December 2003 - cypherpunks-legacy

Leaked NSI PR About $50-Annual-Fee-for-Domain-Name
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

Here's a pointer to a very interesting draft press release, apparently scheduled for release on 18 September 1995. Short version: The article specifies $100 one-time fee for new domain name registrations, and a $50/year annual fee for all .com, .edu, .gov, .net, and .org domains. Long version: > From: rpwhite(a)best.com (rpwhite) > Newsgroups: best.general,best.announce,best.www,ba.internet,comp.protocols.tcp-ip.domains,talk.bizarre > Subject: INTERNET BEGINS FEE-BASED REGISTRATION > Date: 12 Sep 1995 12:18:18 -0700 > Organization: BEST Internet (415) 964-2378 > Lines: 495 > Approved: dillon(a)best.com > Message-ID: <434mdq$c3r(a)shell1.best.com> > NNTP-Posting-Host: shell1.best.com

1 0

The Joy of Java
by mpd＠netcom.com 17 Dec '03

17 Dec '03

> "Krakatoa--East of Java" An excellent Rant in which our Titular Leader, Tim May, sings the praises of Java and denounces an evil sect of Crypto Separatists, the self-described "Coderpunks." > Well, I was not invited to join the elite and secret > coderpunks list, but I still have some thoughts on coding > and, especially, on the opportunities offered by Java. Sorry > if this interferes with discussions of Rabbi Heir and Morris > Dees. Given the various parameters which determine the life and death of mailing lists, I fully expect Coderpunks to become moribund within six months, and its members to reunify with this list. Very few of these "I'm going to start my own list with less noise" adventures ever make it long term, absent the personalities and critical mass of interesting information which drove the list they spun off from. > 1. Java is of course not a perfect language, nor even the > best for specific applications. Other languages will > continue to thrive. Critics of the language and related > items (applet model, JDK, JITs, etc.) may point to various > problems (e.g. security). > 2. However, the "big picture" is compelling. Java arrives > at a time when a Babel of languages and platforms threatens > interoperability. C++ is despised by many (though, to be > fair, liked by many, too), and developers are adopting > Visual Basic (and the vbx widgets, etc.), PowerBuilder, > Delphi, flavors of Smalltalk (no pun intended), and > scripting languages (Perl, TCL, Python, etc.). I completely agree with this. Java incorporates the type of automatic corruption-proof memory management found in languages like APL, the basic notions of object oriented programming, fast dynamic linking, and a C-like program structure. This is powerful combination of features and gives Java the potential to do all the platform-independent things that were advertised for C before the rude reality of thousand line makefiles reared its ugly head. . The complete specification of the Java Virtual Machine means that the behavior of Java programs is perfectly well-defined, and one does not have to tweek anything which is processor or operating system dependent. In the future, I expect Java bytecode to become a significant channel for the distribution of popular applications, with compilation to fast native code on numerous platforms. Java is clean, and its concepts are easily understandable even by persons whose eyes glaze over after the first 30 pages of the C++ manual. > 4. What is so compelling, to me, is that Java programs have > an excellent chance of running on various flavors of Unix, > on Windows-95 and NT systems, on Macs, and on other systems > without changes, and without any special compilers bought by > the users! (Netscape browsers, and even Microsoft browsers, > are able to view applets, or soon will be. And cheap or free > applet viewers are available.) Expect NT to be a Unix-killer in the future. It can be ported to any machine, and its microkernel client-server design with pluggable third-party APIs permits it to manifest simultaneously the personalities of numerous different operating systems. Contrast this with the many different binary incompatible Unix flavors and its marketing advantage becomes clear. NT sales just broke one billion per year and are climbing steadily. NT and Java will be the big players in the future. If Netscape becomes its own OS, requiring no Microsoft software, it will probably capture the low-end "Web TV" market. > 6. One can imagine several applets of interest to > Cypherpunks. The ability to fairly transparently run them on > multiple platforms, effectively bypassing the platform > dependencies, is very important. Check out Hal Finney's site > for some "crytographic primitive" applets he's written. Indeed. One can imagine a nice set of Java classes and methods which interoperates with PGP, and has none of the fixed buffer allocation, limits, and awkward memory management present in PGP. Java tends to do the kinds of things PGP does very cleanly, and implementors can worry about the algorithms without being distracted by housekeeping. Any code produced can instantly be used by others in their applications. This is a powerful paradigm, encourages others to expand on existing work, and renders kludges like "PGPTools" unnecessary. > 10. "Mindshare" is the real story. Java arrives at the > right time. Cypherpunks needs--those needs that go beyond > just the "sealed envelopes and signatures" level which PGP > provides so well--are likely to fit in with this Net-centric > communications model. (I'm already thinking in terms of Java > applets for building blocks for Cypherpunk sorts of things.) Java Applets, mobile crypto agents, and the new Web-centric view of cyberspace will go a long way towards encouraging the planet-wide use of strong crypto, as well as effectively swatting annoying mosquitos like ITAR. Indeed, with Java, I can put up a Web page which teaches someone about a cryptographic algorithm, allows him to try it out and run sample data through it, and provides him with a platform-independent implementation of it to use as he wishes. All in one fell swoop. That's a pretty powerful concept. Java has come at the right time, and it will produce chaotic change in the existing order. Should be interesting. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

