December 2003 - cypherpunks-legacy

experimental socks5 gateway
by sameer 17 Dec '03

17 Dec '03

so I've installed a socks5 server on infinity.c2.org, port 1080. Socks5 is available from coast.cs.purdue.edu:/pub/tools/unix/socks This is for experimental purposes only. Full logs are kept. It may go down at any time. It may not work. Your computer might blow up. etc. etc. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Re: Sun speaks out - but not to the cypherpunks
by todd＠lgt.com 17 Dec '03

17 Dec '03

Pardon the flame but I really have just about heard enough of this BS... >This response came from Sun to Risks: > >> Date: Mon, 16 Oct 1995 21:22:40 -0700 >> From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) >> Subject: Re: Risks in Java >> >> If we are going to "analyze" java security, let's keep in mind that there is >> an important distinction between the language (java) and the machinery which >> runs the java program. >> >> Java is a general-purpose programming language along the lines of C/C++. >> So, there is no doubt that its expressive power overwhelms our >> theoretician's abilities to predict java-programs behavior -- this is where >> we start getting into the halting problem, computability and other black >> magic. Basically, i don't think we can "trust" programs written in any >> *useful* programming language. > >Read: We can't trust Java programs. > >> The area where we can (must) build trust is the computing base. >> Traditionally, this has been the OS, but in the case of java, it is the java >> interpreter (such as netscape 2.0 and hotjava). The browser is now the TCB >> (trusted computer base) for all practical purposes... > >Read: The Java interpreter is supposed to be a TCB > >> And, to address the specific concern about applets spamming the net -- from >> what I've seen, applets are only allowed to connect to the server that >> supplied the applet in the first place (by default). The worst thing one >> could probably pull off is to spam oneself. > >Read: By default only - also note, none of this invalidates attacks 30-49 >from the previously posted list. > >Who here truly believes that the implementations of Java meet the >requirements of a TCB? > >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Dr. Fred, you seem to spend a lot of engery slamming Java and HotJava. Are you unaware that the HotJava Platform is the first generation pass at an inline extensible GUI harness. Underline the total concept "extensible GUI harness". This includes a series of tool functions to *help* perform secure messeging (like those supplied iun Netscape 2.0/Java.), but because of the enormity of the task and the number of facets on the face of this gem it will be some time before the final versions of the first generation will be available. No one else had been working on this piece of technology before SMCC started their effort. From the word floating about the SMCC labs they didn't even know what they had. So rather than slamming them, SMCC, or their PR folks for - releasing a version of a development tool far beyond what the "big boy's - doing what PR people do - Minimize and Maximize concepts in the press I hope that you understand my point?. The net/net is that OLTP needs to be scaleable to be a saleable commodity and without the ability to do "java-ish" like local applets... There is no clean way to do this, ***period***. Also that OLTP requires transport level security, transaction level security , and a whole lot of systems security and authtication. The browser is the harness not the complete tool suite at this juncture. As an aside - What blows my mind is the number of cycles people spend bitching and moaning about Java itself rather than working to create a better solution. I just want to say "Get a clue. Moan about something that is important and pertinent to the technologies at hand". These comments are my own - Sincereley, Todd Glassey todd(a)lgt.com

1 0

Lack of secrecy in U.S. Banks
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ph(a)netcom.com (Peter Hendrickson) writes: > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records As a former bank employee, I can assure all readers that privacy of banking records is non-existant. All you need is a friend who works in the computer, auditing, bookkeeping, or loan department (in that order of preference). If your friend has worked there long enough, he/she can probably also get informmation from any other bank in the community. (Don't suggest the security department. As far as bank transactions are involved, the Auditor normally handles that.) To reassure the excessively paranoid, bank employees are normally flooded with so much information per day that they normally take no interest in any more of it than their job forces them to. Moreover, when you consider that it is commonplace for a teller to handle total transactions daily than run well into six figures, few if any individual transaction attract any attention. Banking trivia #1: Banks are the only businesses that close their books daily rather than monthly or quarterly. Banking trivia #2: When choosing a bank, check out the Cash Over/Cash Under account on their balance sheets. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIpbMd74r4kaz3mVAQEi5QP+KYftQ3jKjWFbqqgH65tUB7sONx1poZV0 w8g5OdHlwpG+lU0HeqZlVPlJv+iqmGGo4hCN1sZ5z0LB3FDyeLlO8AQwBHPGadGB dYUtMhq4gpJEpjJba9jdH7neu57j94/S+3Y0lYA0y/ZqJxbwRRntLMJzAZ0RozDH SsJsLn/tOlo= =N8mQ -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

No Subject
by ibg＠oro.net 17 Dec '03

17 Dec '03

Very interesting article on offshore banking. Can you suggest a reading list or source of additional information?

