December 2003 - cypherpunks-legacy

Re: Keyserver keyrings
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

syrinx(a)c2.org (Syrinx Anonymous Remailer) writes: > According to 'Derek Atkins': > > > The name pgp.mit.edu is now > > pointing at another machine (which I do not maintain). For access to > > the keyring, send email to pgp-public-keys(a)pgp.mit.edu -- that is the > > supported method of access. > > does anybody out there maintain a current keyring that can be grabbed > via anon ftp instead? It seems like a waste of time for hundreds of > users to continually add updates to their own keyrings when the whole > keyserver ring can be picked up at one time, updates and all? ftp is > much more convenient than stringing together multiple sections received > by e-mail. That's what I did with WS_FTP until they stopped updating it on August 24th. [Pgpkeys] HOST=ftp.informatik.uni-hamburg.de UID=anonymous LOCDIR=c:\pgp DIR=/pub/virus/crypt/pgp -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: New Netscape bug (in version 1.12)
by Jeff Weinstein 17 Dec '03

17 Dec '03

On Oct 4, 11:00am, sameer wrote: > Subject: Re: New Netscape bug (in version 1.12) > Isn't there a resolver #define or something in limits.h called > MAXHOSTNAMELEN ? Something like that? (Perhaps not, but that's what I > recall..) We are using MAXHOSTNAMELEN if it exists, both in 2.0, and in the security patch that we shipped. If it doesn't exist we just assume 64. As a quick sample, on sunos and irix it is 64, and on solaris it is 256. On sunos and irix it is defined in sys/param.h, and on solaris it is defined in netdb.h. I wasn't able to find any mention of it or any other limits on the host names passed in to gethostbyname() in the man pages on any of these systems. --Jeff Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Rich Salz 17 Dec '03

17 Dec '03

>If the cancel cannot be authenticated (e.g., because the original article lacks >the "Cancel-lock: M2" header, or the cancel lacks the "Cancel-key: M1" header >such that H(M1)=M2), then INN should forward the unauthenticated cancel to one >or more "collection centers" so the author of the original article may be >notified. So if 70% of Usenet follows this scheme a handful of forged cancels can easily cause melt down. >Each "collection center" deamon should wake up periodically (say, every hour), >group the collected unauthenticated cancels by message-ids of the cancelled >articles, and e-mail the (distinct) addresses (other than "usenet@*" or >"news@*") mentioned in the "From:", "Sender:", "Authorized:", and >"X-Cancelled-By:" headers, quoting the unauthenticated cancel and the Path's as >seen at many different sites that forwarded the cancels. This way, if the >unauthenticated cancel is indeed forged, its author will see within hours that >it has been fraudulently cancelled _and_ will automatically receive enough >"Path:" samples from all over the world to see where it was posted, by >comparing the "Path:" headers in several forwarded copies. I can post a handful of articles and forge the From line, and create my own Cancel-lock headers by "rolling the dice." I can then get their mailbox bombed by forging cancels. A little more complicated then "sendsys-bombing" but not much more so. /r$

1 0

CSPAN2: Copyright on the Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

It's 3:43 pm EST, and CSPAN-2 has Cerf, the CO$ counsel, and others on a panel about copyright on the internet... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 2

Re: Serious Windows TCP/IP Security Hole
by Rich Graves 17 Dec '03

17 Dec '03

I'm forwarding you a couple messages. I haven't run SAMBA myself, but people who have have been able to read files on my machine that aren't supposed to be shared. -rich On Wed, 4 Oct 1995, Henry Sanders (Exchange) wrote: > Hi, I've jumped in late on this thread. What is the bug referred to in the note below? I might be able to give you current status on it. > > Thanks, > Henry Sanders > henrysa(a)microsoft.com > > >In article <44amc4$ft6(a)nntp.Stanford.EDU>, llurch(a)networking.stanford.edu > says... > >> > >>FYI for those of you still running WFW. Could anybody confirm or deny > >>that Microsoft has patched this hole in the shipping version of 95? > >>As with most such serious "oopsies," Microsoft has not made any > >>information on this issue available in their Knowledge Base. > > > >Nope, it is still there. > > Can you demonstrate that this is true? I'll give you an account on my box. > I've received several notes and flames that the problem either never > existed (which I know is untrue) or was fixed at a specified (often > specified different) patch level. > > I should really try this myself, but I don't have time, and the only UNIX > box I can really mess with is my Linux box, which is also my Win95 box. > -rich

