December 2003 - cypherpunks-legacy

E-Commerce Report
by John Young 17 Dec '03

17 Dec '03

7 August 1997, Business Wire: Businesses will spend $31 billion on Electronic Commerce-related software, hardware, products and services by the year 2001, according to Bill Burnham, senior research analyst at Piper Jaffray Inc. That's one of the conclusions Burnham draws in "The Electronic Commerce Report" released today. The first comprehensive study of the rapidly emerging Electronic Commerce industry, Burnham's report outlines how this spending threatens to topple many of the existing structures underpinning the economy. The 250-page document provides an in-depth examination of five separate areas of the Electronic Commerce industry: Internet Security, Electronic Payments, Financial Software, Business Commerce Software and Commerce Content (Internet-based retailing). The report includes projections for revenue growth, size of the electronic bill payment industry, number of electronic bill presentments and the number of commerce-oriented Internet sites. Some of the report's most significant findings include: -- Implementation of the Secure Electronic Transaction (SET) standard for Internet credit card transactions may be delayed due to compatibility and processing problems; -- Increasing concentration in the electronic payment sector will lead to the "death" of the current payment system. The Internet increasingly will be used in lieu of payment networks currently run by organizations such as Visa, Mastercard and the Federal Reserve; -- An estimated $228 billion in goods and services will be bought and paid for over the Internet in 2001. The consumer-to- business market will account for $26 billion in purchases while the business-to-business market will account for $202 billion in purchases - eight times larger than the consumer market; -- The Electronic Data Interchange (EDI) industry faces an increasing challenge from a new Internet-based technology called Direct Data Internet (DDI). DDI eventually will battle with the EDI industry for control of the business-to-business market on the Internet; -- Intelligent Agents -- software programs that automatically shop on behalf of consumers -- will eliminate the advantage enjoyed by firms with well known consumer brands; -- Banks and technology firms such as Microsoft and Intuit are heading towards a confrontation over the creation of so-called "Integrator" sites on the Internet. These sites are destined to become a consumers' gateway to the Electronic Commerce industry; -- The Internet security industry will grow from $525 million to $2.7 billion in the next five years. However, this industry will face constant threats from large technology firms such as Microsoft and Cisco Systems, who could destroy the industry by embedding security features into their products. "Too many people have confined the concept of Electronic Commerce to selling trinkets over the Internet," Burnham said. "But Electronic Commerce goes much deeper than that. Over the next few years we will witness a series of battles between firms that hang on to the traditional ways of doing business and those that embrace and capitalize on the rise of Electronic Commerce." Copies of a six-page summary or the entire 250-page report are available upon request. For more information, contact Piper Jaffray at (612) 342-5540. -----

