December 2003 - cypherpunks-legacy

Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

In light of the continuing vulnerability to long user input, I humbly offer the following aphorism, suitable for display on all Netscape programmer cubicles: Copy strings with strdup, not strcpy.

1 0

House Intelligence Committee Press Release
by Dave Del Torto 17 Dec '03

17 Dec '03

INTELLIGENCE COMMITTEE OFFERS ALTERNATIVE ENCRYPTION LEGISLATION TO ADDRESS SECURITY CONCERNS SEPTEMBER 11, 1997 CONTACT (202) 225-4121 The House Permanent Select Committee on Intelligence (HPSCI) today approved, by voice vote, legislation proposing an alternative to pending encryption legislation, known as the "Security and Freedom Through Encryption Act" (H.R. 695). The HPSCI amendment in the nature of a substitute to HR 695 proposes safeguards in the law to meet national security and law enforcement concerns in the debate over the future of United States Encryption policy. "All members of Congress, and particularly those of us on the Intelligence Committee, have a responsibility to find the proper balance between forward thinking commercial policies and the unquestioned need to protect the security of the American people and America's national interests. We are offering proposals to ensure that we do not plow full steam ahead into the 21st century's information age having seriously weakened our ability to protect the national security, " said HPSCI Chairman Porter J. Goss (Fl-14). "American citizens have a right to their privacy and their access to the freest possible markets. But they also have a right to their safety and security. Terrorist groups that plot to blow up buildings; drug cartels that seek to poison our children, and those who proliferate in deadly chemical and biological weapons are all formidable opponents of peace and security in the global society. These bad actors must know that the United States' law enforcement and national security agencies, working under the proper oversight, will have the tools to frustrate illegal and deadly activity and bring international criminals to justice," Goss said. "The bill referred to the Intelligence Committee attempts to deal with complex issues. The substitute adopted by the Committee addresses the legitimate national security and law enforcement concerns that are simply not addressed in H.R. 695. In that respect, the Committee substitute, in my judgment, furthers the debate on these important matters," noted Ranking Democrat Norm Dicks (WA-6). The main elements of the Intelligence Committee's proposal are: * Requires exports of encryption products to submit to a one-time review and to include features or functions (that need not be enabled by the manufacturer) allowing for immediate access to plaintext or to decryption information; * Requires that encryption products manufactured and distributed for sale or use, or import for sale or use, in the United States after January 31, 2000 include features or functions that provide, upon presentment of a court order, immediate access to plaintext data or decryption information from the encryption provider; * Does not change law enforcement's statutory requirements prior to intercepting oral, wire, or electronic (wireless) communications, or law enforcement's requirements prior to obtaining stored data. Law enforcement will specifically be required to obtain a separate court order to have data, including communications, decrypted; * Allows for law enforcement access with delayed notification requirements, similar to those allowed in current wiretap statutory provisions: * Provide civil remedies and criminal penalties for unlawful access to or disclosure of plaintext or decryption information; * Require US government procurement of encryption technology that includes functions or features allowing for immediate access to plaintext or decryption information. "Our committee has weighed in on these issues in the interest of furthering the important debate now underway about how best to accomplish the multiple goals of a sound encryption policy. Any encryption legislation we consider must take a balanced approach to the national security, law enforcement, public safety and privacy issues at stake. Our action today marks another step in this process, which no doubt will continue to unfold in the days and weeks ahead. I look forward to working with all sides on this debate as we tackle this complex but important issue," Goss said. The HPSCI, which sought and received sequential referral of H.R. 695, is one of five House committees with jurisdiction on this issue. The Committees on Judiciary, International Relations, National Security and Commerce have also considered this legislation. The HPSCI expects to file its committee report with the House tomorrow, meeting its deadline for action set by the Speaker. -30-

8 7

Forwarding of Federalist Papers from Canada for U.S. Citizens promoting democracy
by Six 17 Dec '03

17 Dec '03

If you have a desire to educate the citizens of foreign countries as to the value of democracy, I would be pleased to forward a copy of the Federalist Papers to any email address you desire, upon receipt of only the email addresses, with no instructions or requests.

1 0

(noise) Subject: Married with Children (was: Re: Netscape closes up 1 3/8 today!)
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Christopher J. Shaulis <cjs(a)netcom.com> writes: > Yeah. Thats the way it works sometimes. I remember back when that > housewife from minnasota launched her media campaign to have "Married > With Children" taken off the air. All it did was make the show a > hundred times more popular and extend its life for years after it > probably would have been canceled on its own. Terry Rakolta is from Bloomfield Hills, Michigan, just a few short miles from where I sit, typing at my keyboard. After being offended by the episode "Her Cups Runneth Over", Rakolta took notes on things she found offensive in subsequent episodes and then mailed a complaint to Fox. Fox's reaction? According to executive producer Michael Moye, "Everybody did the manly thing which was immediately dive behind desks and point the finger at us. You couldn't get your legs under a desk for all the executives under there. You have never seen such wussing. And we're going, 'One letter? *One letter?*'" [emphasis his] The resulting media incident almost certainly increased the show's ratings, but it also brought the wrath of the Fox censor down on the producers. For an interesting account of this, see Playboy, July 1990, (the one with Sharon Stone topless on the cover ;), "Hanging out with the Bundys", Pamela Marin, p.114 et seq. Something else which has happened here in the Greater Detroit SMSA, just in the last few days, is the mother of a ten year old boy has demanded that _The_Stand_ by Stephen King be removed from the school's library after her son checked it out from said library. Turns out Stephen included some graphic descriptions of sex. The punch line, if you like, is that in tv news coverage the young lad was shown sitting in front of the tv, playing a Mario-like video game. Thank God they got that book away from him just in the nick of time, eh? He might be reading even as we speak! They walked still further and the girl said, "Is it true that long ago firemen put fires *out* instead of going to start them?" "No." -- Ray Bradbury ``Officer, officer, arrest that man! He's whistling a dirty song.'' -- Jean Ellison Crypto relevance? None. drc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGLunREcrOJethBVAQFnbwP/SI1df4BtSIOZryK+pcoatMy7jePQQF4W fj6cONy6ulf/0KqswS1md91qZMUKJ0EpCJGf+qbaXTblASCZ08spGlgZ3rp0yYiK wGlWEHxatgqbrSO6XKJAEAIccd2aArtpnWPBfnnXpCGaSXQ4lLrg+/a3b+q9JZ9m BvLSyhaTqkM= =Ijia -----END PGP SIGNATURE----- -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Strong Crypto Forwarding From Canada For U.S. Citizens
by Six 17 Dec '03

