December 2003 - cypherpunks-legacy

None
by Anonymous 17 Dec '03

17 Dec '03

John Young said: > Flame War, by Jonathan Quittner and Michelle Slatalla, > William Morrow, New York, 1997. 291 pp. $24.00 > ISBN 0-688-14366-0 Sure that isn't Alexis Slatella? ;) FedPlunger

1 0

With friends like these...
by Damaged Justice 17 Dec '03

17 Dec '03

...who needs enemas? (Administered by plunger, no doubt.) Internet Tax Plan Is Needed, Net Creator Says (09/09/97; 12:00 p.m. EDT) By [33]Douglas Hayward, [34]TechWire GENEVA -- Internet taxes are inevitable, according to the man dubbed the "Father of the Net." The only way to avoid global chaos is to create an international agreement on how to do it, added Vint Cerf at a meeting of the Internet Society here. Cerf co-developed the [35]TCP/IP[LINK] protocol on which all Web and Net transaction depend. Although proposals for taxing the Internet were rejected by both the Clinton administration and the European Commission earlier this year, there will be no way to avoid it, he said. "We need to be prepared for the day when there will be taxation as a consequence of Internet transactions," said Cerf, who is senior vice president for Internet architecture and engineering at MCI, in Washington. Taxation of the Internet, also called "bit taxes," must be well-planned, Cerf said. "And it must also be thought through on a global scale -- not parochially," he said. In the United States alone, there are 30,000 taxing authorities that might be interested in taxing transactions on the Internet, said Cerf, adding that right now, there is no way to determine which of those authorities should have jurisdiction over a particular transaction. "Imagine going through 30,000 tests for each transaction -- no transaction would ever go through," Cerf said. "If the Internet becomes a major tool for electronic commerce, every major taxing jurisdiction in the world will be interested in using that as a revenue stream." Although the rate of growth of visible Internet hosts appears to be slowing significantly, the growth of intranets is still on the rise, Cerf said. "Traffic is growing at such as rate that on [MCI's] backbone, we will have to consume as much fiber capacity for the Internet as for the telephone network by the third quarter of 2110," he said. As Internet traffic grows, Cerf said, legislators will move to regulate it. "You cannot have a fully and totally unregulated environment," he said. "If something is becoming an infrastructure that is important for people's daily lives, then governments will have the right to be concerned about the public's safety and well-being," Cerf said. "When you build roads, you make rules about how people are to behave on these roads, in order to protect people." [36]TW [37]Search Archives ____________________ [All CMP Publications] ______ Related Stories: [38]Europe Rejects "Bit Tax" [39]Congress To Take Byte Out Of Taxes [40]Clinton: Hands Off The Internet References 35. http://www.techweb.com/encyclopedia/defineterm.cgi?sstring=TCP/IP 36. http://www.techweb.com/ 37. http://www.techweb.com/search/search.html 38. http://www.techweb.com/se/directlink.cgi?WIR1997040812 39. http://www.techweb.com/se/directlink.cgi?WIR1997071107 40. http://www.techweb.com/se/directlink.cgi?INV1997070102

1 0

Re: Netscape is doing well -- give 'em a break.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:52 AM 9/21/95, John Gilmore wrote: >All progress is by steps. Let's step on each others' shoulders, not >on each others' toes. Netscape is doing us a favor by pushing strong >crypto. We are doing them a favor by pointing out problems before >they cause major losses to Netscape customers. The result is higher >security for everyone, and more respect for each other's efforts. So >kindly show them a little... I agree strongly with John. This whole Netscape thing is good for us, good for Netscape (in the long run), and good for raising the awareness of the importance of strong crypto. It also underscores the need for "tiger teams" to validate software, much as the Pentium debacle of last fall underscored the need for even more detailed checking of designs. It's clear now that 1000 ravenous Cypherpunks, or some fraction of them, are eager to "crack" the next big product, and this will hopefully make for better and stronger software. --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: FROM A FRIEND . . . (the joys of boating)
by landon＠netcom.com 17 Dec '03

17 Dec '03

>On 21 Sep 1995, Jeff Weinstein wrote: >> My understanding is that we can not >> export our US-only product, except to canada - for the use of canadian >> citizens. I also believe that it is illegal for anyone except US citizens, >> permanent residents of the US (green card holders) and Canadian citizens >> to use it, even within the US. I'm not a lawyer, and I've not read >> all of ITAR myself, so I could be totally wrong... > > All the same, if anyone wants an easy and economical >way to get around ITAR, have someone do your cypto software development >just north of the border (Vancouver's just north of Seattle and close >enough to Silicon Valley, with excellent net-access) or at least just >publish it here first. here's a possible bullshit wrinkle. i'm not a lawyer, but one of my bosses was, once. said boss owned a boat that was of canadian registry. he was a canadian citizen with a green card. he *claimed* that, even when docked in the SF bay area, his boat was technically considered canadian territory, due to some maritime law malarky. US authorities theoretically had to go through various hoops to legally board his vessel. i wouldn't try to halt a SWAT team, or even the local fuzz, with this tidbit of legal gaga. but doing crypto development on such a vessel might hold up in court for something as squishy as ITAR. naturally, commuting to canada is probably a *lot* cheaper than owning a boat. the uninitiated have little idea what these holes- in-the-water really cost.... :-) -landon (returning to lurk-mode)