1 0

a decentralised dejanews
by Adam Back 17 Dec '03

17 Dec '03

As you'll know if you read some of the previous eternity verbiage I've generated over the last few days, the design is evolving as ideas are bounced around. To recap briefly: The eternity implementation at the moment is performing the function of a cache of USENET, which also `reformats' messages to extract and deliver the content as web documents. The cache has no replacement policy. Planned replacement policies where least accessed documents, and/or the document accompanied by the smallest ecash payment. Obvious problem: The cache will fill up and material will be discarded when the eternity document store grows too large for one machine to cache. Solution: My last thoughts on how to fix this was to have collaboration between the eternity servers: they ask each for documents they don't have. They act like a distributed raid file server with redundancy. Clearly with the "least accessed" replacement policy they'll all likely cache similar material, and documents will still fall off the cache. Ecash payment for cacheing might work reasonably well, if you buy as much redundancy as you wish by including cash for several servers. Or perhaps a random cache replacment policy is the simplest to keep even spread of availability of documents. k of n secret sharing could be used at some overhead so that no one site is responsible for serving a given document. However it is fairly complex to design and implement such a system which can provide full underdisturbed service with nodes dynamically leaving and joining, and it is also difficult to protect fully against denial of service attacks. Recap on old idea of using dejanews and altavista You will recall that earlier discussions talked about using dejanews or altavista as archives to fetch documents from. I rejected this initial idea because altavista and dejanews take steps to reduce their disk space usage, by stripping out UU and radix-64 encoded documents. Now we can fool them easily enough by waging a running battle of increasingly sophisticated textual stego on our side vs playing catch up with cleverer eternity document spotters on their part. We might even win long term if we public key encrypted the documents for specific eternity servers. Kind of messy. Old content will be disappearing if they go back and filter out old with the new filters. However is another important reason not to use altavista or dejanews: it's not decentralised. If something sufficiently hot gets published they'll both be taken off line long enough to figure out how to disable access to eternity. Even if they can't do it ultimately because of sufficiently advanced public key text steganography, it'll disrupt the service. Viewing the situation more modularly: The eternity service with a distributed raid file server formed from the respective caches has one problem: of acceptability. Each server is actually holding eternity material, it tries to get away with this by claiming that it is a cache. However each server is serving three potentially separable functions: - document cache - node in a distributed news archival service, but only for messages which look like eternity articles - a view on the database to allow it to be viewed interactively as web documents (fetching and translating decoding eternity documents to serve as web pages) The first function -- a document cache could probably just as well be served by a standard proxy cache. Not a big issue, it's easy either way. The second function makes it hard to claim you are `just cacheing USENET' -- you're also creating a distributed archive of a very particular subset of it. And the third function, viewing the database, is somewhat like a specialised search engine. The search engine functionality is 100% replicatable at practically zero storage overhead, and pretty good as a non-censorable element of the system. 100% redundancy of service each node has nothing that can't be replaced. A distributed deja-news replacement So after separating the functionality it becomes apparent that we could have a another model. Actually try to start a distributed deja-news replacement, an complete eternal record of _everything_ that _ever_ gets posted to news. Dejanews is kind of doing that, except that it's not complete -- they are stripping out uuencoded files, etc. Also this would be distributed, and harder to coerce. So what are the storage requirements? What does dejanews have in their machine room? (Huge raid server? How many Gigs?). I'm wondering if 1000 academic nodes, small and large ISP nodes, and indivduals each contributing 1Gb each could out perform deja-news. That'd be 1Tb. How long would 1Tb last at the being consumed at a rate of a full USENET feed? As disks get cheaper, next two years or so, people can upgrade disks to 10Gb disks or whatever is cheap at the time. You would want some redundancy, more than redundancy than dejanews needs in their raid fileserver, because nodes may come and go, and the number of nodes could fluctuate. On top of distributed news archive, build an eternity service So with the eternal news archive, you now have everything you need to easily build an eternity server. How practical is this? How much interest is there likely to be in creating a full USENET archive as a distributed net based effort. It's clearly got vastly larger storage requirments than storing the full set of eternity articles posted to USENET. However it has wider uses, and has lots of innocuous reasons to exist. I guess it's quite an interesting project in it's own right. You could start with just some newsgroups, and build up as a way to boot strap it. But it may be harder to generate enough interest to deploy this than to deploy enough eternity servers to do build a distributed archive of just eternity articles. How soon could it happen? Who knows. What do people reckon the interest would be in a distributed complete USENET archive for it's own sake. For purposes of the archive cancels would not be applied. Indeed archive the cancels too, and the control messages for everyone to see for perpetuity who did and said what. Best way forward? Perhaps it will be more realistic to build a distributed archive for eternity documents only first. If it is designed as a separate service, then it could be the same software to do either, just restrict it to alt.anonymous.messages, or just for alt.anonymous.messages passing a filter program. Comments? Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

