December 2003 - cypherpunks-legacy

Re: Crypto++, Cpunk Icons, list noise
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 4 Nov 1995 don(a)cs.byu.edu wrote: > An anonymous complainer writes: > > >Well, Perry, my opinion is that there is far too much noise on this list > >as it is. I have already seen my words drowned out by bellyaching over > >next to nothing. > > POT-KETTLE-BLACK. > > Also, since nothing you've written (in your commentary, as opposed to > anonymous announcements or releases that most people use anonymity for > here) indicates that you're using anonymity for any particular reason, Hmmm, I'm not sure that anyone has an inherent right to question WHY a person seeks moments of anonymity or privacy. I don't believe that anyone should be placed on the defensive, for *choosing* to maintain some semblance of a personal life, or wishing to maintain some illusions that they might still have some shred of personal privacy left. Hopefully, we can still leave a man with his dignity. I should not have to defend my right to present my ideas as I believe are appropriate to the circumstances. My choice to present the idea, that an entire economic sector needs to carefully reevaluate their strategic choices, and their discovered hidden security attitudes -- will stand or fall strictly on its merits. The debate is not advanced in any way by attaching a reputation to the question. Like any other person, I have my skeletons, and I have my regrets. I certainly have unfinished, unresolved, issues that I need to tend to. In that sense, I am no different than any other man. I also realize that ultimately, I'll have to come forward from behind the veil of secrecy which is provided to me. This I will do, after I have reconciled my own security considerations. Please allow me the boundary and dignity to choose when, where, and in what form I choose to reveal myself. That inherent right, should be extended to any man, and no man should be called to account for his desire to maintain his personal privacy, no matter how arbitrary his reasons. Especially when he comes forward to challenge Goliath. > please stop so people can killfile you. Or send it from a nym at > alpha.c2.org. I mean, the NSA has your real name anyway, what's the > point... At this time, I don't feel that a bi-directional private communications channel is needed. I have no need for a "nym". People who need to contact me, can. People who would like to know a bit about me, can. Netscape has my address. So does AT&T. And reputations aren't pertinent. (Although, I will say, that the disappearing here-again, gone again, internet draft at ds.internic.net is simply childish, and I'm certain that it was just routine "file maintenance" that caused the flicker.) The ball isn't in my court, it's in theirs. Netscape and AT&T are some of the primary parties who will have to take the hit for the fiasco that they find themselves in. For now, I'll leave my communication channels with them open, rather than letting my mail queue fill more than it already has. Email that is already overqueued. I don't really envy the two companies' position. No one expects to find as significant a security flaw as my anonymous email to this list detailed at this stage of code Burn-In, and I don't take any pleasure in facing the unenviable task of informing ANY party that a Trojan Horse has been engineered into the fabric of an existing globally installed code base. No one does. And as the messenger, I (hope) I don't have anything to fear, from the NSA or any other foreign group that would seek to pursue its own agenda within the borders of sovereign Canada. I really don't think that the NSA is "evil incarnate", as some list subscribers do. They have their intelligence and know how to use it. Usually, they use it prudently. If I did have any worries about the NSA, then I might take some elementary precautions. I certainly wouldn't have my terminal screen pointing towards the twelve odd feet of open glazing that sits behind me, as I currently do. Privacy can't simply be reduced to "a desire to hide from the NSA", just as security isn't something which is simply provided by licensing from RSA. Look to the message rather than the messenger. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 5

Check out what I found!!!
by checker＠208.19.53.108 17 Dec '03

17 Dec '03

The secret is out! If you want absolutely free access to thousands of adult sites from around the world, there's only one way to get it: http://208.19.53.108 http://208.19.53.108 ............................................................................................................................. If you wish to be removed from this list, please reply with the subject "Remove"

1 0

Re: Kallstrom Calls All Calls Tappable
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

> James Kallstrom, assistant FBI director in charge of the > New York field division, argues that the proposal would in > fact reduce the FBI's surveillance authority. "Today ... we > could tap all the phones in the United States," he said, > referring to older, pre-digital technology. Under the plan, > the FBI's surveillance ability would shrink to a maximum of > 1 percent of simultaneous telephone calls from any one > telephone switch, he said. Doublespeak. 2 legs good 4 legs better.

