December 2003 - cypherpunks-legacy

[NOISE]Re: AUTHOR A VIRUS, GO TO JAIL
by RobL 17 Dec '03

17 Dec '03

At 10:08 PM 11/30/95, Michael Coates wrote: >Found this intersting too. US Position? > >AUTHOR A VIRUS, GO TO JAIL >A computer cracker last week became the first virus writer sentenced to a >jail term under Great Britain's Computer Misuse Act. The 26-year-old >perpetrator was sentenced to 18 months in jail after pleading guilty to 11 >charges connected with placing virus-infected programs on computer bulletin >boards. (Investor's Business Daily 29 Nov 95 A6) Gak.. glad I don't live in G.B. as I have had as many as 700 virii available for download on my BBS.. wonder how long it will be before the start to prosecute authors for writing buggy software ;) ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

GAK, Netscape, CyberDog, and you.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Hi Semper Fi-ers! I've been lurking on this list for a long time, and I haven't said much here primarily because I'm not a developer. I mean, I've hired developers, and sold the software I've had them build for me. Not very well, I might add, which is why I try do something else (talk and write) for a living now. Frankly, I couldn't code my way out of a paper bag, which, of course, is why I've not said much here. :-). Anyway, something has come up which I think makes the world very interesting, and I think you should know about it. Netscape has come out in favor of what the government calls "key escrow", but which most "cypher"-punks (and I seem to have become one over the last year and a half) call GAK, for Government Access to Keys. Here's the URL: http://www.cnet.com/Central/News/govt.html . This is a news report of a speech that Jim Clark gave at a trade show in Boston this week. Normally, as serious as this is in the rest of the world, that wouldn't really rate a mention here, except for the fact that this presents a very interesting set of opportunities for the *independent* Mac developer community in the form of CyberDog, Apple's set of OpenDoc parts for the internet. I'll get to that in a moment, but first, let me give you some background on the problem. Netscape's Jim Clark has quite a tightrope act going. He has a stock price which gives Netscape a P/E ratio of something like 7,000 (the S&P average right now is about 14), which means he really ought to get some revenue in the door, or his investors are going to have his hide. The next thing is, the government is a *really* big customer, and *they* want GAK, in case you haven't noticed. ;-). Couple this with the fact that Netscape is pretty much replicable by concentrated developer effort because its underlying technology is an open standard, *and* the fact that any significant attempt by them to create any real proprietary standards on the internet is practically impossible in the long run, unless they get a whole lot of very big customers in a hurry. Now, it looks like that's what happened already, because a lot of very large companies have signed on to using Netscape servers, but you can also see how really weak Netscape's position is when Uncle Sam knocks on their door and asks for a key escrow "bug" in every "secure" Netscape web session. This isn't the first time that Netscape has had problems with financial cryptography and the law. Netscape made the papers recently because the government-mandated SSL key-size in their export version was too small. (We won't talk about the cognitive dissonance between the words "export" and "internet" just yet...) The "export" version of Netscape Navigator got cracked by a French grad student in a university computer lab, who broke it just by running a bunch of background processes on his Sun workstations for a couple days over a weekend. The ITARs, the arms export laws covering this (cryptography is legally a munition, more cognitive dissonance), are a now problem for everybody who wants to do business securely and safely on the internet. More to the point, since digital bearer certificate technology, the most economical method for doing business on the net, is entirely based on digital signatures, which in turn are entirely based on very strong public key cryptography, all business on the internet will eventually require very strong cryptography. In other words, if you don't have unbreakable key sizes, you can't issue digital certificates to pay for things with. It would be like having paper money which is easy to forge. Lately, I like to say that "Digital Commerce *is* Financial