December 2003 - cypherpunks-legacy

Re: Java and Safe-TCL security
by Hal 17 Dec '03

17 Dec '03

The safe-tcl mailing list has not been active for a few months. I think a lot of interest has transferred to Java. One problem is that safe-tcl was oriented around email, so it lacks facilities for accessing web pages. I agree with Ray that the security of safe-tcl leaves something to be desired. I implemented a safe-tcl mail filter which would automatically run incoming mail scripts which were in safe-tcl format. This would be a generalization of a remailer, so that users could write scripts which would determine when the remailing would occur, etc. However I ran into a number of problems, particularly related to persistent storage (e.g. disk file access). This is a hard problem for a "safe" system to solve. One solution is to just forbid it, but beyond that you need to have rules about how much disk space a script can use, whether they can access each other's space, etc. There are some nice applications if they can do so, for example the telescript model where two software agents come together and exchange some information. Another tricky issue is if you are going to let the script talk to the outside world via email or tcp connections. How do you prevent abuse of this feature (sending junk email, or connecting to a web page and entering bogus data into a form)? But again, without this capability the script is pretty much limited to drawing pretty pictures on your screen, which isn't very useful. Here is one message I sent to the safe-tcl list earlier this year describing some of these problems in a little more detail. Note that there were also several bugs in the implementation which left security holes, things being checked in the wrong context and such. This is similar to what Ray was citing. Hal > From owner-safe-tcl(a)CS.UTK.EDU Fri Feb 10 22:30:35 1995 > X-Resent-To: safe-tcl(a)CS.UTK.EDU ; Sat, 11 Feb 1995 01:22:02 EST > Date: Fri, 10 Feb 1995 22:21:28 -0800 > From: Hal <hfinney(a)shell.portal.com> > To: safe-tcl(a)CS.UTK.EDU > Subject: setconfigdata and delivery time > Status: R > > The spec appears to allow delivery-time scripts to do setconfigdata. > This is a mechanism for a script to store persistent data. One application > would be a telescript-like interaction between scripts. Some data could > be stored by one script and later read by another. More interesting, a > script could even store some script, perhaps some or all of itself, into this > persistent store. That script could then be read and eval'd by a later > script. This way scripts could in effect call subroutines in each other, > providing somewhat similar functionality to telescript's procedure calls > between agents. > > At activation time the user gets asked whenever a script does > getconfigdata, although oddly not when a script does setconfigdata. > Also, the .safetcl.conf file is written on any getconfigdata after the > user has supplied or confirmed a database value. This will have the > side effect of writing out any setconfigdata values which have been > previously set by the script. > > At delivery time the current implementation will not ask the user since > there is no user to ask, which causes the writing out of the config data > base never to happen. So there is actually no way for a delivery time > script to set a persistent value right now. It would be easy to change > the code to allow delivery time scripts to set persistent values with > setconfigdata. > > However, this does open up a possible avenue for abuse. There is > presently no limit on how much data is written with setconfigdata. And > actually if the idea above were used where scripts put themselves into > the database for later running then the database could legitimately be > quite large. The problem would arise if a script abused this capability > by filling the disk with junk database entries. > > Maybe something is needed analogous to AutoConfirmMailHook to determine > whether a given SafeTcl_setconfigdata should be able to go out to the > disk. It would want to be given the data as input and possibly also > the size of the current database. Maybe there should be a counter of how > many times the current script has written to the database (or perhaps the > hook could retain this information itself). > > Two other points: as mentioned before the use of the database to retain > "system" information conflicts with its use for this purpose. If > database entries like "mailer" or "external-site" are changed and saved > to .safetcl.conf, that could break later invocations of swish. I think > this system data should be somewhere else (or else there needs to be > another form of persistent store for scripts). > > Secondly, the code right now checks the SafeTcl_evaluation_time > variable in the restricted interpreter to decide whether it should ask > the user. This is not reliable as the untrusted script could change > SafeTcl_evaluation_time. In other places the code checks > SafeTcl_InterfaceStyle and if it is empty then it doesn't ask. That > seems safer. > > Hal Finney > hfinney(a)shell.portal.com

