December 2003 - cypherpunks-legacy

Re: Netscape 2.0 beta
by David K. Merriman 17 Dec '03

17 Dec '03

Even nicer would be if the Windows beta included *all* the files needed. The setup routine wants to install some OLE2 .dll's, but they don't seem to be included with the compressed file, or even on the Netscape site. I was able to work around it, since I already had the OLE2 stuff on my machine, and edited the installation scripts and such - other folks aren't likely to be as 'lucky'. I suspect that Netscape is going to be hearing about that little oversight..... Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Nat Sec Eco Espo
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The anonymous post of the White House's National Security Science and Technology Strategy recalls debate on this policy underlying reports on CIA economic espionage: Clinton instructs CIA to focus on trade espionage - report Los Angeles, Jul 23 (Reuter) - President Clinton has ordered the Central Intelligence Agency to make economic espionage a top priority, according to a report in the Los Angeles Times on Sunday. The report quotes American intelligence sources who say the CIA was instrumental in providing U.S. trade negotiators information during heated auto trade talks with Japan this spring, and has helped uncover bribes by rival nations competing with U.S. firms for government contracts. The sources say Clinton has issued a classified set of intelligence priorities for the post Cold-War era, and that the CIA is providing case officers with new training on economic matters to meet the new challenge. The recent trade talks with Japan were viewed as a success of the new policy, according to the Times report. It said U.S. Trade Representative Mickey Kantor was pleased with the CIA's ability to report on the bargaining positions of American rivals. But the agency has reportedly been less willing to spy on individual companies. In one recent success in that area the CIA discovered that the French were offering bribes to Brazilian officials to help telecommunications giant Thompson win a government contract. The report says intelligence information helped U.S.-based Raytheon Co. elbow out Thompson of France to win the work. But the problem in such work, say intelligence sources, is determining which multinational corporations based in the United States should be considered "American" firms deserving assistance. Because of this confusion, CIA officials argue they should be kept out of spy work targeting individual foreign business at the behest of U.S. corporations. Even so, the Times report says the intelligence community has told Congress it can claim credit for uncovering bribes affecting $30 billion in foregin contracts over the past few years. -----

