is called). A lot of private data from many people, not related to the alleged copyright infringements, may have been compromised. Furthermore, these raids serve to stifle Free Speech on the Internet. In essence, CoS is saying to the Internet community: "If WE feel you are disseminating our copyrighted materials in excess of Fair Use (and we will define what Fair Use is), then we will get a Writ of Seizure allowed under U.S. copyright law and take away your computer BEFORE the court decides on whether you exceeded Fair Use." And if much later the court determines that the dissemination was done under Fair Use, then there is no "effective" and "practical" remedy other than filing a laborious and expensive countersuit, which could drag on for years, to the detriment of the individual originally accused of copyright infringement. CoS knows this, and thus they really don't fear the consequences if they overstep their bounds in this matter. And who wants CoS to plaster the Internet and the newsmedia with their propaganda stating that "Federal Marshalls Seized the Computer of John Doe"? We all know that the general public may see John Doe as some criminal of the first order because Federal Marshalls were called in to handle the matter. This also serves to stifle Free Speech. Thus, we must call upon Congress and the courts to fix this "loophole" allowing these unnecessary and, in my opinion, unconstitutional raids/seizures of computer equipment for alleged *civil* copyright infringement in excess of Fair Use. This "loophole" is a clear threat to Freedom of Speech. I call upon electronic freedom activist organizations, such as EFF, and more traditional civil liberties organizations, such as the ACLU, to do something to stop these raids. I think asking a Federal judge to put a *temporary* halt on all such raids pending Federal court review on necessity and constitutional grounds. In addition, we should call on Congress to amend the copyright laws to take into the special aspect of computer networks so as to not allow the trampling of civil liberties that we've seen with the barbaric CoS raids. If you agree with me, do forward this to your Congressperson, to anybody you know involved in civil liberties issues, religious leaders, etc. Become aware and concerned. If you live in the U.S., you could be the next person raided just for exercising your right to Free Speech. Thank you for listening. Jon Noring **************************************************************************** For more information on the Scientology versus Internet "war", check out both alt.religion.scientology on Usenet, and the following Web site, which has links to nearly all Web pages devoted to the Scientology issue: http://www.cybercom.net/~rnewman/scientology/home.html **************************************************************************** -- OmniMedia | The Electronic Bookstore. Come in and browse! Two 9671 S. 1600 West St. | locations: ftp.netcom.com /pub/Om/OmniMedia/books South Jordan, UT 84095 | and ftp.awa.com /pub/softlock/pc/products/OmniMedia 801-253-4037 | E-book publishing service follows NWU recommendations.