SSL trouble
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

Let us call "sequential search" an algorithm that remembers which keys were tried and avoids trying them again, and "random search" an algorithm that just tries keys at random without bothering to check. The sequential search has the following problems: 1. The server is badly overloaded. It is vulnerable to a variety of active attacks: 2. "result hoarding" attacks: finding the result and reporting it "not found". 3. "dilution" attack: allocating some search space and not sweeping it. 4. plain old "denial of service" attack: deliberately overloading the server with bogus communications. 5. And of course all of the above in their "buggy software or hardware" versions. The random search has none of them: attacks 1 and 4: there is no server to overload attacks 2 and 3 are no worse than simply refusing to participate in the search, because the rest of the computation is independent of what any one party is doing. The main drawback of the random search is that the expected running "time" is the size of the key space instead of half the size for the sequential search ("time" here is the number of keys to try before finding the right one). In practice, because of server overload, our machines don't seem to be working more than half the time, so the random search could be actually faster than the sequential search. Even if it isn't, I think doing twice as much work is a good trade-off for protection against all attacks, and no more network or server problems, and no more allocation hassles for off-line users. Four more remarks: * I get the factor of two by assuming that the algorithm is "pick a segment at random, look for the key in it, pick a new segment at random, and so on". I suspect that sequential searching from a random starting point would be much worse in the case of many independent searchers. * I hope there's no bug in my math. * Another drawback is that the worst-case running time is infinite (but it is infinitely unlikely). * Of course, we need a good PRNG, but that's essentially what RC4 is. In conclusion, I think random searching is the way to go. It's even better than Monty's pre-allocation with quad-coverage. -- Damien

5 5

Re: proliferation of voicesystems
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:38 8/27/95, Thomas Grant Edwards wrote: >On Sun, 27 Aug 1995, Tatu Ylonen wrote: > >> Maybe someone could start writing an internet draft about "encrypted >> voice transmission on the internet". It should address several >> issues: >> - compression methods, sampling rate differencies, encoding methods > >BTW - does anyone actually know what the voice compression is in >PGPfone? GSM lite and I think CELP. PGPFone has some serious problems with the variable latencies of real life connections. These problems will not go away until PGPFone makes the shift to APIs that are designed to deal with such problems, such as QuickTime conferencing. I hope PRZ will realize this. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 3

Christian CypherPunks / Re: The BIG Lie (Jesus Confesses)
by TruthMailer 17 Dec '03

