December 2003 - cypherpunks-legacy

netscape rewards bug finders
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Netscape Offers Rewards To "Bug Catchers" MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1995 OCT 11 (NB) -- Netscape Communications Corporation (NASDAQ: NSCP) has announced the "Netscape Bugs Bounty" program that rewards users who help the company find and report "bugs" in the beta versions of its recently released Netscape Navigator 2.0 World Wide Web browser software. Users who are the first to report a particular bug will be rewarded with various prizes depending on its importance. The contest begins with the beta versions of Netscape Navigator 2.0 that are already on the Internet. Full rules for the contest will be available on Netscape's home page at http://home.netscape.com . Speaking to Newsbytes, Roseanne Siino a spokesperson for Netscape, said, "As far as we can determine, this is the first contest of its kind. Netscape's whole approach to broad-based beta testing on the Internet was new, and we hope the contest will enliven the beta testing process." Users who are the first to report a particular bug will be rewarded with prizes depending on the "bug class." Users reporting "significant security bugs," as determined by Netscape, will collect cash prizes, while users finding any security bugs will win Netscape "merchandise." Users finding other "serious" bugs will be eligible to win "a choice of items" from the Netscape General Store. Siino pointed out that there are no caps on winners. Top prize will be $1,000 for any and all bugs in the top category: Severe Security Bugs. To win, the finder has to be the first, and, according to the company, it is important to be constantly using the current versions. The beta versions are available now for downloading on the Internet for free evaluation. Netscape's beta testing of 2.0 is already underway. Users who downloaded previous beta versions of the 2.0 software should download today's versions, which fix major and minor bugs identified since its initial release, including security bugs in the pre-release version of the Java language support integrated in 2.0. Netscape has released special beta versions of 2.0 that include Java for users wanting to test it. Because bugs will be reported and fixed on an ongoing basis, Netscape asks users to stay current on the beta version they are using, so that the latest software is constantly being refined. "We are continuing to encourage users to provide feedback on new versions of our software, and the Netscape Bugs Bounty is a natural extension of that process," said Mike Homer, vice president of marketing at Netscape. "By rewarding users for quickly identifying and reporting bugs back to us, this program will encourage an extensive, open review of Netscape Navigator 2.0 and will help us to continue to create products of the highest quality." Netscape has created two versions of its Netscape Navigator 2.0 beta, available for downloading from Netscape's home page at http://home.netscape.com . Version b1J for Windows 95, Solaris, and Irix platforms includes Java and is for users who want to participate in the bounty program. For general users or those on other Unix environments, Windows 3.1, and Macintosh, Netscape has posted beta versions without Java. After initial testing is complete, future beta versions for all supported platforms will contain Java. (Richard Bowers/19951000/Press Contact: Roseanne Siino, Netscape, 415-254- 1900) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

variations on an attack
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Jiri Baum wrote: > To start a new sub-thread: what if the man in the middle is actually > a behaviour-modifying parasite? At that stage even a physical meeting > won't do you much good (the parasite may be otherwise asymptomatic). That wouldn't quite work since the host would notice the parasite in the middle and could then work out countermeasures. An important part of a MITM attack is escaping notice. What if one night the man in the middle drugged you, kidnapped you, placed you inside a virtual reality machine, replaced your body with a clone, and established a link between the VR machine and the clone so that you experience everything the clone experiences and the clone does everything you intend to do? Can you prove this has not already happened? - the Mad Scientist in the Middle - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHyIA9IjPOsOWLIJAQE3AgP/bNcA0BmDMvto9SocpIcYImoXJ72k9k+Z gYH6dnCo5UCY0KbKwgCbBfQI0bxpaP7EWmZPS/i1HdzWvKOw9JExY2i0gvKMr/BS KGtlG0+RAVSU9DiVRuAr6d7x6IQKYOeRgcNz0Dm2JpaA1eo/DbJ3tsRBYCeaQQ26 gS5XzNzL00M= =lc/J - -----END PGP SIGNATURE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzB8hz8AAAEEAKuHA58RXNk5o0nlDTOsoAs3YTKubscQYoW3kLSjmn7gmskD NtPKxYvXveGN3D/eBgsMzdGVtrl46j1r6VjYsTMcDGUL9wGQnflgHGrbReFYGzkI yW7GhyeUoRqCdmACDpmzUxEqp2J5hK2obL8bcvoiVSBMFogabdIjPOsOWLIJAAUT tEJJIHdvdWxkIGxpa2UgdG8gYmUgcmVmZXJlZCB0byBhcyAidGhlIE1hZCBTY2ll bnRpc3QgaW4gdGhlIE1pZGRsZSI= =Lzd5 - -----END PGP PUBLIC KEY BLOCK----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHyK9SoZzwIn1bdtAQHNsgF/WqMLd/EuNEG3QEXZobZKDQDl0hjMmhBn 56pUQxkNYi0ckMx+YIij9X7XoExm3MsK =D+xl -----END PGP SIGNATURE-----

1 0

Re: NYT on Internet Flaws
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Adam Shostack sez: > > Dr. Frederick B. Cohen wrote: > > | There are alse several papers there on "Internet Holes" under Network > | Security in the same on-line journal. Every month, another 5-10 holes > | are added to those published in this forum. > > And how many of those holes are published by bugtraq/CERT/8lgm > first? Just curious to see if this is another list I should be on... > Well since I see far less than 5-10 announcements from bugtraq, CERT and 8lgm put together most months, they must have others. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: NYT on Internet Flaws
by Rich Salz 17 Dec '03