3 2

using perl-rsa
by Adam Back 17 Dec '03

17 Dec '03

[managed to type kent instead of keng this time, touch typist and not watching the screen either]. Kent Crispin <kent(a)songbird.com> writes: > [...] > > >print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> > >)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` > > BTW, how do you use this code? I'm not a big "dc" user, I must admit. You first of all extract your a PGP key with pgpacket. (You'll need to change the password to be no password (press enter when prompted for password), so that PGP doesn't encrypt the private key. Next, you can do: % perl rsa.pl [e] [n] < plaintext > ciphertext % perl rsa.pl [d] [n] < plaintext > ciphertext to encrypt and decrypt. Here's a small example (Fred is a notional eternity user who's key, both public and private is included in the eternity distribution): Fred's public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQBNAzPfUPsAAAECAMn6jtL3ZNjmBrkDLIktHNmBGc+a59BSvFPN8howj5zAj1U8 5QOfVtV4kOliK2AkCcL2yyz3Wz+AHiYdVyuQJF0ABRG0FEZyZWQgPGZyZWRAZXRl cm5pdHk+iQBVAwUQM99Q/B4mHVcrkCRdAQECQQH/YZqss3VQZwZi5KfylAzFOnz8 /pXOSh8Rf9pTsF2TbsAKIK4xL9PzYoicy/KAZdIN+AJO8dX/xY0a1v5A8xobeg== =iWoN -----END PGP PUBLIC KEY BLOCK----- Fred's secret key (no password): -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.3i lQD4AzPfUPsAAAECAMn6jtL3ZNjmBrkDLIktHNmBGc+a59BSvFPN8howj5zAj1U8 5QOfVtV4kOliK2AkCcL2yyz3Wz+AHiYdVyuQJF0ABREAAfsEPkWwiGybJRn00/dB RLZjOZHAmMRVDH6UC9si+GpHDsOs5/eLbK6GUqmbWXG4I4LadxRQz/nplQ+lCVYP ecrbAQDixLjtXlj9ks1e9ZcroU71Pvk84oQjpUhiU1rAIkKh9wEA5APIvVJETEjm DxEpdE6hJkty+nb6v8VNOYlslo8Ol0sA/iwRycjjcNs4A2c9Owt+xLCiMp2JIb0z yf7d4xEcLI1vUXG0FEZyZWQgPGZyZWRAZXRlcm5pdHk+ =CHwS -----END PGP SECRET KEY BLOCK----- (to extract public key do: % pgp -kxa fred fredpub ~/.pgp/pubring.pgp and to get private key do: % pgp -kxa fred fredpri ~/.pgp/secring.pgp ) Next get pgpacket.pl, see ftp://ftp.ox.ac.uk/pub/crypto/pgp/utils/ or something like that. Then run pgpacket on the fredpri.asc (it contains all the info that you want, without looking at fredpub.asc, ie the values for e, d and n): % pgpacket fredpri.asc The values for e, d, and n are: e = 11 d = 043E45B0886C9B2519F4D3F74144B6633991C098C4550C7E940BDB22F86A470E C3ACE7F78B6CAE8652A99B5971B82382DA771450CFF9E9950FA509560F79CADB n = C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC0 8F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D Now you can encrypt for fred like so: % echo hello world | perl rsa.pl 11 C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC08F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D > hello.rsa % and to decrypt: % perl rsa.pl 043E45B0886C9B2519F4D3F74144B6633991C098C4550C7E940BDB22F86A470EC3ACE7F78B6CAE8652A99B5971B82382DA771450CFF9E9950FA509560F79CADB C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC08F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D < hello.rsa hello world % Now dc can do modular exponentiation like so (reverse polish notation): dc> m e ^ n % but that's going to take a long time because it will evaluate m ^ e and then do mod n. So the clever thing that the program does is to implement Knuth's modexp algorithm which reduces the work factor immensly. Actually GNU dc 1.1 (distributed with GNU bc-1.04) now includes "|" as a modular exponentiation operator, so you can do: "m e n |" and it'll do it directly. This feature was a special, just for perl rsa because Ken Pizzini, author of GNU dc, happens to be one of the major contributors of hacks to shorten the perl program, and so have a vested interest. With the dc 1.1 | operator, Ken got the script down to: $/=$z;exec"dc -e'16i0[lN*lMlKlN|+lMlN/dsM0<J]dsJ\U@{[ pop,pop,unpack'H*',<>]}\EsMsKsNx[II*~aSad0<ZLaP]dsZx'" a considerable improvement over: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` > I dug out a midi interpreter I wrote a number of years ago, > and it is indeed trivial to modify it to read any text as input. > Unfortunately, I wrote that long before the midi file spec was > finalized, and the hardware I wrote it for is also long gone. But > it's probably not much work to get file output working again...and > the thought of a general text-to-midi translator is rather > entertaining -- I could play this entire mail message through it, for > example... It would definitely make better music if some rhythmic > variation was part of the coding, but that would make it a little > harder to make an automatic decoder... I'd find it most cool to hear an audio file of the above. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

4 4

Re: The sorry state of non-US crypto
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

There are also some links on http://iaks-www.ira.uka.de/subjects/crypto.html to ftp-servers with cryptographic stuff outside USA/Canada. The page contains several crypto-related links and is written in german language, but the ftp links at the end of the page are language-independent. Hadmut