Cryptography", and it's true. First Virtual has the only truly "out of band" internet transaction settlement mechanism, it's very well-designed, and very robust, but you have to remember that they did it *because* of the ITARs, and the complications for financial cryptography those regulations cause, no matter how much First Virtual itself likes to "dis" financial cryptography as a concept. Unfortunately, the transaction costs on such out-of-band methods are always going to be higher because of the inefficiencies of not instantly settling transactions, like you can with something like digital cash. When you buy something in the store for cash, you initiate, settle and clear the trade all at once, right there at the cash register, without an audit trail to maintain. Frankly, *any* credit card trade is really an "out-of-band" method, because it has to go off of the net to clear and settle, with audit trails, and the overhead of their offsetting book-entries. Fortunately, as governments start to figure this out, they will have to stand back and let the economic train go by, so to speak. So, having said all that, let's talk about OpenDoc and CyberDog. I hear that with CyberDog, building a secure Netscape-compatible browser in OpenDoc is now pretty simple. That adding economically useful -- and interchangable -- functionality like strong encryption, digital cash protocols and most of the tools of digital commerce is also pretty straightforward. That is, even though they have to be developed separately, because Apple justifiably doesn't want to have the ITARs limiting its export market for both OpenDoc and CyberDog. Again that cognitive dissonance between "export" and "internet". In addition to building utterly secure browser-server links, I see some interesting OpenDoc digital commerce applications coming out of a Netscape-compatible browser. My favorite "flash" on this was imagining the ability to drag Digicash ecash dollar bill icons out of a wallet and dropping them on a cash-register icon in a web page to pay for a transaction. That's certainly doable with OpenDoc and CyberDog. In addition, the IETF has just promulgated a secure link-level encryption standard called IPSEC, which allows for encrypted links between any two machines on the net, with any cryptographic method you want. That looks like a great Open Transport Streams Module project to me. And the wierd thing is, once IPSEC is out there, GAK in Netscape becomes moot, anyway. Netscape can only shoot itself in the foot here, and it looks like they already have, with a premature announcement of GAK. One final thing about Netscape. It's not their fault. There is no evil man-behind-the curtain in all of this. The government's doing what it thinks necessary for the preservation of order, and thinks it needs GAK to do that. Netscape is doing the best it can for its (newly rich) stockholders, and thinks it needs to comply with Uncle Sam, which it probably in fact has to do, or burst it's stock market price sooner, rather than later. Also, there is no reason why Netscape can't make a Navigator OpenDoc part, and I expect that they are planning to. I bet that Apple would really like that, and as a matter of fact, is probably courting Netscape to do exactly that. But I also know that by using OpenDoc and CyberDog, that the user can create a very easy to use, flexible, extensible, and *powerful* internet environment. Being there first with a Netscape-compatible browser, especially one that doesn't have GAK built into it, will be worth a whole lot in the marketplace for any enterprizing independent OpenDoc parts developer. I'm going to be giving a talk on Wednesday at noon at Apple's Town Hall, (4 Infinite Loop) in Cupertino about what I'm calling "geodesic" markets, that is, financial cryptography on the internet. The URL for a web page with all the details is http://thumper.vmeng.com/pub/rah/talk.html . In addition, if you want more stuff on financial cryptography, you might want to try my e$ home page, which is in my .sig, below. Finally, I've asked an *actual* financial cryptographer, Eric Hughes, who many of you may know from the cypherpunks mailgroup, and from the Clipper fight, to show up at the Cupertino talk and bail me out on the real hard questions. Well, that's about it. Oh. The talk is titled "Financial Cryptography for Dogs". I think you can see why, in light of the events of the last week, it's quite appropriate. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: nsa and netscape
by loki＠obscura.com 17 Dec '03

