December 2003 - cypherpunks-legacy

Re: Encrypted Magazine Subscriptions Via E-Mail?
by Michael Sattler 17 Dec '03

17 Dec '03

>>>why Wired ... don't [use PGP] to make subscribing easier? >> >> Because if you saw the low-tech state of the Wired office... > >Yup, too busy to automate. After all, if they took orders by email, >they wouldn't need manual intervention. It all makes perfect >sense. Why spend effort to lower the amount of time their staff need >to spend on manual tasks? Makes more sense just to remain buried. That a bunch of their staff is the minimum-wage "gee, look at my Mac" crowd might have something to do with it. I was amazed to find out that there really are two sides to Wired: the professional computer geeks (eg. Negroponte) and the professional get-a-magazine-out geeks, and the twain never seem to meet. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

1 0

Re: Remailer Specs
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >ftp myriad.pc.cc.cmu.edu /pub/remailer >ftp cs.cmu.edu /afs/andrew.cmu.edu/usr12/mg5n/public/remailer Thanks for the sites, but after looking at them, I can say they will NOT build in THINK C. But, They might help me figure out what to do with Remailer (the Mac version I'm building). Also, I'm not writing mine in C, I'm doing it in Pascal, because 1) I have the TCP libraries for it and 2) I don't now C very well at all. -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLyrN9UiLvmPjc4XdAQHeuAP/djk9XYKP3YmfdluJN8hMkNajetRAjKVK i0AvDyMUjN0fs5MXfez6v8tBx65qeWY0WIi8O53O5UzS7JOtiKNF4uLbDfJZiYRW okgdCutn6l4nHxz7MiNNCo1TXvMvPyYffy+cdPuRwX7IzfxdfaVHqD14e/x+S3Cs cy9zpuCnho0= =cDiR -----END PGP SIGNATURE----- aka: (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's February 8th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) PGP block.

1 0

Re: Encrypted Magazine Subscriptions Via E-Mail?
by Michael Sattler 17 Dec '03

17 Dec '03

>I posed this question in alt.wired. Am I missing something obvious as to >why Wired (or magazines in general) don't do this to make subscribing >easier? Because if you saw the low-tech state of the Wired office you'd understand; they're at capacity just opening envelopes and manually entering names and addresses off the checques. Visit them whenever you're in downtown San Francisco. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

2 1

Re: NNTP archives
by Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Michael Froomkin writes: > I would like to use it to read c'punks in netscape. what do I put in > the box which says NTTP news reader? just putting the machine name seems > to produce no result... Not knowing netscape, I couldn't tell you. The newsgroup name should probably be in there, tho: it's hks.lists.cypherpunks on nntp.hks.net. The URL might be something like "nntp://nntp.hks.net/hks/lists/cypherpunks" or "nntp://nntp.hks.net/hks.lists.cypherpunks", but I'm just guessing. - -- Todd Masco | "If we don't make utter fools of ourselves from time to time, cactus(a)hks.net | we grow smug - that is, we do not grow at all." - T. Peters Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLysYkSoZzwIn1bdtAQGEXgF/QzfXQmikP3AGwXBjJaUPPXPDpmy8dlVM NDcjQbtG125EIoBXGLa9GR6dfrp4HhBy =fGHU -----END PGP SIGNATURE-----

