December 2003 - cypherpunks-legacy

Karl Hess - L.A. area meeting
by J. Kent Hastings 17 Dec '03

17 Dec '03

-- [ From: J. Kent Hastings * EMC.Ver #2.5.02 ] -- -----BEGIN PGP SIGNED MESSAGE----- "Extremism in the defense of liberty is no vice, and let me remind you, moderation in the pursuit of justice is no virtue." -- Aristotle, and a Goldwater speechwriter, but not Karl Hess. Politically Barry's Boy, Karl was often credited with Goldwater's most famous line, but he denied it when interviewed. Karl announced his Libertarian position in the book \Dear America\, followed by \Community Technology\, and \Capitalism For Kids\. --- T H E K A R L H E S S C L U B --- now in its second year of almost monthly dinners, invites you to its sixteenth meeting on Monday, October 16, 1995. New Developments In Conspiracy Theory, Part II O N E B A N K T O R U L E U S A L L Last month we heard some "Conspiracy Classic." For Hallowe'en Partyarch, Paleolibertarian and Agorist tell us what's at "stake" in the latest Bankster cannibal bloodfeast and summon Murray Rothbard back from the grave to repel these vampires with a Cross of Gold! Place: Marie Callender's, 4356 Lincoln Blvd., Marina del Rey (at west end of Marina del Rey [90] Fwy). Time: 7:00 p.m. for dinner; 8 p.m. announcements; 8:15 program. Speakers: Wally Conger, SEK3, and Bob Weber. Charge: $13.00 for program with buffet dinner including full-salad bar, roast turkey entree, and choice of three pies for dessert. Tax and tip included! Next Month: J. Neil Schulman Fires Back with \Self-Control, Not Gun Control\. Coming soon: Robert Anton Wilson, Dr. John Hospers, and Brad Linaweaver. Posted by J. Kent Hastings, zeus(a)pinsight.com http://www.pinsight.com/~zeus/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIDNTzTxxI221vktAQESEgQAnojLCPg0+43EGBtYSMQHr34CvWs0Xc5U 2LidnuEI9w9awBiBuuVWuWfVk7YEpq2UWIe1Xr/8jZoWtjpEkIeLQRjt9D2WQHml Vt2MiuIXbpcuc7GAhio7gMC7M5rsIVoxD6xd6MthcDOhbUa61a7xVma/QhIyyhcK 17MhZMeBl8Y= =wGp1 -----END PGP SIGNATURE-----

1 0

Idea Futures
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:03 PM 10/14/95, s1018954(a)aix2.uottawa.ca wrote: >On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > >> I have a better idea. How about an open market in break-in >> software. We crack Netscape and offer the crack code to the highest >> bidder. Bids start at US$25K per hole. For the insult, Netscape has to >> outbid the competition by a factor of 2 to get the details of the hole. >> Here's how it works: >> >Funny that you mention it, the other mailing list (or rather set of lists) >I'm on is devoted to a just such market system. The Idea Futures home page >is at http://if.arc.ab.ca/~jamesm/IF/IF.shtml. You'll find a few familiar >faces. Robin Hanson, who developed (so far as I know) the modern focus on idea futures, was an active Bay Area person. His interests parallel ours, and I think he was on the CP list for a while back in '92. (Some of his game theory simulations--on betting markets and preference-revealing--were a main inspiration for the "Crypto Anarchy Game" I put on at the first Cypherpunks meeting in '92.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Netscape rewards are an insult
by fc＠all.net 17 Dec '03

17 Dec '03

The idea that Netscape (like Microsoft) thinks they can get free testing services from all over the net by real experts just by offerring a tee shirt is down right offensive. I have a better idea. How about an open market in break-in software. We crack Netscape and offer the crack code to the highest bidder. Bids start at US$25K per hole. For the insult, Netscape has to outbid the competition by a factor of 2 to get the details of the hole. Here's how it works: - We get a panel of 5 cypherpunk judges who test each claimed hole. - Exploit code is sent to the panel for verification. - If they verify the hole, it is put up for bid. - Winning bidder gets the code for 3 months before it is released on hacker BBS systems throughout the world. - The panel of judges splits 25% of the money paid for the code as pay for their efforts. The rest goes to the author. I have an even better idea. How about if Netscape gets some competent programmers with real security expertise, adds in some good change controls, a serious internal testing program, quality control ala ISO-9000, internal IT auditors, external IT auditors, training and education for their employees, and everything else it takes to be in the software business in a serious way. As an alternative, we could help them contact the shareholders for a lawsuit. After all, they are a public company now and are responsible to the shareholders for the value of their stock. If it goes down because they aren't doing an adequate job of software quality control, the officers may be personally liable. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