1 0

Good Gore, Bad Freeh
by Marshall Clow 17 Dec '03

17 Dec '03

At least they've got the good cop, bad cop routine down. Check out <http://allpolitics.com/1997/09/09/ap/gore.encryption/> >WASHINGTON (AP) -- Vice President Al Gore Tuesday reaffirmed the Clinton >Administration's policy against restricting the sale in the United >States of high-tech devices that maintain the privacy of computer >messages. > [snip] >But White House aides, speaking on condition of anonymity, said the vice >president's brief comment on the administration's policy was intended to >respond to Freeh and show that for now the administration is not changing >its position on the sale of encryption devices in the United States. > "For now". Myself, I prefer California SJR 29: <http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.current.s… rom0000.sjr0029]> (which accomplishes nothing except feeling good, I know) -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "In Washington DC, officials from the White House, federal agencies and Congress say regulations may be necessary to promote a free-market system." -- CommunicationsWeek International April 21, 1997

1 0

Re: Entropy vs Random Bits
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:50 PM 9/20/95, David Van Wie wrote: >I've been watching the debate and discussion unfold on usable sources of >random data from environments, user actions, etc. I have a vocabulary >question (and something of a bone to pick as a mathematician and physicist). Well, I was trained as a physicist also, but am completely comfortable with the Shannon definition of information-theoretic entropy. In fact, through my readings about entropy in computations (cites below), I now view traditional thermodynamic entropy as a special case of information theory! >Usually, the term "entropy" is being used to characterize one of two >different things: (i) random data, as in "300 bits of entropy," and (ii) the >"randomness" of data (i.e. high degree of variance in a statistic drawn from >it), as in "you can find a lot of entropy in the low order bits of a timed >interval between keystrokes." I suspect that there are other shades of >meaning intended in other uses as well. > >This is odd. The term entropy describes an aspect of thermodynamic >equlibrium in physical systems. Although sometimes used as a synonym for >"random," that definition is vernacular, not technical. In fact, there is >no meaningful relationship between "entropy" and random data of the type >described in the postings related to seed values. In the presense of a >perfectly suitable and precise mathematical term (i.e. random), why invent >new terms? Why use them to mean at least two different things? Entropy has been used with an information theory context since the 1950s, by Claude Shannon and others. I disagree that there is "no meaningful relationship between "entropy" and random data of the type described in the postings related to seed values." The bits of entropy we are talking about are the "bits derived from a physical process or a user action which are effectively from a random process." (Granted, the internal thoughts of a user swirling the mouse around are not quite as "random" as, say, alpha decay, but for all intents and purposes no "prediction" can be made of the mouse motions, at certain levels of detail, and the bits dervived are in fact effectively random. We are not "living in a state of sin," to paraphrase Von Neumann, in using these bits and assuming them to be random.) Good books on the incredibly fascinating aspects of information theory, and expecially algorithmic information theory: * Cover and Thomas, "Elements of Information Theory." A good textbook on information theory, covering gambling (!), prediction, and the Chaitin-Kolmogoroff outlook. * Chaitin, Gregory, "Algorithmic Information Theory." A bit dense to read, and Chaitin has written several more popular accounts for "Scientific American" and similar places. * Zurek, Wojciech, editor, "Complexity, Entropy, and the Physics of Infromation." This collection of great articles shows the role of entropy in infromation theory, and why the thermodynamic definition is essentially a variant of the more fundamental information-theoretic definition. Enjoy! --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: netscape bug
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Vlad Nuri said (with some exerpting) > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? It's been noted on this list before that some programs give uid information out...sendmail comes to mind...this GREATLY narrows the search for a pid. > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? It requires knowledge of how the stack is set up and of assembler for the target. Most people in computer science know at least one assembler and could easily add enough of another to launch an attack like this. I did one once to attack one of my programs as an example for a class. Please don't overestimate the difficulty of this attack or underestimate the number of folks out there that are qualified to launch it. It's just that most of us would rather be writing constructive code:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Renaming TEA remailer
by Antonomasia 17 Dec '03

17 Dec '03

I am advised by Mark Hedges that Anonymizer, Inc. owns the trademark for the product name "Anonymizer" and at his request I have changed name of the tea remailer to 'Tea Remailer'. I believe I have made changes everywhere the name appears. -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

4 4

Council of Europe proposes to outlaw strong encryption (fwd)
by wb8foz＠netcom.com 17 Dec '03

17 Dec '03

********************************************************** > SUBJECT: Euroclipper > Apologies if this is old news to you folks, but thought I should > pass it on. Date: Thu, 21 Sep 1995 00:42:39 -0400 Subject: IP: Council of Europe proposes to outlaw strong encryption According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tries to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disppointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson ------- End of Forwarded Message -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

1 0

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>Forwarded message: > >> From: amp(a)pobox.com >> Date: Tue, 09 Sep 1997 09:26:21 -0500 >> Subject: Re: Removing Tyranny from Democracy (Part II), >> was Democracy is the true enemy... >> >> > I don't believe there are intrinsic flaws in democracy, so much as >> > there are intrinsic flaws in *human*nature* that are coming to light >> > after decades. government is a reflection of our human natures. >> > one cannot really expect a government to correct the flaws of its >> > users, any more than software could do the same. >> >> No intrinsic flaws in democracy? >> >> Surely you jest. > >Please be so kind as to detail your top three flaws... I think my Parts II and III detailed a number of shortcomings of democracy, at least when the franchise goes to 'employees' as opposed to 'customers' of government. --Steve

1 0