17 Dec '03

> I understand though, that we can't control what the reporters >say and how they interpret what we say. It is very important to word >your posts carefully such that when you post a bug a reporter won't >think that they should write an article on it until it is verified. NO! Something like Perry's "Do not redistribute without permission" should be the only modification needed. /r$

4 3

Aquaria wars ?
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

I need some historical information for a discussion about which security features are to be used in usenet. Perhaps someone can help: Some (many) years ago there was a very large and long flamewar at the usenet. As far as I know it was called "The Aquaria Wars" because it began with a debate about the question whether the newsgroup should be named "alt.aquaria" or "alt.aquarium". I am looking for historical informations about this flamewar. Can anyone remember it or is there anything available about? Thanks a lot Hadmut

2 1

Re: SAIC bought ... [NOISE]
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:27 PM 10/11/95, Alan Horowitz wrote: >I used to work for SAIC. It's a legitimate beltway-bandito contractor. To >call it a cover op is sort of missing a point. The government hardly ever >does _anything_ itself (as, say, percentage of budget). Contractors are >the ones who do the dirty work in the trenches. It's not missing the point at all; what I find particularly alarming is this half-measure situation we increasingly find ourselves in, wherein the state farms out the drudgery of being a state but reserves to itself the prerogative to govern by obscure fiat. Institutions like SAIC aren't accountable in a way that gov't agencies at least theoretically are, yet the continuing existence of those agencies amidst this move toward privatization perpetuates this increasingly mythical idea of "accountability." If everything's going to go private, fine, whatever, let's make a go of it, and no one can tell me what software I can/can't use and how much I can/can't deposit, etc.; OTOH, if the USG wants to reserve the right to tell me what I can and can't do in these regards, then it had bloody well better submit to the "responsibility" that goes with that "right": accountability to the electorate. Why do you think the spooks make such prodigious use of cutouts? In part because it's an effective way of evading detection; and, unfortunately, oversight is a subset of detection. I'm sure SAIC does tons of perfectly legitimate contract work--but I'm equally sure that it does tons of covert work. And far too much covert work is covert for no other reason than it's stupid (read my lips: "exploding giant clams") or--in the case at hand--something that a rapidly growing sector of the electorate rightly regards with suspicion. Ted

1 0

Cypherpunks Moderated: Avoid This Thread
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Anon wrote: >"According to the group's moderator, who prefers to remain anonymous, > `The most important means to the defense of privacy is encryption. > Cypherpunks are therefore devoted to cryptography. They wish to learn > about it, to teach it and to implement it.'" > >Ok, since when is the Cypherpunk's mailing list moderated? Ummm, anyone seen L.D. lately? Just wondering. Don

1 0

Follow-up to sci.crypt posting that prompted NYT article
by rubin＠faline.bellcore.com 17 Dec '03

17 Dec '03

Yesterday, a New York Times article cited a posting by several graduate students at Berkeley about the insecurity of the Internet. We found the sci.crypt posting very interesting and relevant because we spent a good portion of the summer working to address the same problem. Namely, detection of the malicious (or other) modification of an executable in transit over an untrusted network. In particular, we believe that our system could be used to solve the NFS problem mentioned in the posting from Berkeley. Our paper can be accessed at ftp://thumper.bellcore.com/pub/rubin/stretch.ps Avi Rubin <rubin(a)bellcore.com> Trent Jaeger <jaegert(a)eecs.umich.edu>

1 0

Re: PC disk wipe software
by GreggMan＠aol.com 17 Dec '03

17 Dec '03

In a message dated 95-10-09 12:34:33 EDT, you write: >>PC Tools has a wipe program that will either wipe individual files, or >>wipe all unallocated diskspace. It also allows you to choose the level >>of wipe (single overwrite, multiple, etc). > >There has been considerable discussion on the MCIP list about how most >*Mac* programs that purport to do this, like Burn, for example, leave stuff >over in disk blocks. My understanding is that this is not a trivial >problem, and it occurs in MUSH-DOS as well.... > >Cheers, >Bob Hettinga > > Actually not a problem for mess-DOS: just overwrite to the next multiple of the allocation unit size. Trivial indeed. What you must *not* do is just write to the end of current file ... you have to extend. Good idea too is to flush file buffers/reset disk subsystem before the next file writes so that buffer garbage doesn't get stuck in at end of last sector(s) of new files.

1 0

Re: PC disk wipe software
by GreggMan＠aol.com 17 Dec '03

17 Dec '03

In a message dated 95-10-09 22:07:18 EDT, you write: > >Archive data off to tape, low level format drive using the bios hd utils, >reformat drive, restore data. I find the non graphical AMI bios very useful >for this. > >Doing anything else fails to remove the old data on partially used but valid >blocks. > > Why do people insist this is the case? ABsolutely not true under MS-DOS. I haven't personally verified under a VxD file system (like 32bit disk access) but ask yourself: if I expand (by appending new garbage data) the current file to the next allocation-unit boundary, will that overwrite the tail blocks of the current file???? Folks: it's sooooo easy.

1 0