2 1

alt.religion.your.operating.system.sucks
by Joe Turner 17 Dec '03

17 Dec '03

I mean no disrespect, but the attrocities commited by the aged masters who wrote most of the operating systems are well documented. I have run into this line of thinking in many occasions (my <insert compiler or operating system> is better than yours...), although it it seems to be more of a sore spot to those who love thier compiler/ interpreter. Most of these observations are made out of ignorance. I get paid for programming under NT, windows, MS-DOS, VMS, RSX, and UNIX, not insulting the designers or users. Additionally, I deal with other people in other companies who love thier AS/400s and IBM mainframes. Hell there is even several programmers here who go misty-eyed everytime the word Amiga is mentioned. I bet there is even someone out there who believes that he/she could write a GUI operating system in COBOL (if someone has accomplished this I would love to see the punch cards...). UNIX is a programmers environment. It is very flexible, and you can do just about anything you want to, provided you have the ability. Spawning processes and child processes are trivial, and much more efficent compared to windows-NT and VMS. Additionally, I don't know of too many operating systems where the source code is floating around. I mean so what if it doesn't come with a pretty shrink wrapped package and a thick getting-started, if you have a question just go find the source code. Geez. And as far as a GUI, most of my work revolves around plain old ASCII. X windows may be "standard" now, but it didn't stop SUN, DEC, etc., from making their own proprietary (errr.. I mean "optimized") versions. I don't know why there is so much whining about: - My GUI interface sucks - Your GUI interface sucks - Your mother's interface sucks. I see no reason to puke up this garbage other people. VMS is more secure (interlock intrusion detection, etc.), but any operating system is only as strong as its users/administrators. The one thing I do not like about VMS is the way the system libraries are structured, but such is life. I was not consulted when DEC was designing the operating system. Thier Xwindows system needs some work, but it does work. NT is cool (if you are running on a 300MHz Sable). I think it is something special when you can run UNIX, Windows, and OpenVMS applications simultaniously on the same box. Can your operating system do that? Hell, for $3500 you can by a 166MHz alpha that will do this. System 7 is great. I just didn't like it. I didn't like the way I was isolated from the hardware, forced to take what the designers thought I needed. Just my preference. Besides, Apple equipment was, and still is overpriced (I should know I used to own several). Windows isn't a true multitasking operating system, and besides its like the old joke, Q: "how do you turn a 486/66 into a 286?" A: "run windows!". But like it or not, it is here to stay. I do like programming under windows over dos, simply because it is a pre-emptive operating system and forces the programmers to write structured code (for the most part) to intercept the messages. But the serial driver code sucks. PDP-11/RSX. Ewwwwww.. MS-DOS. If you want to write fast graphics, assembly is the way to go. Windows just can't keep up. Sure Micro$oft released win-G, but what's the point. Your operating system is so much better than mine are, as is your keyboard, your mouse, etc., My point is that every operating system, programming language, or whatever has benefits and detracting points. If you want to continue this discussion, I will be more than happy to create a list for it,.. then you can rant until you fingers are bloody. -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597 Finger for PGP KEY.

6 7

Re: Protocols for a Data Bank
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 4:39 PM 1/28/95, jpp(a)markv.com wrote: >> Date: Sat, 28 Jan 1995 15:49:13 -0800 >> From: norm(a)netcom.com (Norman Hardy) >> [...] >> Selling Hat Checks: The bank will sell a hat check to anyone who will pay a >> negotiated price. The hat check specifies the secure hash of the data, the >> penalty to be paid upon failure to produce the data, and the cost of >> redeeming the data. The hat check is signed blindly by the bank and is a > ^^^^^^^ >> bearer instrument. Any holder of a hat check can present the check along >> with the redemption fee and demand the data. > > Why in the world would the bank want to sign blindly? The bank >would be undertaking an obligation of an unknown nature. Would you >sign a blank check? A blank contract? I wouldn't. .... You are right. I forgot that the blind signer knows nothing of what we signs. The protocol requirements seem clear but I lack a protocol. I think I have a fix but I will be more careful before I post.

1 0

NNTP archives
by Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If anybody ever actually uses the cypherpunks archives via NNTP on hks.net, please let me know immediately (we don't log). I'm probably going to be putting a reasonable expire time on the group and archive the articles at expire time: if people use it, I can set up a "cypherpunks archive group" for NNTP access. This won't affect folks who use the NNTP access to read cypherpunks normally: I'll probably set the expire time to something like a month. -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLyrP8ioZzwIn1bdtAQF0VQF9HSyCQDkeUMiso29z3TOJY4cuj6EQdjq1 JpRBSoM35ZOfKcTQ2qSIvn6WvLk56pZD =RAyu -----END PGP SIGNATURE-----

2 1

Again, where to upload code?
by Robert Rothenberg 17 Dec '03

17 Dec '03

I posted this query recently with no replies, then again it's not been "duped" back to my account either, so I'm not sure if it went through. I've written some fingerprinting code for MD4, MD5, SHA, RIPE-MD and HAVAL in assembly language for 386 machiens and would like to make it available, not sure of an ftp-site... pref. ITAR-safe or are those algorithms not covered under it?