1 0

New Computer Security Act
by John Young 17 Dec '03

17 Dec '03

The Computer Security Enhancement Act of 1997 (HR1903) is intended to replace the Computer Security Act of 1987. It redefines the role of NIST in meeting federal computer security and encryption requirements through cooperation of industry. Public use of encryption is also addressed in the bill. Two lengthy reports on the bill have been issued recently, both of which provide overviews of the current encryption debate. House Report 105-243, published on September 3, provides a detailed analysis of the bill, hearings held, floor remarks and mark-ups since introduction: http://jya.com/hr105-243.txt (115K) And one published today includes recent floor remarks on encryption, mostly supportive of public use: http://jya.com/hr1903-floor.htm (44K) One point of contention is the evaluation of foreign encryption. The original bill put that responsibility on NIST, but the latest version deleted that and leaves the task to BXA (and unnamed others). Moreover, there's dispute over committee jurisdiction for other provisions. Information security now attracts the swarm, with encryption the moths' beacon.

8 9

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (robo hroller syrinx c2) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- hacktic remailer(a)utopia.hacktic.nl *********+** 8:54 99.98% portal hfinney(a)shell.portal.com ###--###**-- 46:06 99.98% ideath remailer(a)ideath.goldenbear.com --.-----_.-- 10:46:11 99.98% wmono wmono(a)valhalla.phoenix.net ************ 12:41 99.97% ecafe remail(a)ecafe.org *##*#*##*#*# 1:06 99.97% alumni hal(a)alumni.caltech.edu *+#--***+*-- 46:01 99.97% robo robo(a)c2.org #--*##.#*#*# 10:10 99.92% spook remailer(a)valhalla.phoenix.net * *+******** 12:11 99.92% penet anon(a)anon.penet.fi --+++-----+ 3:25:44 99.90% replay remailer(a)replay.com * ******+** 7:06 99.88% mix mixmaster(a)remail.obscura.com ---------- 1:59:30 99.75% rmadillo remailer(a)armadillo.com ++++++++++ + 39:58 99.58% bsu-cs nowhere(a)bsu-cs.bsu.edu #-+#* *##++ 13:47 99.23% ford remailer(a)bi-node.zerberus.de ________ . 78:53:54 99.04% syrinx syrinx(a)c2.org __ .+-+--+++ 15:25:24 98.98% flame remailer(a)flame.alias.net **+***+ +** 22:20 98.00% vishnu mixmaster(a)vishnu.alias.net +*******-*+ 22:47 97.99% rahul homer(a)rahul.net +#*****+-**+ 9:18 99.95% c2 remail(a)c2.org +-- **.* - 46:46 86.40% extropia remail(a)extropia.wimsey.com - -..- 10:09:23 31.33% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

PGP signature legal standing?
by Russell Nelson 17 Dec '03

17 Dec '03

Is there any legal standing for a PGP signature? I'm tired of my luser customers faxing me legal documents, then expecting me to sign it and fax it back. Yeah, right, like photoshop can't cut-n-paste. I've got a fax modem on my Linux box, so I'm going to start (in fact have started) uuencoding the .g3 file, indicating my assent, and emailing it back to them. -- -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom causes peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry.

3 2

PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Date: Nov 6th, 1995 Contact: Sameer Parekh 510-601-9777 sameer(a)c2.org PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE Two Princeton University grad students, Dan Wallach and Drew Dean, recently discovered holes in Sun Microsystem's HotJava web browser. In response to this finding, Community ConneXion, well known for offering rewards for exposing holes in internet security products, has decided to award them with a t-shirt and expand the Community ConneXion Hack line of promotions to include Java and Java-related products. Sun's Java product is alleged to allow people browsing the World-Wide-Web to execute programs on their own computers without worrying about whether or not the programs were viruses or not. The holes Wallach and Dean found show that there are a few things in the HotJava alpha implementation of the Java language which make viruses and other malicious programs possible within the alpha HotJava web browser. "We were very impressed with the HotJava concept, so we thought it would be good to poke around their implementation," said Wallach. "While we did find some interesting holes, we believe these can be addressed and Java could make a good standard for remote code on the Web, if an effective security policy is defined." Wallach and Dean released their findings initially in the RISKS Digest, and plan to publish a paper detailing their results. The holes they found make it possible for a malicious applet to set things up so as to be able to monitor or modify all of a given web-surfer's activity, after they ran the malicious applet exploiting the holes. By doing so the applet may make it possible to violate user's privacy by revealing to an third party their web traffic. The holes they found exist only in the alpha release of HotJava. The beta release, which is the version found in the widely-used Netscape Navigator 2.0b1J is not vulnerable to these attacks. "I don't want to be in the t-shirt business," said Sameer Parekh, President of Community ConneXion, "but we felt that these students' work deserved a t-shirt. Java has great potential for making the Internet much more powerful than it already is. It is very important that we examine Java and make sure that we can trust it." Community ConneXion, in addition to this Hack Java t-shirt promotion, is offering t-shirts to people who find holes in Netscape, Microsoft, and DigiCash. Information about the Hack Java promotion is available from http://www.c2.org/hackjava/. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org/ or from sending email to info(a)c2.org. Java and HotJava are trademarks of Sun Microsystems, Inc. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. The Hack Java promotion is not affiliated with nor sponsored by Sun Microsystems.