17 Dec '03

Could we have a source or a confirmation of this. It is a conspiracy theorists wet dream, so I will reserve judgement until there is more evidence that this is true. -Lance At 4:31 AM 12/1/95, Bob Bruen, MIT Lab for Nuclear Science wrote: > The following came from a government source. I thought it might be of > interest. > Bob >-------------------------------------------------------------------------- > > At yesterdays FNC (Federal Networking Council) meeting it was > mentioned in passing that NSA has given Netscape a grant of $5 Million > (yes $5M) to beef up the security features of Netscape. More info will > be forthcoming on this. ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Netscape gives in to key escrow
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [Warning: More linguistic than crypto relevance follows.] Tim wrote: <snips> >At 10:45 AM 12/1/95, JR(a)ns.cnb.uam.es wrote: >>With regard to all this waving about Netscape giving in to key scrow... > >Key _escrow_, though "scrow" is perhaps just as accurate as the >improperly-named "key escrow" Indeed. One of the main libertarian objections to the term "key escrow" is the "it's Newspeak" objection. "Escrow" [from the Hypertext Webster Interface at http://c.gp.cs.cmu.edu:5103/prog/webster?escrow ] means: __________ 1. es.crow \'es-.kro-, es-'\ n [MF escroue scroll] 1: a deed, a bond, money, or a piece of property delivered to a third person to be delivered ^^^^^^^^^^^^ by him to the grantee only upon the fulfillment of a condition 2: a fund or deposit designed to serve as an escrow 2. es.crow \es-'kro-, 'es-.\ vt : to place in escrow __________ [emphasis added.] The number of cases that begin: "US v. ___," or that end: "___ v. US," puts the lie to the idea that the government could somehow be *any sort* of a "third person" in many of the cases that come before the (government employees, albeit with some autonomy, known as) judges. Mine is, of course, the libertarian view of "the government as one giant blob," as opposed to various contrary views of "the government as many wonderful-but-separate agencies who are all just trying to do their best." My view, while certainly not the majority view, is pervasive enough that [IMO] the current government terminology of "key escrow" *should* change to a less Orwellian term. > (hint: escrow is something done voluntarily, not the situation here > with GAK). I liked the term "FUCKED" better, but I guess I can settle for "GAK." JMR Regards, Jim Ray -- http://www.shopmiami.com/prs/jimray Al Gore's mission is to reinvent government. He seems to have started with the office of the vice president. His staff is 48 percent larger than Dan Quayle's was. -- Reason "Brickbats" October, 1995 issue. - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL - ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBML9Lp21lp8bpvW01AQENGQP/XDh27QPgG/XkyYEHA255ij7fV1yrGKnO iGlWPFEzEnewoBWcJChIjDA4jTDJFiGT2D6VlEG8V8OyFPoHmdYPhkDGbIixjHE+ ZZMrWrzmbgiijLU9+Fp4Ib3cQibeefQY1HpmZ3wGd/3mLpu5gCtU8t3/Xx5PcZSF ueAU57DmJO8= =zVa0 -----END PGP SIGNATURE-----

1 0

Re: GAK Flap Happening at a Good Time--Journalists Read!
by James A. Donald 17 Dec '03

17 Dec '03

At 03:01 AM 12/1/95 -0800, Timothy C. May wrote: >I hope the media types reading now will attend the December 5th (I >think...details should be available) gathering on "key escrow" in >Washington. D.C. This should be a fiery meeting, especially if the Netscape >reps (I assume someone from Netscape will be attending, given their central >role in the all-important Web world) either denounce GAK or support GAK. I will prepare the netscape dehanced dirty pictures web page, but not advertize the URL until shortly after December 5th. I hope to hear a suitable "clarification" before then. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

7 17

GAK Flap Happening at a Good Time--Journalists Read!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:43 AM 12/1/95, Leslie Todd Masco wrote: >I've been told that many media-types go to the archives whenever c'punks >make the news. How much of an effect do y'all think it'll have if they >can't do it with Netscape? Even better, let's see the journalists get the story first-hand. I hope the media types reading now will attend the December 5th (I think...details should be available) gathering on "key escrow" in Washington. D.C. This should be a fiery meeting, especially if the Netscape reps (I assume someone from Netscape will be attending, given their central role in the all-important Web world) either denounce GAK or support GAK. Frankly, and my thanks again to Sameer for bringing this to our attention, this flap over Jim Clark's GAK-supporting remarks could not have come at a better time: the issue of GAK will not be ignored. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Barring access to Netscape
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 0:32 12/1/95, Ed Carp wrote: >If you want to bar access to your site from a Netscape browser, such >can easily be accomplished. If memory serves, every browser, when >connecting to a site, exchanges certain information about the client >with the server. One can gain access easily to that information. > >I believe that Netscape uses "Mozilla" as their keyword when >exchanging browser-specific information. If you want to see one way of locking out Netscape users, check out this URL which points at a Web Page that will not allow access by Netscape Users (the guy is ticked off at them trying to establish their own standards) - http://www.ccs.neu.edu/home/ratinox/angels/