1 0

Re: Attila T. Spammer / Re: Denning questions/reverses her position? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Attila T. Spammer / Re: Denning questions/reverses her position? > From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > Date: Fri, 01 Aug 97 09:18:19 EDT > I'm pretty sure she still supports the right of a corporation to > tell the users of corporate systems not to have anything on those > systems that the corporation can't decrypt. And why wouldn't you? Let's look at this a moment. 1. Business, irrespective of size, is not equivalent to the government and specificaly isn't mentioned in the Constitution at all so we are reasonably safe they are exempt from federal compliance with its requirements outside that detailed for citizens and regarding inter-state or international trade. 2. The relationship between employer and employee is one based on a contract. 3. Neither party is forced beyond their own needs and desires to sign the contract. 4. Each party is aware of the contents of the contract before they sign it, or at least is given the opportunity to be made aware. If somebody wants to sign a contract with no knowledge of its contents, so be it. 5. Who owns the computers? The business does clearly. Now a commen proviso on ownership is that the final decision, or the transfer of that decision, is up to the business. Just as it is ultimately up to you who gets to drive your car. 6. Most provisions of employment contain the proviso that the time you agree to work for that employer is to be spent on dealing with the employers needs and not the employees. This is after all at least one of the reasons behind using time off and floating holidays and such. 7. Provided the employee is aware of this policy at the time of signing OR is given a reasonable warning period before a shift of policy after hiring then the employee has no grounds to complain. Myself, I always ask my immediate supervisor for a description of company policy on this. I also always ask if they have an objection to me using the company system to log into my home system during lunch and other 'off-clock' hours. So far I have never been refused. Short answer to this, use your own resources for your own use and don't use other peoples resources to carry on your own activities unless you offer them a cut of the profit. Ultimately this isn't even a question of contracts but of simple plain ol' every-day manners. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: True Names and Webs of Trust
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

BW> Be that as it may, I still think that Zimmermann assumed that BW> key<->real-life-identity mappings would be the primary purpose for the Web BW> of Trust when he wrote "pgpdoc1.txt". And I think he was wrong about that. BW> It is not "arrogant" or "offensive" to say that someone was wrong when you BW> believe that to be the case. Actually, this is what qualifies as a "wicked problem". Until pgp 1.0 came along, there was no way to know how people would =actually= use a public-key system. (Sure, there were lots of theories, and a few academic experiments, but those don't count as RL.) Phil tried to anticipate the kinds of errors that would be made by people unaccustomed to thinking in terms of attacks and threat models. Face it, the average.net.person is not into game theory. Phil was under severe time pressure to get a workable public key system out the door before the government slammed it shut in his face. Now that we have had an opportunity to observe people using the system, we can identify nuances that could never have been debugged on the test bench. We can explain to people the various paradigms for viewing keys, and the importance of being able to trust the "identity" of an anon.id, which seems oxymoronic on the face of it. Some kind of explanation by analogy seems in order: We all know of movie stars who changed their names for Show Biz, or authors who wrote under pseudonyms. Take Mark Twain for example. A person who had read a Twain book, or had friends (his own WOT) tell him how good/bad Twain books were, would develop his opinion of the man's work. His ultimate decision to (not) buy a particular Twain book has nothing to do with the True Name of Mr. Clemens. Where it =does= come into play is in the realm of law. Had Twain libelled a person, the means to identify the Man behind the Mask would be integral to executing the judgement of the court. And even then, if there were sufficient continuing royalties that could be attatched to satisfy the judgement, it would only be necessary to know the True Name of the publisher. So we must be very careful of what it is that we are certifying when we sign something. This is what needs to be addressed in future versions of PGP. * Free the Wisner Five! * Free the Wisner Five! * Free the Wisner Five! --- * Monster(a)FAmend.Com *

