December 2003 - cypherpunks-legacy

NEW Netscape RNG hole
by an402976＠anon.penet.fi 17 Dec '03

17 Dec '03

Did anyone else notice a bug in the new, public Netscape RNG code? It appears that on Windows builds, during the RNG seeding, the function that hashes in file contents (EnumSystemFiles) doesn't close a file handle (lFileHandle). This doesn't hurt too badly on the client, but on a server, leaking these resources is deadly. I ran some experiments. It took a few thousand calls before these open file handles forced not only the file content function to fail, but also made OTHER calls quietly fail. With these calls quietly failing, the RNG is significantly weakened. In my tests on Windows NT, ALL of the following RNG functions failed: * GetComputerName * GetVolumeInformation volume Name, volume Serial Number, Maximum Filename Length Filesystem Flags Filesystem Name * GetDiskFreeSpace SectorsPerCluster BytesPerSector Free Clusters Total Clusters * subroutine for the inclusion of system files, both number of them & contents ReadSystemFiles() * subroutine used for other history file accesses SEC_FileForRNG(*filename) How did this get past Netscape testers? Does anyone know if this was fixed before Netscape shipped? Does it rate a shirt, or does this mean Jeff W. gets to shave his head? I seem to remember him promising to shave it if we could show a significant weakness in the new RNG code, and since this does (IMO)... On another note, has anyone noticed the 73 (!!!) or so handles that are leaked by simply opening and closing &Options -> &Preferences... ? Looks like somebody had a problem coding the tabbed dialog. RingZero --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Image Tape - view with Java enhanced Netscape mail reader
by Andy 17 Dec '03

17 Dec '03

http://www.javasoft.com/JDK-prebeta1/applets/ScrollingImages/example1.html Title: Image Tape The source.

1 0

FOR_who
by John Young 17 Dec '03

17 Dec '03

10-8-95. NYPaper: "Foreign Policy 3.1. Microsoft as World Power." [Foreign affairs column] Does Microsoft have a foreign policy? Mr. Ballmer says Microsoft doesn't have a foreign policy per se. But it does have a global business agenda. Since Microsoft today has twice the market value of General Motors, it's worth looking at that agenda because it is bound to influence U.S. foreign policy. Microsoft doesn't need Washington to open doors for it because foreign governments are begging Microsoft to come in and translate Windows 95 into their languages, so they can get on the information highway. Describing his contacts with foreign leaders, Mr. Ballmer put it this way: "People say, 'You have this technology. We hear it's changing the world. Tell us how it can help us.' " 10-7-95. The Econofog: "The myth of the powerless state." [lead for a superb 40- page survey of the world economy] The increasing "globalisation" of the world economy is a fact, and one that nobody can ignore. To many, however, one aspect of this change is especially important: its effect on "economic sovereignty". They claim that global integration is emasculating the modern state. If the number of believers is any guide, these views are appealing. Yet the new orthodoxy is wrong. The world has changed, the global economy has indeed arrived: nonetheless, the emasculated state is a myth. Micro and Macro: FOR_who (19 kb)

1 0

Boston Globe article
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Boston Sunday Globe Business section has an article by Jon Auerbach entitled Cypherpunks with a picture of Carl Ellison and one of Ian Goldberg and David Wagner. It stresses privacy, anarchy and the fears of the FBI.

1 0

Re: cypherpunks digicash bank?
by cman＠communities.com 17 Dec '03

17 Dec '03

I strongly recommend that anyone considering licensing from Chaum first read my paper on some interesting aspects of his basic blinding patent. The paper is at: http://www.communities.com/paper/agnostic.html. I will be putting up another short paper on anonymous currency management within the next few days. Also, I strongly recommend that anyone serious about this not use the word "bank", and take the time to figure out how to structure the service as an NBFI (non-banking financial institution) and not a "bank". Note that NBFIs are still regulated, and you will, at minimum, need to consult with your state banking regulators as well as the IRS (who also regulate money transmitters, i.e. issuers of traveller's checks, moneygrams, etc.) Note that the BSA (Bank _non_ Secrecy Act) does in fact apply to NBFIs and money transmitters, and you should be sure to educate yourself as to the implications of this. I will be covering some aspects of these issues at length in my trip report on the anti-money-laundering conference I recently attended, which was a real eye-opener in a number of ways.