1 0

Re: cypherpunks digicash bank?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Douglas Barnes <cman(a)communities.com> writes on cypherpunks: > I'm afraid you may have somewhat misunderstood the motivation behind > the Identity Agnostic paper. In no way is it intended as a way of > not facing the music wrt regulators in the country(s) where such an > institution has offices. The IA approach is intended as an possible > alternative for an institution that might otherwise license from > Chaum. So it's intended for avoiding patent issues only? But the identity agnostic idea, and the idea of using software not officially supplied by the bank does not sound like something that would be easy to convince a bank, or other financial institution of? I mean the agnostic server idea is that the user must obtain patent infringing software in order to gain anonymity, or else the user individually obtain on a case by case basis a license from Chaum. A similar mess to the early problem with PGP, back in the days when RSA contended that PGP was a patent infringement, and the other side of the story was that it was the users responsibility to get a license from RSA. As early versions of PGP demonstrated individuals can get away with this kind of thing, but it doesn't help commercial uptake of the software. You need commercial uptake, as a lot of the shops will be commercial service providers, plus value added information or product providers. What I'm saying is that whilst technically the server need do nothing infringing, without the infringing client software it provides nothing new over existing systems, and that the stigma of illegality, might adversely affect the acceptability of the whole scheme to a bank. Ie if you really wanted to sell the system to a bank, you'd presumably stand a better chance if you removed the potential for blinded signatures altogether. Tim is right, patents most definitely retard advancement of technology. > The regulators I've discussed this with are primarily concerned with > how money moves into and out of a digital cash system. The fact that > small payments cannot be traced from buyer to seller is not at the > top of their list of concerns -- it's already a basic fact of life > for them in existing payment systems. So you think with the $10k limit, they might even be happy with a system such as I just described? (note: I did not imply anonymous accounts, only payer anonymity, basically exactly what Chaum has in his trial system right now). > They are also not oblivious to the privacy concerns inherent in an > institution logging massive amounts of counterparty data about > small transactions. I had not realised they were concerned over such things. How does this fit in with the separate 100$ bill for domestic and foreign use? It was previously my suspicion, that 100$ bills were first, and that soon they would be trying to outlaw cash altogether! Perhaps I am too cynical, and I am glad to hear it. (Anyone know if anything ever come of this creation of a foreign issue of 100$ bills which had to be exchanged at customs in entry and exit, each being legal tender only when used in the correct jurisdiction?) > I would strongly discourage anyone from trying to set up a garage- > type operation. While regulators clearly don't appreciate the > subtleties of this stuff, they can spot an illegal bank or an > unlicensed money transmitter from a mile away. I was talking of doing it by the book, patent licenses, appropriate banking licenses, banking regulatory approval. Your description of the banking regulatory bodies likely stance on transferring small amounts anonymously was more favourable than I envisaged. The garage-type operation: I was having problems convincing myself that any bank could be persuaded to do it. Hence I thought, well the civilian sector would have to do it. It doesn't have to be amateurish, just has to be run by people who have an interest in privacy, cypherpunks aren't excluded from doing things professionally, and in fact have a vested interest in seeing it succeed even. You can't expect big banks, governments or corporate types to deliver privacy on a plate, it is counter to their interests - they like nicely indexed, cataloged user profiles, as they are saleable items. Accurate user demographics is big business. The closest that I've seen to a bank offering any semblance of anonymity is Mondex, and it's a crock as far as privacy goes IMO, as as far as I understand the card knows everything, and there is *nothing* stopping the bank downloading *all* of that information next time you plug the card in. That's the kind of anonymity I was growing used to seeing banks offer. Also the fact that it relies purely on the tamper resistance of the card isn't very inspiring, no cryptographic protocols, just a counter buried in a tamper proof card. > If your concern is creating account anonymity, then you're going to > need to set up outside of the US. That was not the immediate concern, only payer anonymity. I thought this would be too much to expect to get away with. Your comments backup that belief. > Do be aware that even the more relaxed countries of the world have > regulations that cover this sort of thing, and they are especially > interested in making sure you at least pay the appropriate licensing > fees. Licensing fees for what? I lack details, and insight into the background of financial dealings (as you might have noticed:-), but my outburst was prompted by impatience with the take up of DigiCash, or any half decent alternative. Blind signature technology has been around for a long time now, and there is not one on-line instance of a practical real world use of this technology. So what problems remain to be solved with a system which has the following characteristics: 1) either agnostic (to save $150k + 10% profits) or coughing up the $150k for Chaums patents - I'm not fussy, only concern for me is implications on uptake as described above 2) no anonymous accounts 3) payer anonymous 4) on-line, normal banking style records kept of money paid in 5) 100% real currency backed 6) profits by keeping interest on backed currency, possibly small % on cashing to pass on VISA costs, etc if necessary Would US banking regulations in your opinion have a problem with this? If $150k is the real sticking point then I'm surprised, I mean ok, it's some money, perhaps the 10% cut of profits Chaum requires is more of a concern. But surely this would win as a privacy preserving internet payment system for convenience, on-line instant payment. With the kind of money investors seem to be willing to back netscape with and the unexpectedly high level of interest in their commerce servers, even Chaum's $150k seems like small change. There must be more to it, what a $1M lawyers bill to sort out the technicalities, and legal implications with regulators? Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

1 0

Re: NSA Realists v. Nuts
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510071424.AA00279(a)october.ducktown.org>, mkj(a)october.ducktown.org wrote: > Need I point out that pride in one's work is not necessarily exclusive > of evil? Rarely does anyone actually think of themselves as evil -- > and those few who do are usually just harmless nuts. The most evil > and destructive people throughout history have always thought of > themselves as good people, doing good work. Let me illustrate this with an example. During my visit to Dachau Concentration Camp, I saw original lab notebooks of experiments designed to increase the survial rate of pilots downed above the cold waters of the North Sea. A noble cause. The notebooks contained pages upon pages of tables listing survial times vs. water temperature, the data gained by dropping subjects into a tub containing water of a defined temperature. I them saw more tables of the effects of various methods investigated to revive hypothermia victims who were near death. One of the treatments under investigation was dropping the patient into boiling water. Surely this type of research falls under the category of evil. But the scientists that conducted the study would not have thought so. They believed that they did a favor to humanity. The fact that to this day the treatment of hypothermia is based upon the results of this study, saving the lives of thousands of patients over the decades past, would surely - in the experimenters' minds - have vindicated their gruesome deeds. Ponder this, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHgyXyoZzwIn1bdtAQFZCAGAvCKsAfc09eefeVsp3Oec73L6WsvxJcbH nlyp7+gX0rG1vBZcsTemp817MSa/WUbb =UuOA -----END PGP SIGNATURE-----

6 6

Certification Authorities in history.
by Bill Stewart 17 Dec '03

17 Dec '03

Timothy C. May (or somebody like him, or Tim the Enchanted) wrote: >> The talk of certification authorities is OK, so long as the practice is >> _completely_ and "strongly" voluntary (*). It occurred to me that the authors of the US Constitution had direct experience with the equivalent of mandatory certification hierarchies for legally acceptable digital signatures. They called it "The Stamp Act". If you wanted to make a legal document, such as a contract or will, it needed to be on paper with a tax stamp on it; I forget if this was a watermark or a stick-on stamp, but you could only get it from the authorities. They didn't like it. There was also a few-percent sales tax on tea around that time. They didn't like that either :-) -------- </serious_mode> <Don_Hopkins_Monty_Python_Voice> <i> WHAT </i> is your name? <i> WHAT </i> is your certificate number? </Don_Hopkins_Monty_Python_Voice> <serious_mode> #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 3