17 Dec '03

David D.W. Downey preached hate and intolerance by saying: > Considering the apparent ignorance you have > displayed thus far about... I have not yet _begun_ to display my true ignorance. > ...the makeup of the US, I would venture to say > that you probably have not read it. Silly me. I thought it guaranteed freedom _from_ religion. That's the last time I ask "? the Platypus" to read something and give me a summary of it.. > Next, you attack christians for > trying to control the content made available on the internet. Thanks for at least being honest enough to admit it. I don't attack Christians for speaking their mind, I attack them for lying through their fucking teeth about their motives and intentions. I have no problem with Christians wanting to take firm control of their environment, but I object to them wanting to take control of _my_ environment. You might think there is a need for more Christian CypherPunks, while I think that there is a need for more CypherPunk Christians. (And Mike Duvos thinks there is a need for more lions.) If you take the time to read "The _Really_ Big Lie," which has all of the original post, instead of the one that the God/Dog of mirrored remailers was so rude as to edit with a lightning bolt, it might be slightly more clear that my rabid vendetta is not against a particular point of view, but against hypocrisy and oppression. > At least > the site ratings plan is better than alot of other plans I have seen. Yes, it is. And it still sucks, as do the available Search Engines. When was the last time you bought a Bible that had an index which showed 5,000 references to "he lifted her skirt, and knew her," for every reference it has to "I AM." What we have in common is that you don't want to have Little Johnny do a search for "Jesus" and get 5,000 sites with pictures of Jesus shoving a crowbar up his ass, and I don't want to try to find a site to buy a crowbar to work on my house and get 5,000 sites with pictures of Jesus shoving a crowbar up his ass. My point is that I don't object to you supporting InterNet tools which allow you to screen out pictures of Jesus with a crowbar up his ass, but I object to a "quick and easy" solution which blocks out all sites with a reference to "crowbars," because one guy in Toledo "used to have" a site with a single picture of Jesus with a crowbar up his ass. I would genuinely like to see more CypherPunk Christians. I would like to see them write code which you can use to "block" access to certain sites, and which I can use to "gain" access to certain sites. > Besides, Oh Godlike TruthMonger, where is *your* surefire plan to halt > the spread of trash that *most* humans would want out of of the reach of > their children? Burn all the Bibles. (Thought you had me on that one, didn't you?) > I have not seen you *once* offer a straightforward clear > cut plan to efficiently handle *any* issue placed for discussion on this > listserv. Tim May has already suggested that we, "Nuke D.C.", so any valid solution to society's problems would merely be a plagarism of Tim's stance. I just try to fill in the whitespace between Tim's posts. > I have seen you do nothing but slam, belittle, and degrade > others and their beliefs and ideas. I don't subscribe them to the CypherPunks list, I just turn on the gas... > When you can come up with a plan that even *remotely* seems like a > logically thought out, planned, and intelligent proposal on how to > handle the issues presented everyday on the internet that affect the > computing industry balanced with a concern for the children, then I will > listen. If you would listen to the *intelligent* proposals of rational, sober people who are capable of sustaining a logical train of thought (such as Declan McCullagh, Tim May, Blanc, and snow--to name but a few), and reply to them, then I would not have to suffer the indignity of foregoing taking my medicine in order to let my Tourette Syndrome and Obsessive Compulsive Disorder get so far out of hand that people such as yourself will feel threatened enough to shake themself out of their robotic slumber and contribute their knowledge, viewpoints and wisdom to the CypherPunks list. Listen up, shit for brains, I am about to follow this insult with a compliment... I enjoyed your post! It is refreshing to hear someone defend their faith using their own logic, intellect and thought, without merely resorting to meaningless platitudes such as "God is Love" or "Patience comes to those who wait." I don't have a "problem" with Christians, and I don't have a "problem" with anarchists. I have a problem with people who begin a sentence with the words, "EVERYBODY KNOWS..." Well, Lou Reed doesn't "know," although he wrote a great song making fun of those who _claim_ to "know." {If anybody on the list has his album, please post the relevant quotes.} > (And yes, I do agree that the parents of the children have an > obligation to monitor the content they are exposed to. It's called > responsible parenting which unfortunately is not a well practiced > ideology. And to take the wind out of your sales, I have 2 children and > as a parent I limit them to what is appropriate to their ages.) The word is "sails," not "sales," you illiterate piece of crap who accused me of going out of my way to "slam, belittle, and degrade others" on the list. Why don't you get "? the Platypus" to teach you how to spel? > Until > such time as you can fulfill the obligations to us, the adult computing > population, and our offspring, the children... Unless you have a valid signature of mine on a contract, I do not believe that I am under any obligation to kiss your self-righteous, Christian fucking ass. As a matter of fact, since I am every bit as immature as your saintly children, I believe that the onus is on you to "protect" me from the "immature-adult" molesters and the licensed doctors who prescibe the same drugs for me that I used to get illegally from "drug dealers." > I suggest you rest those busy little > fingers of yours and listen to the underlying theme of the issues before > us. Don't talk while I'm interupting. It's rude. >Until then, HateMonger, I have one suggestion for you..... Shut Up! I have to concede your point, here. I obviously need to be spanked. How's your schedule look for next Friday? TruthMonger "Mad dog in possession of the last false smile."