2 1

Cypherpunks in the Boston Globe
by nyuan＠husc.harvard.edu 17 Dec '03

17 Dec '03

"Cypherpunks: In pursuit of privacy they break codes, fault government plans" by Jon Auerbach is on the front page of the business secion of today's Boston Globe. It leads with a paragraph on Carl Ellison, along with a picture captioned with his quote "We have privacy in the real world." Aside from a few minor inaccuracies and simplifications, it seems like a very balanced, cypher-favorable article. -nhy --------------------------------------------------------------------------- Nina H. Yuan yuan(a)wjh.harvard.edu nyuan(a)fas.harvard.edu nyuan(a)bbn.com "Education is a progressive discovery of our own ignorance." - Will Durant ---------------------------------------------------------------------------

1 0

Re: cypherpunks digicash bank?
by cman＠communities.com 17 Dec '03

17 Dec '03

Adam -- I'm afraid you may have somewhat misunderstood the motivation behind the Identity Agnostic paper. In no way is it intended as a way of not facing the music wrt regulators in the country(s) where such an institution has offices. The IA approach is intended as an possible alternative for an institution that might otherwise license from Chaum. The regulators I've discussed this with are primarily concerned with how money moves into and out of a digital cash system. The fact that small payments cannot be traced from buyer to seller is not at the top of their list of concerns -- it's already a basic fact of life for them in existing payment systems. They are also not oblivious to the privacy concerns inherent in an institution logging masssive amounts of counterparty data about small transactions. I would strongly discourage anyone from trying to set up a garage- type operation. While regulators clearly don't appreciate the subtleties of this stuff, they can spot an illegal bank or an unlicensed money transmitter from a mile away. If your concern is creating account anonymity, then you're going to need to set up outside of the US. Do be aware that even the more relaxed countries of the world have regulations that cover this sort of thing, and they are especially interested in making sure you at least pay the appropriate licensing fees.

1 0

Netscape 2.0 beta
by Ray Cromwell 17 Dec '03

17 Dec '03

Well, it's not mentioned on their home page yet, but I went to their ftp site and I found that Netscape 2.0 beta was up there. For those wishing to get their hands on Java, they don't support Java on the Mac or Linux/NetBSD/BSDI platforms yet. Only Win95/NT, IRIX, and Solaris/SunoS are supported for Java. I knew it was too good to be true for them to have ported Java to so many platforms so quickly. The good news is that someone finally, after years, has implemented Progressive JPEG (I've been yelling about it for a while myself), and it is simply *light years* better than interlaced GIFs. -Ray

2 1

Re: Netscape 2.0 beta
by David K. Merriman 17 Dec '03

17 Dec '03

Even nicer would be if the Windows beta included *all* the files needed. The setup routine wants to install some OLE2 .dll's, but they don't seem to be included with the compressed file, or even on the Netscape site. I was able to work around it, since I already had the OLE2 stuff on my machine, and edited the installation scripts and such - other folks aren't likely to be as 'lucky'. I suspect that Netscape is going to be hearing about that little oversight..... Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Nat Sec Eco Espo
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The anonymous post of the White House's National Security Science and Technology Strategy recalls debate on this policy underlying reports on CIA economic espionage: Clinton instructs CIA to focus on trade espionage - report Los Angeles, Jul 23 (Reuter) - President Clinton has ordered the Central Intelligence Agency to make economic espionage a top priority, according to a report in the Los Angeles Times on Sunday. The report quotes American intelligence sources who say the CIA was instrumental in providing U.S. trade negotiators information during heated auto trade talks with Japan this spring, and has helped uncover bribes by rival nations competing with U.S. firms for government contracts. The sources say Clinton has issued a classified set of intelligence priorities for the post Cold-War era, and that the CIA is providing case officers with new training on economic matters to meet the new challenge. The recent trade talks with Japan were viewed as a success of the new policy, according to the Times report. It said U.S. Trade Representative Mickey Kantor was pleased with the CIA's ability to report on the bargaining positions of American rivals. But the agency has reportedly been less willing to spy on individual companies. In one recent success in that area the CIA discovered that the French were offering bribes to Brazilian officials to help telecommunications giant Thompson win a government contract. The report says intelligence information helped U.S.-based Raytheon Co. elbow out Thompson of France to win the work. But the problem in such work, say intelligence sources, is determining which multinational corporations based in the United States should be considered "American" firms deserving assistance. Because of this confusion, CIA officials argue they should be kept out of spy work targeting individual foreign business at the behest of U.S. corporations. Even so, the Times report says the intelligence community has told Congress it can claim credit for uncovering bribes affecting $30 billion in foregin contracts over the past few years. -----

1 0