1 0

Crypto-law etc
by Chuck McManis 17 Dec '03

17 Dec '03

The longer I follow the crypto "debate" the more I begin to understand what must have been the real intent behind the 2nd amendment of the constitution. If the White House can get crypto code defined in the true legal sense (that is backed up by case law) as a munition, do US citizens then have a constitutional right to "bear" it? Just curious, --Chuck

3 2

SSL-encrypted apache web server available for beta-test
by sameer 17 Dec '03

17 Dec '03

I put together an SSL/Apache using mostly other people's work, but some of my own. It's available for beta-test to use non-commercial to US-persons. See http://www.c2.org/apachessl/ The README is attached. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org "I don't want to get into the t-shirt business." The release of Apache supports SSL, using Eric Young's SSLeay package and RSADSI's RSAREF cryptography library. Ben Laurie <ben(a)algroup.co.uk> wrote the interfaces to SSL within the Apache server, which was developed by the Apache Group. This release of Apache-SSL is maintained by sameer <sameer(a)c2.org>. For more information on sameer's releases of Apache-SSL see http://www.c2.org/apachessl/. For more information on Apache see http://www.apache.org/ For more information on SSLeay see http://www.psy.uq.oz.au/~ftp/Crypto/ For more information on RSAREF see http://www.rsa.com/ Portions developed at the National Center for Supercomputing Applications at the University of Illinois at Urbana-Champaign. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. Use of this software is allowed for non-commercial use only, as described in the RSAREF license. For information on commercial use of this software, please see http://www.c2.org/apachessl/. This package is using Apache 0.8.14 -- not the most recent version of Apache. While every effort will be made to keep this package up to date with the most recent Apache version, that can not be guaranteed.

1 0

Re: [noise, personal reply] CBC address.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