2 1

Re: nym server development mailing list
by steven ryan 17 Dec '03

17 Dec '03

>John created a mailing list for those interesting in contributing to the >development of his nymserver and as a forum for discussion of nymserver >related issues. So far, there have been few folks subscribed, and no >answer from those that are presently subscribed to the list. I find >this rather disappointing. This sounds very interesting and on topic for the list. If it is such low volume why not talk about it here and then if it gets to be too much volume move it to a separate list? You may generate more interest that way and keep more people informed. Steven Steven Ryan sryan(a)reading.com

1 0

Re: e$: The Book-Entry/Certificate Distinction
by Alan Penny 17 Dec '03

17 Dec '03

> Date: Wed, 23 Aug 1995 23:30:27 -0700 > From: tcmay(a)got.net (Timothy C. May) > Subject: Re: e$: The Book-Entry/Certificate Distinction > > At 4:10 AM 8/24/95, Alan Penny wrote: > >The other night I heard that some of the rules for selling stock have > >been changed to allow companies to sell stock directly to investors. > >I have been thinking that this may have the potential to support an > >interesting system. > > My company sold stock to me directly, through a Stock Participation Plan > and an Incentive Stock Option Plan. I think that the point of the news report was that in the past companies were limited in the type of investor they could sell to (e.g., employee, stock-broker). I assume what they meant by the report was that a company under the new rules could sell stock to anyone who asked. > > >Imagine "Portfolio Accounts" with a debit-card like access method. > > I use a debit card which directly accesses my stock account. More on this > in a moment. > > >Instead of paying for an item at a store with money or credit you use > >your Portfolio-Account card and buy the item with shares/micro-shares > >of stock. Stock brokers may offer this type of service in response the > >competition of companies bypassing them. Stock brokers could setup > >services that mediate between transactions calculating trades and values > >"on-the-fly" (anonymity could be tricky to build into this system). > > This is where it breaks down. Stock prices are denominated in dollars (or > the local currency, as applicable). And local purchases are denominated in > dollars. Nobody pays "one microMicrosoft" for a loaf of bread. They pay $1. > And Microsoft stock sells for $100, not 100 loaves of bread. Prices could still be denominated in dollars, but the actual transaction could be executed with stock value (at the current market price). There would be an element of risk in these transactions since after the transaction a stock's value might go down, but it might also go up as well. I would think that if a merchant had a large volume of transactions and a varied stock "intake" a merchants portfolio would tend to balance out in terms of stock increases and decreases. > > >If the company you worked for paid you with stock instead of money this > >would complete the loop. > > The IRS and other tax authorities have this one figured out: barter > economies are not generally a way to avoid taxes. > Oh well, you win some and you loose some :-) > >This also has the interesting feature of avoiding all taxes. Until you > >"cash out" your account you would not have to pay taxes, if you never > >need cash out your account, you never need to pay taxes. I suspect that > >our friendly governments would try to "correct" this "problem" in the > >long run if they can. > > If you are paid in barter for some service, taxes are still owed, based on > the estimated value of services rendered. > > By the way, a simpler example than all this talk of partial shares of > companies is simply to talk about paying each other in gold, or oil, or any > other commodities. Hmmm, a "micro-spot" commodity market? Cordially, [-------------------------------------------------------------------------] [ Public pgp-key: email penny(a)tyrell.net with subject as 'send pgp-key' ] [ My opinions are mine. I have scored 90% on the the Turing Test. ] [ Alan Penny, penny(a)tyrell.net ]

1 0

Source Code for New Encryption Algorithm
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Source Code for the Dick TruthMeasure Encryption Algorithm: (c) "The Hoff-Center of Virtual Math" ==============> |<eight inches>| + DOOM = DICK + DEATH = 2" + NULL = Nine Inch Nails ## Proof of Theorem: ## ## If she says "I want nine inches, and I want to bleed." and you give ## her two inches, four times and stab her to death, using a 6" knife, ## then 4(DICK) + 6" = 8" + 6" = Nine Inch Nails. ## ## Therefore, Nine Inch Nails band members have 14" Dicks. ## ## Basing the Private Key on Nine Inch Nails private parts, and the ## Secret Key on the secret location where the dead woman's body is ## buried, the sick, twisted creators of the "Dick TruthMeasure ## Encryption Algorithm" have produced a cryptography product which ## cannot be broken by normal people, using normal math. ## This has been confirmed by the independent research of Carol Anne ## Cypherpunk, who reports that Kent Crispin has always claimed that ## this, ================>, is eight inches, while Tim C. May claims ## this, ================>, is fourteen inches. ## Her research methods have been approved by TruthMonger, who ## states, "Give her two inches, and she takes a mile. She never ## judges an encryption algorithm until she's fucked a mile with ## your Dick in a 'rubber boot'." ## In response, Carol Anne Cypherpunk said of TruthMongers sexual ## prowess, "He claims that his Dick was the inspiration for the ## Eternity Server, but it is a forgery, like his posts to the list. ## It just _seems_ like it never ends when you are subjected to ## abuse of either of them. A mile, my ass..." <EOC> (I mean, <EOF>)