Kerserver keyrings
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Jim Grubs (W8GRT)" <jgrubs(a)webcasters.com> writes: > -- [ From: Jim Grubs (W8GRT) * EMC.Ver #2.5.02 ] -- > Attachment: mailsig Code: 0006727 \ Created: 10-03-95, 07:16 PM [1 Kb] > > Someone at Uni-Hamburg must have seen my message and said, "Oops, who turned > that off?" Anyway, their keyring was upated today. It's 6.4 megs!!!! (My > first HD was only 10.) > > > > begin 644 mailsig > M+2T-"B`@("`@("`@("`@("`@("`@("`@("`@(%=E8D-A<W1E<G,H=&TI#0I* > M86UE<R!#+B!'<G5B<R`@("`@("`@("`@("`@("`@("`@("`@("`@("`@:F=R > M=6)S0'=E8F-A<W1E<G,N8V]M#0HV.#$W($UA<&QE=V]O9"!!=F5N=64@("`@ > M("`@("`@("`@("`@("`@("`@("`@5&5L+CH@-#$Y+3@X,BTR-CDW#0I3>6QV > M86YI82P@3V@@-#,U-C`@("`@("`@("`@("`@("`@("`@("`@("`@("`@($9A > M>#H@-#$Y+3@X-2TR.#$T#0H@($EN=&5R;F5T(&-O;G-U;'1I;F<L($A434P@ > E<')O9W)A;6UI;F<L($EN9F]R;6%T:6]N(&)R;VME<FEN9PT*(``` Apologies to all for the mite in E-Mail Connection that caused it to think my .sig was an attachment. Needless to say, I have purged my system of it... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMHgO7t74r4kaz3mVAQGPOwP9HLmDUXzv6FHyWUwIiK+kGQkm2f/wS6+C snRmcyuzUK1bYk/xKleq1bdwGo1p6WfkdonAKYlV2sQIfx5smMlwtVqyKCJ8PJZJ EnNhT9i47x0/oF9qta0O225LRGKEFgMswaqAZoRbrwWk1wwDQy1Be1GdUnUMxCTt Ss8yYdV5p4o= =8fAh -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Certification Authorities in history.
by James A. Donald 17 Dec '03

17 Dec '03

At 10:26 AM 10/8/95 -0700, Hal wrote: > One key to rule them all; > One key to find them; > One key to bring them all > And in the darkness bind them. A more famous statement on key certification authorities: And he causeth all, both small and great, rich and poor, free and bond, to receive a mark on their right hand, or in their foreheads: And that no man migh buy or sell, save he that had the mark, or the name of the beast, or the number of his name. Coming soon: True names neatly linked to your social insecurity number --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

(ecm) Chaum patent prices (was Re: cypherpunks digicash bank?)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

[Marcel just posted this in the ecm list, I'm taking the liberty of doing a Rob Hettinga and acting as human gateway between lists, as the posts this was in response to were posted to both lists. -Adam] Forwarded from the ecm(a)ai.mit.edu (Electronic Cash Market) mailing list: >>>>>>>>>>>> From: Marcel van der Peijl <bigmac(a)com.digicash> To: ecm(a)edu.mit.ai Subject: Chaum patent prices Sender: bounce-ecm(a)edu.mit.ai Precedence: bulk Reply-To: Marcel van der Peijl <bigmac(a)com.digicash> Hi, I just want to make a quick comment on the prices that have been floating around on this list ($150K +10%). No doubt this is what David asked at some point to some individual but it is NOT the 'list price' -- there is no such thing as a list price. It all depends on the application, business potential etc. The up-front patent price should never be an obstacle for setting up business. If you wanna do serious business, I suggest to give David Chaum a call, or call Dan Eldridge. Phone numbers and email addresses can be found on our web pages. You might be surprised. And may I remind you that the patent price that is quoted is just a tiny drop in the bucket compared to the kind of money spent on marketing budgets for systems like Mondex!!! You are really talking about a non-issue here, IMHO. Marcel van der Peijl DigiCash bv