1 0

Re: Serious Windows TCP/IP Security Hole (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 30 Sep 1995 02:01:56 -0700 (PDT) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Ken Simler <krs2(a)cornell.edu> Subject: Re: Serious Windows TCP/IP Security Hole (fwd) I don't really know, I'm just passing on news... maybe talk to these folks. -rich ---------- Forwarded message ---------- Date: Thu, 28 Sep 95 19:56:38 PDT From: Tom Czarnik <czarnik(a)netmanage.com> To: Rich Graves <llurch(a)Networking.Stanford.EDU> Subject: Re: Serious Windows TCP/IP Security Hole On Thu, 28 Sep 1995 18:31:07 -0800 Rich Graves >Can you demonstrate that this is true? I'll give you an account on >my box. I've received several notes and flames that the problem >either never existed (which I know is untrue) or was fixed at a >specified (often specified different) patch level. We can do it your way or if you are physically located at Stanford, you can schedule an appointment to come by NetManage. We are located in Cupertino, right off 280 at DeAnza Blvd. The choice is yours.

1 0

Re: Serious Windows TCP/IP Security Hole (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 30 Sep 1995 02:03:58 -0700 (PDT) From: Rich Graves <llurch(a)Networking.Stanford.EDU> To: Ken Simler <krs2(a)cornell.edu> Subject: Re: Serious Windows TCP/IP Security Hole (fwd) This doesn't work for you? Please get back to me if you figure it out. I'd like to document the problem accurately. -rich ---------- Forwarded message ---------- Date: Thu, 28 Sep 95 23:45:49 -0400 From: Mark Thornton <markt(a)eng.umd.edu> To: llurch(a)networking.stanford.edu Newgroups: comp.os.ms-windows.win95.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.networking.tcp-ip Subject: Re: Serious Windows TCP/IP Security Hole I can confirm that the complete(floppy) version of Windows 95 STILL has the ../ bug ;-( The ... bug has been fixed correctly returning the following message chkpath: ERRDOS - ERRbadpath (Directory invalid.) But cd ../ WILL put you in the root directory of the share with the rights you had in the intial directory. Very bad... I've had to share all my drives read-only until the problem gets fixed.

1 0

McNeil Lehrer on Net Insecurity
by John Young 17 Dec '03

17 Dec '03

McNeil Lehrer has a segment on net boogers this evening, reported by Time's anxious Elmer-Dewitt. Diffie, Farmer and Shimomura, all beautifully coiffed, offer sagacious views. It includes a clip of Kevin, unbeautifully cuffed and mutely eloquent. Says most of the charges against him have been plea-bargained away.

1 0

SAIC Bags Tier 1 Job
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

SAIC Awarded Multimillion Dollar Communications Security Contract San Diego, Oct. 3 /PRNewswire/ -- Science Applications International Corp. (SAIC) said it has been awarded a three year, $28 million contract to support the Space and Naval Warfare Systems Command (SPAWAR). The Common Tier 1 System will integrate computers and software to implement and field the Tier 1 element of the Department of Defense's Electronic Key Management System. This program will provide automated communications security and key management system support for the Navy, Army, Air Force, Marines, Coast Guard and other government agencies. Common Tier 1 will help implement the Electronic Key Management System and support its integration with COMSEC material management in the Navy, Army, Air Force and joint key management systems. The work performed on this contract will be split between San Diego (66%) and Camden, New Jersey (34%), and is expected to be completed in October 1998. "We expect to hire an additional 65 employees in San Diego during this contract to primarily work on software development," said SAIC Program Manager Tom Trebelhorn. "This is a very significant win that allows SAIC to continue its involvement in this key information security program and extend the company's commitment to the communication security field," Trebelhorn added. SAIC provides high-technology services and products for government and private industry in the areas of space, transportation, national security, environment, health care, energy and systems integration. With nearly $2 billion in annual revenues, the employee-owned, San Diego based company has 20,000 employees in more than 350 locations worldwide. Contact: Tom Trebelhorn, Operations Manager of SAIC, 619-552-5319, or fax, 619-452-3540, or e-mail, tom_trebelhorn(a)cpqm.saic.com/

1 0

GSS sample/demo?
by David K. Merriman 17 Dec '03

17 Dec '03

Sorry for the 'broadcast', but I'm looking for some source code that shows how GSS 'works' in real-world applications, as well as opinions on how good it is. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1