1 0

Re: PGP for pine and other Unix programs
by Jaeson.M.Engle＠dronf.org 17 Dec '03

17 Dec '03

I'd like to be added to your list of people wanting the 1.0 version. By then I should have MachTen running on my PowerPC Mac, and I would like to make sure that it works for that. Thanks Jaeson At 2:19 AM 8/23/95, Bryce Wilcox wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >> Does anyone know of an addon to the Pine mailer that supports PGP? >> the only PGP software i could find required me to first compose a >> letter in an editor then run it through a pgp signature program >> then finally read it into my favorite mailer. >> >> I'm looking for something that is hopefully transparent, or if not >> relatively quick to do. > > >My "Bryce's Auto-PGP" fits the bill. It is an sh script so it can be >integrated without too much trouble into Pine, Elm, trn, tin, mh, etc etc. >I have personally tested it with Pine so I know it'll work. You can e-mail >me for a beta copy, or you can ask for a v1.0 copy if you don't mind waiting >an unspecified amount of time for beta-testing to finish. > > >Regards, > >Bryce > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Auto-signed with Bryce's Auto-PGP v1.0beta > >iQCVAwUBMDrWWfWZSllhfG25AQEpXQP+ISF5DNtNa/SbceUTPzFkHLO7YFoV01+S >t91Tt488GplyFQrimqbJpRTRtdxNjt4fR7o23F9kbRkPRtD3zQPxi0/jjT29JrNU >Oi0eiteq2FpgAoevMdkfwdsVKupW2fb78jNnz2490JHM/Zr1CvOH+2bwziQ1i8hR >5y48rjUrLTE= >=DQYq >-----END PGP SIGNATURE----- -- Jaeson M. Engle http://www.dronf.org Coordinator of the Jourvian Group PGP Mail Encouraged -> jme.pub.key(a)dronf.org Project List -> programs(a)dronf.org

1 0

Re: Demagnetizing
by alt＠iquest.net 17 Dec '03

17 Dec '03

At 04:26 PM 8/27/95 -0500, Buford Terrell wrote: > >>Reply-To: dr261(a)cleveland.Freenet.Edu (Tobin T Fricke) > >> >>Where exactly is the r/c circuit? Is it very small and in >>a label? Book publishers don't put them in, do they? >>Also, if the thing gets "burned out" by the magnet in the >>pad, what do libraries and such do where materials are >>reused? Just slap on another label thing? >> >It's much more low-tech than that. Libraries and book stores just >put a strip of magnetized material (it's much like audio tape, >about 1/8 inch wide and comes on rolls) inside the book and then >put detectors at the doorway. It the detector feels a magnetic field, >it buzzes; if the tape has been deguassed, nothing happens. > >For libraries, it's usually mounted on sticky tape and put down >inside the book spine. Bookstores usually just snip off a 4 - 5" >segment and slip it inside the book. Music stores frequently tape >a small section on the outside of CD jewel boxes. > >Sorry, there's no real mystery or exciting tech here. There's still some mystery. For instance, how does it differentiate between the magnetic field of their strip, and the magnetic field of the strip on your credit card, or the speaker on your cell phone?

1 0