1 0

Re: Chaum patent prices
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Tim wrote in his (to me) spot on article (cypherpunks list) about patents wrecking technolgical progress, and hindering all important experimentation, and exploration of technology: > [...] for example, can't use the Chaumian blinding protocols > without hiring lawyers, paying Chaum his up-front fee, and laying > out his designs and business plans (which he very probably doesn't > even have!). from Marcel's post: > I just want to make a quick comment on the prices that have been > floating around on this list ($150K +10%). No doubt this is what > David asked at some point to some individual but it is NOT the > 'list price' -- there is no such thing as a list price. It all ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > depends on the application, business potential etc. ^^^^^^^^^^^^^^^^^^^^^^ ie laying your plans out up front, plans which don't exist! Business potential is not predictable, even obtaining appropriate status, and banking licenses would presumably be doubtful unless a concerted, organised effort were put together. Requiring business plans rules out experimenting. The freeware mosaic browsers growth while being developed by academia, and the WWW in general seems to be a model which works rather well for the internet, if the netscape success story is anything to go by. Internet payment is rather harder to set up as a small experimental operation due to the legal and political implications, but a *real* example by Digicash would be nice. As in: if no licensing banks for digicash can be found, perhaps it would be a good approach for digicash to do it themselves, and support an offical exchange mechanism, if such a mechanism took off, banks might be interested to buy into an existing client base. On the $150k + 10% figures, my apologies, I picked them up from earlier posts on ecm I think, and had assumed incorrectly that this was a fixed price. > The up-front patent price should never be an obstacle for setting up > business. If you wanna do serious business, I suggest to give David > Chaum a call, or call Dan Eldridge. Phone numbers and email addresses > can be found on our web pages. You might be surprised. I am tempted to say: "how about free for a good cause :-)" And it might (theoretically) be nice as an analogue of the relationship between PGP and RSA with PGPs current free non-commercial use license from RSA, that seems to have helped RSA quite a lot. RSA are fond of quoting statistics about the world wide usage of their algorithms, one rather suspects that PGP is included and a major contributer to their figures :-) However, being realistic, I expect the answer to be no. I can understand this, but IMO it is still not a good situation from the point of view of advancing technology. My point however, is lets see a digicash payment system with a real exchange and soon! I don't care who does it so long as it gets done! > And may I remind you that the patent price that is quoted is just a > tiny drop in the bucket compared to the kind of money spent on > marketing budgets for systems like Mondex!!! You are really talking > about a non-issue here, IMHO. True enough. The 10% is likely more of a sticking point tho, but as you say this is all negotiable. But hey, I don't have a high powered business plan, I'm just a little cypherpunk be-moaning the fact that there are no digicash licensing banks which I can use to take advantage of Chaum's privacy technology, and instant on-line buying. Just think how much hassle could be saved when buying the perl rsa T-shirts even (no, I promise no more shirts arguments, I'm talking of payment!), all the foreign cheques, the hugely exhorbitant charges banks charge for writing small value foreign currency cheques, the risks (and dubious technical legality in some places) of posting paper cash in the mail, and the odd postal order which the bank would like to charge more than the face value to cash (I kid you not, I asked a few people to send different payment forms). "Click here to buy" would be infinitely better. The market is impatient, and inferiour, non-privacy preserving payment forms are in danger of soon becoming entrenched as standard internet payment methods. Digicash has or soon will have MSN money systems to compete with. Digicash now! Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

1 0

Re: Noise: anyone experience with brain waves input devices (IBVA,...)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510080007.AA01951(a)hplyot.obspm.fr>, dl(a)hplyot.obspm.fr (Laurent Demailly) wrote: > I'd like to know if anyone have first hand experience with brain wave > and other (hyped) input devices like IBVA or others and/or pointers to > informations ? The pioneering work in this field was done by Andrew Junker, formerly Air Force labs. He now uses his system to sail his boat. At Rand Mac Millan Air Force Base, they have a simulator that is controlled by brain waves alone. Note that all the brain wave interfaces only allow a simple left/right type of control. Right turn is easy, but left turn is rather hard to learn. Anything bejond that, as well as direct input of data into the brain requires a direct link to neurons that can only be achieved by surgical means. See Brindley G S et al and the work done by Normann R A at U of Utah for the studies that defined the field. I have developed a design that solves the notorious problem of connecting the silicon matrix to individual neurons, but really can't elaborate on it until I get around to file a patent for it. Also take a look at the breakthroughs reported in PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 236: August 7, 1995 by Phillip F. Schewe and Ben Stein available at http://www.hep.net/documents/newsletters/pnu/1995/pnu-236.html Have fun, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHg4gSoZzwIn1bdtAQFpWAF9HQg2f8myEyI4HrHY/5ZCnB/nLG+AzZXo rA8zMPMo0l5t24i74tlTBJnaZYS4zkSW =Hq/0 -----END PGP SIGNATURE-----

1 0