A post from Alice, that might be worth reading twice ... On Sun, 5 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > > On Sat, 4 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > > > Does anyone on this list know if the CBC has a web site on the Net? > <www.cbc.ca> They have a lot of shows in .au (so I hear) or accessible by > realaudio. Don't know if they have any mpigs [sic] though. There's an alt > newsgroup too. Uhhm, thanks ... I guess ... but I wasn't _really_ looking for the CBC web site. I was actually looking for someone to HOST a website which might showcase one particular program from the CBC, a program broadcast in Canada which highlighted how AECL (Atomic Energy of Canada, Limited) fails to practice safe computing and then when confronted, implements a calculated program of strategic misrepresentation. (i.e. they lie.) I thought that someone who strongly felt that error-free protocols and error-free methods were important -- especially in mission critical applications like medicine, commerce, or nuclear power plants -- might possibly contact the CBC, and either voluntarily donate some bandwidth and a host site, or conversely build a site devoted to showcasing the human tragedy that can follow in the wake of shoddily designed software. I mean, good grief, we have Atomic Energy of Canada taking a cavalier attitude towards computer code. Not only is AECL involved in nuclear medicine, in building wonderful radiological tools to help cancer patients (theoretically) live, but they BUILD nuclear reactors worldwide. The CBC broadcast documented how this international firm REACTS to reports of computer software errors. It documents how the firm reacts to reports of people dying because of sloppily written computer code. The program is NOT (unfortunately) on the www.cbc.ca website, but should be placed on the net and made available. I'm not sure how, that was misunderstood. But your next statement helped make it clear. > You oughta use Sameer's (or someone else's) replyable remailer when asking > questions Alice. I wasn't really asking for an answer, my Ottawa friend. I really wasn't looking for _another_ email in my mailbox to answer and address in my copious spare time. I was looking for some assistance. No direct reply was necessary. Someone could simply announce that they were volunteering to quarterback bringing a host website online, and dealing with all the issues that are involved with that (including liasing with the CBC.) I'm not *quite* sure how you misread what I was hoping to achieve. If however, you were looking to convince me to post to from a remailer that allows replies ... one that might let you send me known plain text back through it ... something traceable back to me ... then I *might* really understand, and I might beg off for a bit. Bit premature, and such ... I think I'll pass on _that_ offer, especially since I really wasn't looking for a personal private reply to what I wrote. Maybe, if I requote myself, it will be a little clearer all around. (That's, strike two, btw ... to my Ottawa friend.) Here's what I wrote: > I know that it is rude to follow up one of your own posts, and I > apologize in advance for this horrible faux-pas, but hopefully, it's > excused this one time. I wrote: > > > >One example of this that should serve as a useful case study is a recent > >problem which was brought to the Canadian public's attention just this > >week, on a program called the Fifth Estate. The CBC (Canadian > >Broadcasting Corporation) detailed a software code problem in one of > >AECL's (Atomic Energy of Canada Limited's) instruments which deliver > >penetrating radiation. > > > >The software which controlled the radiation dose, would periodically > >override the oncologist's calibration and deliver a radiation dose 100 > >times what was prescribed. This software "bug" literally killed wherever > >the machine was in use. > > Does anyone on this list know if the CBC has a web site on the Net? > > I'm hoping that someone (hint, hint) who has a convenient website, one > with lots of spare bandwidth could volunteer to contact the CBC and > persuade them to copyright clear the Fifth Estate program clip which > documented some of the risks of software bugs in mission critical > applications, and allow it to be placed on the Net. I'm hoping that this > English language piece reaches a wide international audience. > > The Canadian Broadcasting Corporation is a Crown Corporation which has > historically received its primary funding from the Government of Canada. > Recently, it has suffered under the budgetary ax, and the push for > privatization. I'm pretty confident that the Corporation would copyright > clear the clip for MPEG distribution across the Net, if they were > approached with the concept that the clip was a demonstration of the CBC's > journalistic excellence and integrity, a piece which is demonstrative of > the critical need to continue their funding. A concrete demonstration of > the need for the CBC. And a piece which could well receive deserved > international acclaim. > > The site would help them, and would simultaneously be a site of > international public service. > > Nothing will drive home the need for quality software, quality code, and > quality security more than the vivid graphic pictures of the consequences > of sloppy code, or of the risks if certain critical systems, LANs, or > private networks are compromised, or if security and privacy (which are > flip sides of the same coin) are ignored. > > The sight of a body, that has had a hole burned straight through it from > the front through to the spine is truly chilling and drives the message > home. Nothing seems to speak as clearly as a picture ... as to what the > stakes are ... of what "bugs" in code do ... and of what a network > compromise can leave in its wake. > > A picture of consequences. > > Six people died in Canada and the United States due to the software flaw. > Even after numerous reports of the flaws, the company refused to even > acknowledge the existence of a problem, and in fact did everything within > its power to make sure doctors, radiologists and physicists were unaware. > > The attitude of trivialization can only be characterized as fantastic, and > would be unbelievable to anyone who has not viewed the piece. > > It's one hell of a backgrounder which not only details problems, but looks > at solutions -- it examines attitudes, especially management attitudes. It > truly deserves an expanded audience. From teachers, to students, to the > international media, to the concerned private individual, all will be > served well if this piece gets wide attention. > > Takers, anyone?? Now, how on earth, (after rereading what I wrote) did my words get misunderstood?? And how on earth did someone figure that they needed to establish a bi-directional communications channel with me?? I mean it's not like I'm atacking AT&T or Netscape, I'm simply trying to coordinate a basic public service, and blow the whistle on bad code. Blow the whistle on software which people expect (rightfully) to be reliable ... software which people expect (rightfully) not to cause any human harm. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0