2 1

PC E-cash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Secret Service Says Student Used PC To Print Money Lubbock, Tex., Aug. 3 -- PC graphics programs have come a long way since their inception, but not far enough to fool the Secret Service. That's what a Texas Tech student tried to do when he used his personal computer to print counterfeit money, according to Secret Service agents. "He really put his whole heart and soul into it," according to Lubbock, Texas Secret Service Resident Agent David Freriks. Freriks said the man is an engineering student at Texas Tech, but told agents he plans to change his major to computer science. The 20-year old student hasn't been identified by name since he hasn't been formally charged yet, according to Freriks. But officials apparently aren't concerned that he will flee. "At this point, he's more afraid of his dad than anything," said one agent. Freriks said the Pakistani national, who resides in affluent southwest Lubbock, scanned a real $50 bill into his PC, then printed the image to an Epson inkjet color printer. Agents said the money looked real at a distance but up close the designs were blurred, the coloration was faulty, and the paper was slick and didn't have a watermark strip. Freriks said agents are confident that all of the approximately $3,300 that was circulated has been recovered except for about $1,000 which he said he is sure will show up eventually, since the quality makes it easy for bank employees to spot. ... Investigators seized the home computer, printer and scanner from the student's home. They said they also found a suitcase containing almost $260,000 in fake $50 bills. --

1 0

Re: Object Oriented Crypto API
by Hal 17 Dec '03

17 Dec '03

I enjoyed Ray's message about the crypto library interface. I haven't had time to study it closely, but I have a couple of quick comments: I thought Wei's library looked pretty easy to use already. Maybe Ray could show an example of what would be needed with Wei's library to do some "typical" crypto function, say encrypting a message with someone else's RSA key. Then we could compare it with how the same function would look with Ray's proposed interface. The other point is that there needs to be the ability to encrypt only a bit of a message at a time. Particularly with public key the first message may be special in that it generates a session key which is used for the remainder. So an interface for piecewise encryption and decryption is necessary. I hope we will see more discussion about the library. Hal

3 2

House Adopts Exon-Like Speech Crimes, Also Adopts Cox/Wyden Amendment
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

8/4/95 ACLU Cyber-Liberties Alert: House Adopts Exon-Like Speech Crimes, Also Adopts Cox/Wyden Amendment --------------------------------------------------------- At 9:10 am today, the House of Representatives voted to adopt an omnibus "Managers Amendment" to the telecommunications bill (HR 1555), which included new Exon-like speech crimes that would censor the Internet. At 11:58 am, the House of Representatives voted 420 to 4 to adopt the Cox/Wyden amendment to the telco bill. The Cox/Wyden amendment, however, was not designed to -- and does not -- affect the Exon-like speech crimes provisions added to the telco bill by the House. Speech Crimes Provisions in Managers Amendment: The Managers Amendment containing the new speech crimes provisions also contained some forty other unrelated amendments. The Exon-like provisions were not a focus of the debate, and it is likely that most members cast their votes for reasons unrelated to these provisions. The Managers Amendment adds an entirely new Exon-like provision to the existing federal obscenity laws. The provision would make it a crime to "intentionally communicate by computer ... to any person the communicator believes has not attained the age of 18 years, any material that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs." (18 U.S.C. 1465) This provision, like the Exon amendment passed by the Senate, would effectively reduce all online content to that which is suitable only for children. It also raises the same questions about service provider liability that were raised by the Exon amendment. The Managers Amendment would also make it a crime to "receive" prohibited material "by computer," thereby subjecting both Internet users and service providers to new prosecutions (18 U.S.C. 1462). Assuming that the House telco bill (HR 1555) is approved (which is highly probable by 3 pm today), both the House and Senate versions of the telco bill will include severe attacks on cyber-liberties. Cox/Wyden Amendment: The ACLU has supported the general approach of the Cox/Wyden amendment because it prohibits FCC regulation of content on the Internet and generally supports private sector initiatives, not government censorship, on cyberspace. As the ACLU has said before, there are several ambiguities and some real problems with the Cox/Wyden amendment. The two sponsors have committed to working with us on resolving the problems. (See previously posted ACLU Online Analysis of the Cox/Wyden Bill.) ----------------------------------------------------------- For the online community to take comfort in what is done in the final telco bill in the conference committee, at a minimum the following must occur: 1. The Senate's Exon/Coats amendment (the Communications Decency Act) must be rejected -- that is, deleted from the bill, not merely modified in some way. 2. The House's Exon-like speech crimes amendment must be rejected -- that is, deleted from the bill, not merely modified in some way. 3. The ambiguities and problems in the Cox/Wyden amendment must be resolved and then the Cox/Wyden amendment as modified should be included in the telco bill. The ACLU urges all those who care about free speech and personal privacy to focus their energized efforts on all three fronts of the fight. The ACLU will continue to fight all aspects of the cyber-censorship battle, including the Exon-like speech crimes provisions just passed by the House, the Exon/Coats amendment in the Senate, the Dole/Grassley anti-computer pornography bill, the Grassley anti-electronic racketeering bill, and the Feinstein anti-explosives information amendment to the counter-terrorism bill.