11 23

Denver area meeting, SUNDAY, 9/17, 2 pm
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As usual, we'll congregate at the food court in the basement of the Tivoli, near the confluence of Larimer St., Speer Blvd., and the Auraria Parkway, and perhaps drift off to nearby libraries or restaurants after an hour or two. Email for directions or more info. Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: I *swear* I have not used the term 'big-endian' in the last 10 years. iQCVAwUBMFYHkFRRFMq4NZY5AQGuGwQAmOqG0gpZHlUsmQxHcCfA2Hg30LQH9FXN xgz+gZuMWLFDNIZp/5bmodK18B4NpE4AtJH9QhA8kngb11/onVAu8aiw/EFGbTyT yHF2NVN20gGOGAYbeJzpUWHnJhPUB9QYszdwc8K0VvDtYfxq/H8mDfgDiGjNenCG z8ryBpKWYkQ= =cscS -----END PGP SIGNATURE-----

1 0

Re: Netscape to patch shareware version
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:00 PM 9/12/95 +0200, you wrote: >>| Netscape said it received word last week that the State Department had >>| cleared that version for release on the Net, but only within the U.S., >>| owing to current export laws banning the export of encryption schemes >>| stronger than 40 bits. THe company could provide no details by press >>| time on how it would ensure that the 128-bit version wouldn't leak beyond >>| U.S. borders. >> >>Ok, any bet on how long it will take? > >It's already been exported. Evidently, one of those who bought the commercial >version sent it to Europe as soon as it was out. The Netscape "personal edition" was available in Europe on some store shelves soon after it's release. (The PE edition of netscape has the 128 bit encryption.) As for what Netscape will do in this case... They had made plans to release the 128 bit version in a method similar to what MIT uses, but they found that they could actually get people to buy a copy if they kept that one as only available by ordering it. (Who says that people will not pay for encryption?) Now all they need to do is come out with a version with a bigger key. (Hint, hint...) I will keep my personal feelings about Netscape to a minimum here. There are certain things that they do well and there are others they do not. But those problems will continue to be forwarded to Dave Null... Well, on to more profitable things. > >I note the site removed it, however, probably because Netscape Comm. Inc. requested that they do so. Netscape generally objects to anyone else carrying their browser (.edu sites with prior permission excepted). > > > > | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: An alternative to remailer shutdowns
by jim bell 17 Dec '03