7 8

Guess what I found...
by Donald M. Kitchen 17 Dec '03

17 Dec '03

From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,alt.fan.bill-gates,alt.privacy Subject: Re: Microsoft Network: Hard Drive Raid Date: 11 Oct 1995 23:59:58 -0700 Message-ID: <45iede$dp2(a)Networking.Stanford.EDU> References: <45h0v7$579(a)news.corpcomm.net> rryan(a)blackhills.com (Richard Ryan) writes: >Had my first hard core, proveable case of MSN reading someones drive. Store >Client had entered fantasy company name upon installing a program. Forgot about >it, didn't tell anyone. 2 days after downloading a simple text file from MSN a >junk mail offering from Pitney-Bowes showed up in his snail mailbox addressed >to him c/o the fantasy company. Somebody is playing somewhere they shouldn't >be. Any comments, Microsoft? I registered as Richard E. Graves (changing middle initials and adding an unnecessary suite number to your address are good ways to track who has been selling whom your address). Richard E. Graves also received mail from Pitney-Bowes. Microsoft says they don't sell their mailing lists. Clearly, someone has taken advantage of security holes in the NT servers that make up MSN and *stole* the mailing lists. Maybe unauthorized external access accounts for the abysmal performance of MSN, in part. -rich moderator of the win95netbugs list http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html

2 1

Re: PA Remailer Concerns
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Has anyone examined the legislative history associated with this statute? I would be surprised if they were singling out anonymous remailers. They may have had other concerns regarding phone abuse, e.g., long distance fraud. Then again, I could be full of it...

6 5

proposal: "security spectrum scale" (SSS)
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding the recent Markoff NYT article on NFS weaknesses, I agree it seemed to be overblown. but in fact I have been betting that feeling from *all* the recent articles on the netscape bugs etc (egad, am I mistaken, or whas there front page NYT coverage for a *buffer*overflow*? at least there was for a single *poorly generated random seed*!!). for example, in another, the fact that netscape had a buffer overflow in URLs was translated by a reporter into "a similar bug was used by Robert Morris in the infamous worm that infected the entire internet a few years ago" or something similar. it seems to me what is lacking in all this is a *security spectrum*. unfortunately security experts sometimes have a tendency to equate *any* security weakness with a catastrophic one. while this is a good approach in general, i.e. to be as conservative as possible, in practice there can be no doubt that some security weaknesses are far less severe than others. if the security *experts* conflate the issue of the *severity* of a security breach (and I see this happening all the time on this list), there is little surprise that reporters aren't figuring it out either. some of the really obvious example of the kinds of differences in security that are being conflated: client vs. server problems (server problems are far worse of course; the netscape bugs were mostly *client* problems), subnet vs. overall network problems, bugs that allow people to merely crash a system vs. submit arbitary code, etc. to aid this serious problem, I propose the creation of a UNIFIED SECURITY SPECTRUM RANKING. this would be a list of all the different types of security weaknesses a system can have, and their LEVEL OF SEVERITY. it would attempt to rank every type of security breach possible. then, when a new security weakness is discovered, it could be ranked A1 or B5 or C6 or whatever. this would be a sort of technological "richter scale" that would allow the novice to immediately understand that a given bug that was recently discovered (say, the recent netscape bugs) was, say, not really as potentially severe as the Morris worm. a press article might say something like, "the recent netscape bug was ranked a B5 on the security scale by experts. this means that an unauthorized intruder could break client software. the bug could potentially be as serious as A3, meaning that arbitrary code could be submitted. the other bug was classed B3, because it allows the detector to grab unauthorized data, but still be detected in doing so." etc!! I think it is pretty obvious how much of a positive effect this could have in quantifying and tracking and publicizing new bugs. it might make it impossible for a reporter to give an improperly alarmist position. for example, no one would take seriously an article that gets excited about a 3.6 richter scale earthquake. similarly, the reader might be able to draw his own conclusions if we came up with a sufficiently universal scale and it is widely used in articles. furthermore, this scale would tend to help the reporter/editor immediately know if a given bug report is newsworthy (if they continue to enthusiastically report bugs, although I wonder if this is a fad that may die out). and ultimately it might really help the issue of "proper attention to bugs". the public is getting a scare story for almost every new bug, and this is just not appropriate. to use my tired analogy, it is like the media putting every dinky earthquake item on page 1. another idea behind the rating: it might be a sort of matrix format, such as "a-6-alpha" where each of the elements indicates some kind of independent factor. for example the "a" might mean "client side", the "6" might mean "crash only", the "alpha" might mean "breach cannot be detected after the fact". however it shouldn't be so complicated that the novice can't immediately determine which of two rankings is more severe. now, I am really rather surprised that no such scale appears to exist currently. I highly suspect the NSA probably has a system for this but unfortunately it is not being used by CERT or anyone else that I know of. if anyone does know of this kind of "security spectrum", I think our cause of trying to improve software security would be furthered immensely if whenever reporters call about bugs, the scale factor could be consistently and uniformly used in association with trying to describe the severity of the bug. I am willing to work on a beta version of this "security spectrum" if there is sufficient interest. it certainly seems like a far better and worthwhile investment of time than, say, "the geek code", the latter of which is already highly developed!! I don't really consider myself the best qualified in terms of experience but sometimes if you want something done, you have to do it yourself. however, if we do this, I hope that a good scale that is pretty general and doesn't need extensions can be done from the start, before its widespread usage, so that later changes do not confuse users. there is already confusion in the media about two slightly different richter scales, this is a pity. another neat perq: if the cypherpunks come up with a good scale, it could be a tremendous positive publicity tool. "today experts discovered a bug in -x- that rated a -y- on the CSSS (Cypherpunk Security Spectrum Scale)" generally, regarding cypherpunk priorities, I think the "media can be made our friend", but we just have to learn how to be more meticulous and careful in our interactions with them. in general I don't really think a lot of the misreporting going on is the fault of the reporters involved. it's not surprising they get their stories mixed up, when, IMHO, even the "experts" they quote aren't particularly polished and don't really have their act fully together (or at least, tend to misrepresent the problems from the beginning). (most of the last Markoff article imho can just be chalked up to, "two prestigious graduate students who discovered something significant recently wrote a message warning about another significant security problem." it shows how absolutely critical it is to be careful what you say once you have built up a bit of a reputation. these two grad students are now being watched as the Chicken Little's of Cyberspace by the media, unfairly or not. be careful about wishing about fame, or anything else!! you might get it!! makes me a bit nervous about causes *I* have promoted in the distant past.) --Vlad Nuri