2 1

Re: PRA_fix
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> 8-4-95. NYPaper: > > > "A Contract Is Awarded To Improve Navigation." [snip] > The geosynchronous satellite would radio a correction > factor back to planes in flight, or any other user. The > plane would also receive signals from the G.P.S. > satellites, calculate a position, apply the correction > factor and fix its location. This is called an active location system, and it was originally disigned by G.K. O'Neill (The Princeton Physics Prof., Space Studies Institute founder, the guy who came up with all those spiffy space-settlement ideas in the late seventies -- see Babylon 5 for a picture ;-) -- and the inventor of the mass driver, among other things), under the name of Geostar, in the early 1980's. It's accuracy was supposed to be 6 inches in 2 dimensions, and 6 feet in 3 diminsions. The FAA didn't like it because they didn't invent it, the DOD hated it because they wanted to commercialize GPS and they didn't want anything so accurate for civilian purposes. The transponders were going to be beensy little things about the size of pagers relying on high-energy burst transmissions. ObCrypto/Privacy: It relied on a fast computer on the ground to calculate where you were, it allowed short messages, and presumably it was going to send them in the clear. It also had a "panic" button function, where someone in trouble could summon help no matter where they were. ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: Java and Safe-TCL security
by Rich Salz 17 Dec '03

17 Dec '03

>One problem is that safe-tcl >was oriented around email, so it lacks facilities for accessing web >pages. No, it's just that the people who took it over^H^H^H^Hand ran with it were most interested in email. My initial motivation was that I wanted to write a new news server that clients could download programs to. /r$

1 0

SYN_tax
by John Young 17 Dec '03

17 Dec '03

8-4-95. W$Japer: "Cyberpoliticking: Presidential Races Are Being Changed By Latest Technology. Internet and Other Sources Can Tailor Information, Sway Voters' Decisions." This kind of campaign foray into cyberspace is but a small slice of a much bigger revolution. The explosion of new avenues of information -- digitized, computerized, cabled and broadcast -- will change the way Americans gather the information they use in picking their leader next year. Campaigns are struggling to figure out how to cope with this static-filled world, in which they can use new technology in unprecedented ways to reach both mass audiences and ever-narrower niches of specific voters. For voters, the difficulty will be to distinguish between the information and misinformation inevitably mixed into the avalanche. LYN_jrk "Silicon Forest: For Oregon, the Boom In High Tech Brings Jobs and Handwringing." The quest for cheap land, cheap labor and tax breaks has led most of the world's biggest chip makers here, more than $13 billion in high-tech construction is either under way or proposed for the 100-mile swath of rural landscape stretching from Portland to Eugene. But surprising resistance is cropping up. In May, Yamhill County, at the western edge of Silicon Forest, rebelled against Sumitomo Sitix Corp.'s demand for an $58 million tax break for its proposed $912 million chip plant. In June, several hundred people turned out to cheer speeches opposing plans by Hyundai Electronics America to build a $1.3 billion chip plant. KIK_but Ev & Ad's kids: SYN_tax