17 Dec '03

At 02:12 AM 5/27/96 -0400, Black Unicorn wrote: >On Sat, 25 May 1996, jim bell wrote: > >> > Why the first in chain? If the anti-traffic-analysis provisions are >> >working properly, it should be impossible to prove that a given first remailer >> >was the first remailer for any particular message. I had thought that even >> >civil courts required that you be the person who committed some act, not the >> >person who _might_ have committed some act. Otherwise, all the remailers are >> >in danger. This is even if someone tries an entrapment by sending through some >> >illegal material - if the courts accept that they should be allowed to do this, >> >then all the remailers they chained are going to be hit. >> >> Likewise, I don't see why the first address in the chain is vulnerable, as >> long as the message subsequently passes through at least one trustworthy >> remailer, and probably a temporary output address. > >I repeat, all it takes is one person to send through only one remailer >(perhaps even a Co$ plant) and the first in chain remailer is toasted. > >Think before you type please. You should take your own advice. The mere fact that the first link in the chain is "known" doesn't mean that it is provably involved. Without a substantial amount of bugging that the COS hasn't the resources to do, there is a big difference between them _believing_ that a given message originated there, and being able to prove it in court. And notice my caveat: "As long as the message subsequently passes through at least one trustworthy remailer, and probably a temporary output address." Jim Bell jimbell(a)pacifier.com

2 1

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:44 AM 5/31/96 -0400, Moltar Ramone wrote: >On Fri, 31 May 1996, Lucky Green wrote: >> Where does this leave foreign vendors? Will Sun sign the 3DES package of a >> foreign vendor? > >Probably. But they won't be able to export the signed 3DES package :) >It leaves foreign vendors in trouble, is where. But why can't they just export the SIGNATURE, if it is detached from the software itself? Jim Bell jimbell(a)pacifier.com

2 1

new info-sec mailing list
by fc＠all.net 17 Dec '03

17 Dec '03

Info-sec heaven is introducing a new mailing list. Unlike many of the Internet's mailing lists, this is not an open forum for people on the Internet to exchange ideas. Rather, it is a monthly mailing used to inform readers of new information that can be found in info-sec heaven. If you would like to be informed of new information, services, search capabilities, protection software, articles, books, and other information that appears in info-sec heaven without having to come in periodically and look for yourself, please let us know by sending email to fc(a)all.net and we will add you to our monthly list. Thank you for your time. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: DCSB: Electronic Commerce: The State of the Art
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

The signature on the message attached below did not verify. Pronto Secure has the neat feature of doing signature checking on the fly. In the process of testing PSecure I have collected from the keyservers, the keys of most people on the list who pgp sign their messages. (Another neat feature of PSecure makes this a one click task) I could quite easily perform the service of bouncing messages with bad signature back to the list. Please let me know if people agree that this would be a useful service, or is it inappropriate ? My experience over the past few months is that around 10% of all signed traffic on the list checks with a BAD SIGNATURE! Geoff Klein Pronto Secure Product Manager.

3 2

No Subject
by Anonymous Remailing Service 17 Dec '03

17 Dec '03

E. Brian sed: >Unbelievable!!! To add to this distressing truth, I have learned that >the White House also subscribes to a number of newspapers and periodicals >which are reviewed for things of interest to the Administration and to >the President. I I I I I I ammmmmmmmmm shocked! mebbe tha Slickster just wants to know who orlin's "Deep Throat" is... Keep checkin' them fingerprints, Willie! >Ooops. Dog bites man. >And do you really think the White House couldn't hire a couple of net >gurus to sniff packets if they wanted to hide their "monitoring"(=reading). who sez they dont post, too? heh

2 1

Cash Is Dying
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-14-96: NYT ad for The New York Times Magazine: Cash is dirty. Cash is heavy. Cash is quaint. Cash is expensive. CASH IS DYING. "You believe in banks don't you? That's good, because ultimately money is backed by nothing but your own confidence, habit and faith -- a form of faith as powerful and essential to modern life as any religious belief. The coming digital era will make this plain to everyone, as never before." (Continued on Sunday) From "Dead as a Dollar" by James Gleick ...the cover article in this week's issue. --------- Yes, the James Gleick whose co-founded Pipeline is near dead as a dollar. Hope his multi-million-dollar PSI-buyout lives.

5 5