3 4

SHA Reference?
by perry＠imsi.com 17 Dec '03

17 Dec '03

Does anyone have the FIPS reference for the latest SHA? I'm writing up the SHA-AH document and I find that I don't have such a reference -- the best I've got is "Proposed Federal Information Processing Standard for Secure Hash Standard", Federal Register, v57, n21, 31 Jan 1992, p. 3747-3749 And I know that this has since been corrected. Perry

5 4

Why encrypt intra-remailernet.
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Suppose Alice sends Bob a message e(M) through Chaum. Eve, a stong opponent, wants to trace the message. She keeps track of all outgoing mail from Alice, an MD5 hash of all incoming messages to Bob, and outgoing from Bob. Eve then sends Chaum e(M), and waits for a matching MD5 to Bob that doesn't correlate to an outgoing MD5 from Bob. (Eve knows that Bob is a remailer.) (Thanks to whoever came up with Eve. I'm embarassed that I didn't think of that trick.) Clearly, this generalizes. Gentlemen, I believe that I have just stumbled upon a strong proof of the necessity of remailer auto-encryption of all messages. Since the session key is PRG, MD5 will change (a lot;). Furthermore, remailer auto- encryption allows the mailers to number their messages to each other. A low number means a re-transmit from the remailer, which is not possible, unless some sort of ACK system is in place, and even then, would still flag. Of course, if the remailers _sign_ their messages (on the way out) as well, you could compare the timestamps of the signatures with the message itself. - --- I also believe that the spammed remailer attack reveals another important weakness: if 50% of all mail leaving Alice during one tick goes to Bob, then Eve can gain probablistic information about the messages that Alice recieved, when attempting to trace a message through the net. This "attack" suggests a rational use of garbage: 1) A remailer always sends at least as many messages as it recieves, _including junk_. This means that you don't have a system "mysteriously" recieving 200 messages, and sending eight. 2) A remailer always sends at least n messages per tick. (n may vary between remailers.) If a remailer has very low traffic, that traffic is still protected. 3) On a given tick, a remailer always sends the same number of messages to each other remailer. This eliminates the effectiveness of a spam hit on a remailer of an old message. 4) Designated users of the net receive the same number of messages from each remailer each tick. (Such users probably _send_ the same number of messages each tick, as well. Note also that if some remailer is untrusted, that will be reflected by its always being sent garbage.) This puts the users "inside" the net. No, these axioms do not blow up the amount of garbage. New messages to the net displace garbage, unless they raise the maximum for the number going to a particular remailer. This system also has the advantage of _immediately_ fully integrating any new remailers. New remailers don't have to build up their users in order to be secure. - --- By combining these two, I believe we can turn the remailer net into a black box, including designated users. A communication should be safe if either end is in the black box. I believe that "PGP only" is the only way that remailers will be able to fulfill their potential. It should also increase the base of PGP users. - --- I nominate the phrases "Execute plan X.", "I have the soveineers.", "Your fried chicken is ready.", and "The NSA is a bunch of idiots." for garbage. If they ever attempt to prosecute, the have to reveal that they broke IDEA or RSA to X digits. ___ Note that the maintainence of an MD5 log of all messages by recipient by the remailers can be used to kill primitive spam/bombs. "PGP?" "ITAR!" "Oh, RKBA!" |--------------------------------------------------+ ----------------- 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> ) |44B3D866 3D551E2E --------------------------------------------------- |F89222A6 338CDE24/ | ----------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyrUVnmgMs8UcStNAQH18wf/a4SSoew9TJeaLsGWg+rL6wqm2RStrdFI XOULDD7e1yaYLBaovSz8BeNgHgW1UUAiKWWsl4rmVQ+QI1u2Oprgzo/mGy5qa1Bv i2GK9yjRleypn06fOf9kS7lr8ACO71m+1L/HPz+NBlPCgg6hCaWSJfoJkSQ1cHYi 5SHCvn/s/zLypgxcbDNqDF3eBMgpYokhFFyoTeD8LfNEtqQB/EGOwMlsik9YaKGg 5djDfDBucRsWy1a7H9G/BPejacA7PsIBKIIjbsQbxqCIczjzPR75j69ypM1IAtow kCwq6KH4d9dyKPaB5Q564LsDiEkrift+84/rADro6L5ppi4GG4PFmQ== =NgpM -----END PGP SIGNATURE-----

2 1