1 0

"The Net"
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

TC> logic, especially the notion that one can be "vanished" by having computer TC> records changed--I can believe that such changes would screw things up, but TC> surely even the character played by Sandra Bullock (nicely) would have TC> human friends and associates to vouch for her. I would have thought so, too. But recently, my boss's sister-in-law tried to get a Kansas drivers' license. She had allowed her Missouri license to lapse before she moved, and some glitch in the MO computer left her as a non-person. Now, in order to get the new license, she will need a photo ID (and her expired "foreign" license doesn't cut it, althought if it were a KS license, it would.) The burrocraps at the DMV won't accept any "vouching" whatsoever. * A man's house is his hassle. --- * Monster(a)FAmend.Com *

1 0

Re: Java and Safe-TCL security (was Re: Java, Netscape, OpenDoc, and Babel)
by Rich Salz 17 Dec '03

17 Dec '03

>the interpreter is made "safe" is to take a fully working tcl interpreter >(with full priveleges) at run time, and use TclDeleteCommand() to remove >offending commands. Safe-TCL is not emasculated at compile time, but at >run time. I have been told by folks at Sun that they are planning on doing it at compile-time as well as at run-time. One of the concerns I conveyed was that I want to make it easy to "pull out" the safe code and give it a security audit. /r$

3 2

Re: Java and Safe-TCL security
by Hal 17 Dec '03

17 Dec '03

From: Ray Cromwell <rjc(a)clark.net> > Hal, > One of the designs I have one the drawing board is to store per-script > persistent data in a dbm file, and allow scripts to import/export data > from/to a shared tuple-space. I would limit the data storage to 1024 > bytes (to make it portable, some DBM libraries have this limit) > Scripts could store variables via a new command added to the interpreter > like 'SafeTcl_putvar varname value', and access valuables with > 'SafeTcl_getvar varname', 'SafeTcl_varlist'. Also, there would be a > 'SafeTcl_read_variables' which could be executed at the beginning of > the script to reload all stored variables. > Scripts could talk to other scripts by means of a > > SafeTcl_export -value value scriptname1 scriptname2 ... > > The other script(s) could check for any incoming imports and use > SafeTcl_import to retrieve the value. (when the last import is done, > the data is garbage collected. Also, there would be a timestamp so that > old data would be purged after a time limit anyway) This sounds like an interesting approach. I hear that Telescript uses a remote procedure call concept for inter-script communication. So one script gets to call the public methods of another script. I don't know how it finds out what other scripts are arround for it to talk to, though, or decides whether they have anything of interest. The tuple space idea sounds good and is not too dissimmilar from the get/setconfigdata in safe-tcl. There are some problems about security though. Who gets to delete tuples? How do you prevent a malicious script from messing up the data? Maybe it depends on the application, what you want to use this data for. BTW what kinds of facilities are there in Java for scripts to have access to disk files? I know there was some discussion of using scripts for cryptography. Presumably the user would want to give "read only" access to the (public) keys he used. And how about other forms of I/O, email and the like? Can Java scripts do this? What are the restrictions to prevent abuse? Safe-tcl has a concept where a script can send mail, but the implementation pops up a window and asks the user first if it is OK to send. (Unfortunately that doesn't work for a telescript like application where there is no user around to vet the messages.) > The problem with all safe "agent" designs is that the programming language > itself isn't enough. There needs to be a meta-agent language for > querying capabilities of local environments. Yes, there was some discussion about this on the safe-tcl list. There is also an agents list I was on for a while but they couldn't even agree about what an agent was so not much progress happened there! There have been various proposals for standard ways agent scripts could specify what capabilities they need to run, etc. Doing web searches on "agents" will track a lot of these down. However most seem concerned with traditional issues like compute cycles, memory usage, etc., and not with the more difficult and important issues of knowing whether there is another agent there (or a local database) which has the specific information my agent is after. Hal

1 0