1 0

Re: CPunks in the news: St. Jude
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:12 PM 12/1/95, Jim Gillogly wrote: >Today's (1 Dec 95) LA Times has a writeup on female "hackers", and gives >several sympathetic column-inches to St. Jude Milhon, a charter Cypherpunk. >Evidently she has a new book coming out (Girls with Modems?). I saw a book yesterday along the lines of "Girl Hackers" (or should it be the Cybernetically Correct "Grrl Hackers"?) I forget the exact title and author, but it's written in the typically breezy, cut-and-paste style pioneered by Stewart Brand and Ted Nelson and now apparently the only acceptable form for anthing connected to the Net. Interviews with Jude Milhon and Romana Machado (aka "Cypherrella"). (For more on Romana and her Cypherella personna, see http://www.best.com/~fqa/romana/) I didn't buy it, though I did buy the "Cyberpunk's Handbook" a few months ago. It was co-authored by Jude, with Eric Hughes as the cover model. Others have reviewed it here recently. And Jude has another book coming out, something like "How to Mutate and Take Over the World." Personally, I find it distasteful--just my opinion, with no aspersions cast on Jude, Romana, Eric, Robert, etc.--that so much blatant self-promotion is becoming the norm. (Yes, I know I agreed to be one of the "cover models" for the issue of "Wired" on "Crypto Rebels," but this was almost 3 years ago and I think now I wouldn't agree to it--in fact, I've turned down a dozen requests for interviews recently, feeling the planned interviews were fluffery and not substantive.) It seems that the media loves to see the extreme side of people, and encourages really strange antics and bizare self-labelling. The glut of Internet magazines ("Wired," "Net Guide," "Infobahn," etc.) and the even greater glut of pop culture mags with Internet connections ("Raygun," "Detail," and a dozen others, mostly with Traci Lords or Sandra Bullock on their covers) means there must be some appetite for these personality pieces. And the more outrageous a personna, the more coverage. (Recall that one Cypherpunk list reader saw the British t.v. show that covered Cypherpunks and mentioned "a porn star named Cypherella who writhed on the floor while describing PGP"...I didn't see this show, but I presumed he was seeing Romana in her "crypto bondage and discipline" outfit. I count Romana as a friend, though I haven't seen her in a long time, but I _personally_ am slightly embarassed at this sort of thing...again, no aspersions cast against her choices in life.) (I expect this will find its way to Romana--Hi, Romana!--courtesy of her friends and/or of search engines like Deja News, and I suppose I really should take this out so as to avoid any hard feelings. But, I guess I won't. Jude, Romana, Lisa Palac, and all the other "cybergrrls" are just players in the media fascination with such things. To each their own. I don't have to buy the books or magazines which extol them, so all is well.) The "cult of personality" is alive and well in cyberia. --Tim May, expecting some angry e-mail over the next few weeks Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: key for Alice as promised (not)
by Thomas C. Allard 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If Alice is so afraid of using PGP, then he's sending his messages through the remailer chain unencrypted (if it even goes through a chain). In that case, the FIRST remailer knows who Alice is... it sees his message, the final destination, and Alice's real address. rgds-- TA (tallard(a)frb.gov) +-+ I don't speak for the Federal Reserve Board, it doesn't speak for me. |X| pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D +-+ -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBML9awKAudFplx0TNAQFUZAQAqjrSOlgy7erUi8eDqdWUNkuVgDBLiJk8 dkxaiTU4pbw+hpQzfydMipxJi3VxVuDiL54k7jEM8NoTPFZTQWPB1NuzOGIvBHPy FvxX3ojlk53/1ZYJBQaoy5eiYaGpyS/KgmLI0XCitT4h3LHNcVk6UrM7PQNURLWK DETslOeBykM= =A3Vf -----END PGP SIGNATURE-----

1 0

available news/mail filtering
by Beavis B. Thoopit 17 Dec '03

17 Dec '03

What news and mail filter programs are available? Pointers will be appreciated. If inclined, please give some pros/cons of your favorites. Thank you for your help in this matter.

4 3