2 1

airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Roy M. Silvernail wriote: >Have you flown recently? They now ask you this scripted question about >whether you have been approached by anyone you don't know since arriving >at the airport, and warn you not to accept anything from a stranger or >leave your carry-on baggage unattended until you board the plane. The >ticket agent told me it was a "new FAA regulation". I hadn't flown >anywhere for a few years. Anyone know how long this has been happening? > Goodbye freedom, hello police state. >I wonder how long before I need a passport to cross a state line... The US is merely trying to catch up to what the Europeans have been doing for over a decade. In fact, the US still has a way to go. You ought to pass through Heathrow in London some time to see what real airport security looks like. The US security changes are a recent response, starting after the World Trade Center bombing and being stepped up on a continuing basis. Today you need a picture ID to board with your ticket. Tomorrow...? We have lived in relative safety compared to the rest of the world, but I think those days are over. Usual disclaimer. Bob Bruen.

5 4

Re: responce to graphic encryption replies
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

> ... The graphic file is going to have a highly correlated > structure, long runs of white space etc. This is not the case for digital imagery. For any given band, if you sample a significant portion of the image it would not be surprising to see a more or less random distribution over the range. > The statistics for such a file > would be different than the random distribution you'd get from using the > wrong key. If you decrypt with the wrong key, do you get a random distribution? Would this be the case for all wrong keys? Would the statistics change in any discernible pattern as the keys got "closer"? > Even if the graphics format is compressed, leading to a more > even distribution, ... This may give a better result. Most compressions involve a shift to the frequency domain with a quantization of the samples. You might be able to write a detector based on this discontinuity. You could also try throwing an edge detector or some other morphological recognizer at the output. It would still be cheaper than having to a man in the loop, but you're going to spend a lot of cpu time. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

2 1

Re: Certificate proposal
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGF06D.HGJ(a)sgi.sgi.com>, daw(a)lagos.CS.Berkeley.EDU (David A Wagner) writes: > In article <199510120147.LAA13833(a)sweeney.cs.monash.edu.au>, > Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: >> What you are missing is that you should not say >> "I want to send my credit card number to Egghead Software" >> you should say >> "I want to send my credit card number to 12 34 56 78 9A BC DE F0" > Why does this sound so much like defining the problem away? > Maybe I just don't get it... I agree. Sending your cc# to a key or an IP address is not what you want to do. As a consumer, I want to make sure that I send my cc# to the merchant I am buying from. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

I want to learn!
by Leo_Martensen_at_~~HEID-DHS＠ccmail.odedodea.edu 17 Dec '03

17 Dec '03

>From: VINCENT810(a)aol.com >Message-Id: <951017234254_126621887(a)mail06.mail.aol.com> >To: Cypherpunks(a)toad.com >Subject: I want to learn! >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. Me Too, I'm catching on but some help would help ! Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu

1 0