1 0

One effort for Internet Privacy
by Chris Avery 17 Dec '03

17 Dec '03

On a lark, I dashed off a "letter to the editor" of the San Francisco Chronicle, quoted below, lo and behold it got published today. You will see I simplified and softened the message somewhat -- a little spin for the good guys never hurt: (published as lead letter, nice headline) "HOW FAR SHALL WE LET THE EAVESDROPPERS GO?" Editor -- Washington wants the right to "wire-tap" private communications on the Internet, and the issue is now being debated in Congress. I'm not raising the "content" issue, which can be handled by screening software or by ratings; this is instead the issue of privacy in person-to-person communications. The rationale for the bills before Congress is law enforcement, giving officials new methods to detect criminal activity. All well and good, but is it really wise to grant the bureaucracy access into this vital channel of personal communications before we fully understand its potentials? How far shall we let the eavesdroppers go? Beware, these aren't casual issues --- your rights are in danger. CHRIS AVERY Oakland

1 0

Spooks and Hackers, etc.
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: Internet Police According to an AP story, Wisconsin Attorney General James Doyle says that police must monitor the Internet to stop child porn, drug trafficking, and fraud. "We need to see that police are surfing the Internet just as other people are," Doyle said. "This is a good example of where the law is slower than technology." Doyle made his comments in a speech to the Wisconsin Chiefs of Police Association Conference.

3 2

Fraud Control
by promotions＠web-promotions.com 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message has been sent by Web-Promotions.Com and adheres to all North American laws pertaining to Bulk Email. If you would like to be removed from future mailings please respond back to the sending address and put REMOVE in the SUBJECT BOX. Placing the word remove in any other area of the email may go unnoticed. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----------------ALERT TO ALL WEB MASTERS--------------- Are you the victim of fraud? You may be being lied to by so called Live Video Feeds. Get what you paid for. 100% live video feeds. Not 12 hours live, 24 hours live all the time. Get Itslive feeds. They are LIVE LIVE LIVE!!! Samples at: http://www.linkitslive.com/candy user: live pass: demo Itslive offers more live 24 hour feeds than anyone else on the planet. But it does not stop there. We have hard core digital feeds too. Check out these new summer prices for unlimited feeds for your site. $400 Hard Core feed (Asian, Young, Lesbian, Anal, Oral, Inter racial, and Gay) $450 Digitized Itslive feed $950 24 hour Live Itslive feed Hundreds of packages available, see why top sites like Net babes, Pink Bits, and Webs Youngest Women use Itslive as their one stop Video Shop. ---------NEW***NEW***NEW--------- Personalize your site with our Sweetheart Program http://www.linkitslive.com/sweetheart To sign up or ask any questions mailto:Candy@Itslive.com Candy Roberts Itslive Direct Sales 3i Inc 800-555-8852 or 214-658-1520 Fax 214-658-1507 Candy(a)Itslive.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message has been sent by Web-Promotions.Com and adheres to all North American laws pertaining to Bulk Email. If you would like to be removed from future mailings please respond back to the sending address and put REMOVE in the SUBJECT BOX. Placing the word remove in any other area of the email may go unnoticed. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: spam is good for you
by Alex de Joode 17 Dec '03

17 Dec '03

Zooko Journeyman sez: [..] : In other news, I'm going to HIP : and I'm thinking I should have a t-shirt made to piss off the : self-righteous socialist anti-spam activists. My favorite : slogan so far is "I may disagree with every spam you send, but : I will defend to the death your right to spam it. --Voltaire". Hehe, bring me such a T-shirt *g* : I consider this to be a powerful meme to broadcast at those : low-tech lawmongers, but it isn't sufficiently.. um.. offensive. : Any suggestions from the peanut gallery? -- -aj-

2 1

Re: Linux brutessl client
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> I've been able to compile a working brutessl 1.02 cllient under linux > and gcc 2.7.0, but I get abysmal search speeds. > > My system is a pentium 60, which, according to the docs, ought to have > a speed of something over 14100 kps (that's what a 486dx2/66 with no > rotate left macro gets). > > brutessl -t reports that my system can do 11200 keys per second. <snicker> I only get 5900 keys/second on a SPARCstation 5:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1