17 Dec '03

Anyone who wishes to export strong encryption to Internet addresses to which it is prohibited to do so by U.S. law may send a copy to me as a file attachment, along with the addresses to send it to in the message body. I will accept up to 100 addresses per crypto program received for forwarding. If for any reason you feel that the terrorists who are ruling your country might be able to persecute you for exercising free speech, I would be happy to forward PGP 5.0 upon receipt of only the email addresses, with no instructions or requests. SixUALDV8

1 0

business intelligence or BI
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

>It's important here to distinguish economic "espionage" and economic >"intelligence." > There is also the difference between the business intelligence and business espionage ! The business intelligence is used to collect, evaluate, analyze etc. the business information and data that may include competitors, markets, economic trends, suppliers among others. The sources of this information are publicly and legally available for all companies and individuals. The formal or informal business intelligence system can be used. The successful use of the traditional business intelligence will result in the best results, when this information and data is eveluated, analyzed and disseminated in the most intelligent, reliable, timely and accurate manner. 100% of companies are already using the business intelligence (all companies are just not calling it the BI): some more successfully than others. The business intelligence can be used both for strategic and tactical purposes. Regards, Mark

1 0

Re: Another Netscape Bug (and possible security hole)
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jeff Weinstein <jsw(a)neon.netscape.com> writes: > Not that I want to divert attention away from netscape(OK, maybe I > do :-) ), but does this bug exist in any other common browser? Lynx can handle it on the info page (reached by pressing '='), but: In response to selecting the long domain name found in the Warning link in http://www.grfn.org/~conrad/test.shtml, lynx replied: - - - Sorry, you have encountered a bug in Lynx Ver. 2-4-2 Please send a concise mail message to lynx-bug(a)ukanaix.cc.ukans.edu describing what you were doing, the URL you were looking at or attempting to access, your operating system name with version number, the TCP/IP implementation that your system is using, and any other information you deem relevant. Do not mail the core file if one was generated. Lynx now exiting with signal: 11 Exiting via interrupt: exit(0) - - - [No core file was generated] My system is: (uname -a) Linux russell 1.3.26 #2 Thu Sep 14 08:34:38 EDT 1995 i486 Netscape 1.1N for linux crashed in a way that locked my system up, and caused endless trashing. I had to reboot, but my filesystem was undamaged. Not sure why it crashed and burned on my system while others have gotten such nice SegVs and core files. I guess I managed to get just the right (wrong) thing onto the stack. :-) :-( (P.S. Whoops, just realized that I rebooted with a different kernel; Lynx did indeed crash under 1.3.26 (post-reboot), but Netscape crashed under 1.2.13 (pre-reboot). Pardon me if I don't re-try under 1.3.26, but having X lock up and hearing my disk trash is not something I relish.) drc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGLu1BEcrOJethBVAQEhwwP/cPZ2Gr/MClaywXEAtagNa7n5IyIsqFGI LmCDxjTMdK/zXzuPcU3Xa53QxOn4dSxQv2PRKHrLGSrVn5vvZHRiYmH5z4NgWvmJ ETFlFascANzqN2VbHgrn80u3RlFIH0UAUiTgoIFiJ4E3TUzrmt5w4qeXxvfA9PKQ LQi2oeIArS8= =EEup -----END PGP SIGNATURE----- Last line above should read: "hearing my disk *thrash* ...," not trash. Signing messages is non-trivial with my current set up, so I don't feel like re-doing it for such a minor glitch. -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Information Please
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I am interested in researching possible legal grounds for taking armed action against politicians governments and law enforcement agencies. I would appreciate any pointers anyone might be able to provide to any material of this nature. Of particular interest would be information as to the application of International law in this area. I am assuming of course that there must be some form of law somewhere which recognizes the right to resist oppression and violation of human rights by any government elected or not. Thank you. ps If possible I would like to receive this information before September 16th 1997 as it is a two day drive to southern California and I would like at least one day to rest.

5 4

YET ANOTHER BAD NETSCAPE BUG (no it isnt!)
by Ray Cromwell 17 Dec '03

17 Dec '03

Just another reminder that the second bug I posted about was a fluke on my system and not a real bug. I'm hoping that putting the reminder in the subject will stop people from forwarding it on to other lists before reading the retraction. Although this was a false bug, the overflow bug is very real and verified. -Ray

1 0

Netscape bug and the IMG tag.
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- You can plunk a nasty url into the SRC field of an IMG tag, thus eliminating the need for clicking on the offending url. Also, it makes it harder to check the html of a page. Check out http://www.redweb.com/experiment/bug2 html if you feel like rebooting. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMGMCc3If3YegbdiBAQFTMgJYsAEPkSWTtGDswAYpT1repQjd8n3unMg3 CIXNlxmg43BkMgyNRrqYP2P61aMJt4FwPZt+PgE4NYxVj6PzaPtsf/Y/6BSsWNxb cKcr =/ORS -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0