1 0

Reducing the Flames, Attacks, and Nit-Pickings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:18 AM 10/22/95, Todd Glassey wrote: >As an aside - What blows my mind is the number of cycles people spend >bitching and moaning about Java itself rather than working to create a >better solution. The recent flames and attacks are pretty typical of mailing lists, especially mailing lists having 1200 highly-opinionated subscribers (gulp!). Not that I like the flames, but they're not the problem I want to really talk about. A trend that bothers me--and others too, from comments here--is the intense "feeding frenzy" that is going on with each and every new product, from Netscape, to Microsoft Network, to Java, to Digicash. Don't get me wrong--finding flaws is a useful thing to do. But this list is becoming _consumed_ by the _process_ of attacking products. Worse, many of the attacks are by innuendo, by rumors and speculations about what features a product has. My comments will likely vanish without a trace, but I urge folks to hold back a bit on jumping in with attacks and reports of problems. Be sure something is _really_ a flaw before sounding the alarms. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

BlackNet in "Hardware"
by Jim Gillogly 17 Dec '03

17 Dec '03

I just bought "Hardware" (Delacorte Press, 1995) by Linda Barnes, one of my favorite mystery authors, and experienced a startled frisson when I saw that at least a couple of subscribers had their work immortalized: Tim's "Invitation to BlackNet" is the opening quote, and the date given is for L.'s widespread Usenet spam of Feb '94. No book report here, but it was as gripping as the rest of her efforts. It's "about" people rather than computer hackery, but the computery bits were done quite well. Does an Amiga 2000 <really> have PC and Mac compatibility options? I don't know, and it doesn't matter anyway. Jim Gillogly 1 Blotmath S.R. 1995, 16:48

1 0

Re: airport security
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:05 AM 10/22/95, Alan Horowitz wrote: >WHy should airplane crashes be more of a cause for disseminating the >Surveillance State than Greyhound Bus crashes? > >I'd be more sympathetic to arguments about an airline's right to write >it's contracts as it pleases. Though they are Common Carriers; they can't >just offer Contracts of Adhesion at will. No crypto relevance--my apologies. I am skeptical that the "all passengers must have picture IDs" has much to do with identifying corpses after crashes. The recent push is certainly associated with the various terrorist threats and incidents. The FAA can push for it, and the airlines have little to say about it. However, I read--probably in the WSJ--that the airlines see this as a chance to regain control of "ticket abuse." Corporations often have bought up discount tickets without knowing who willl be travelling and on what dates. This allows them to have a pool of tickets and saves them a bunch of money. Reports are that many people showed up at boarding gates with a different name than what the ticket said, and had to pay extra to get a current ticket (no advance purchase, of course). I'm not sure what the compelling lessons are, except that the "Identification Required State" is getting closer every day. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 3

Re: Reducing the Flames, Attacks, and Nit-Pickings
by carolann＠censored.org 17 Dec '03

17 Dec '03

It's good to see a real Californian fighting forest fires! Love Always, Carol Anne >My comments will likely vanish without a trace, but I urge folks to hold >back a bit on jumping in with attacks and reports of problems. Be sure >something is _really_ a flaw before sounding the alarms. >--Tim May >Views here are not the views of my Internet Service Provider or Government. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 | black markets, collapse of governments. >"National borders are just speed bumps on the information superhighway." -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: BlackNet in "Hardware"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:50 PM 10/22/95, Jim Gillogly wrote: >I just bought "Hardware" (Delacorte Press, 1995) by Linda Barnes, one of >my favorite mystery authors, and experienced a startled frisson when I saw >that at least a couple of subscribers had their work immortalized: >Tim's "Invitation to BlackNet" is the opening quote, and the date given is >for L.'s widespread Usenet spam of Feb '94. Interesting. I'll pick up a copy today. >No book report here, but it was as gripping as the rest of her efforts. >It's "about" people rather than computer hackery, but the computery bits >were done quite well. Does an Amiga 2000 <really> have PC and Mac >compatibility options? I don't know, and it doesn't matter anyway. I recollect that the Amiga had some gizmo--I think it was called "MagicSack" or something like that--that let it run Macintosh programs, sort of. It never really caught on, at least as an alternative to real Macs. And I think something similar was available for DOS. This was all several years back, before the Amiga faded out. Amiga users and former Amiga users can probably tell us more. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Mondex vs. Digicash (was: Godzilla vs. Mothra)
by cman＠communities.com 17 Dec '03

17 Dec '03

I disagree with Michael's assertion that Mondex will necessarily win over Digicash. Here's why: o The availability of Digicash in the US, for real, with spender anonymity, will be announced very soon; reporter activity on this subject is consistent with an embargoed press release for Monday or Tuesday. From posts to the list it's clear that a fully working system, ready for customers, will be announced. o When doing market research on this subject, it became clear that low-value payments are largely going to be used for impulse purchases. If the Digicash system allows people to set up their accounts without getting out of their chairs (which I suspect will be the case, if they do it right), it will initially get more adopters. o One or both systems could be found to have serious security problems; who knows what the outcome of their discovery & exploitation would be? I know at least one group of people who believe they have a good line on a serious security problem in Mondex. o Even if the Mondex hardware were given away for free, think how much fun it is for the average user to add a new piece of hardware to their machines... ever install a sound card and CD-ROM drive on a PC? I remember reading something like 20% of all "multimedia" kits were returned, largely due to user install problems. If there is a competing method that costs the same and _doesn't_ require the hardware, people will tend go with this. o In my conversations with state and federal regulators, it is clear that it _is_ possible to issue spender-anonymous e-cash. If you ask them, "Hey, can I create fully anonymous digital cash?", they go apeshit, but if you explain that the money uses existing (auditable) channels going in, and existing (auditable) channels going out, and that only spenders are anonymous, they relax considerably. They may change their minds later, but we're about to get an existence proof. o It's not clear that _either_ system is going to win completely in the next 10+ years. Although there's been considerable shakeout in the last ten years, there is still a huge variety of non-electronic payment methods -- how can you be so sure that Mondex will win over Digicash, and that they won't co-exist like, say, money orders, currency and cashier's checks (three instruments with both similar and dissimilar attirbutes)? Douglas Barnes Electric Communities

1 0