December 2003 - cypherpunks-legacy

another anonymous poster helping to destroy our rights
by fc＠all.net 17 Dec '03

17 Dec '03

We just heard from another anonymous poster trying to destroy our rights to free speech. How long will the cypherpunks put up with this? -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

4 4

URL for cypherpunks
by norm＠netcom.com 17 Dec '03

17 Dec '03

I am putting up some solutions to the Garage Door problem that was discussed here perhaps a year ago. I would like to refer to the cypherpunks by URL. Are there currently any appropriate URLs ?

4 3

COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh 510-601-9777 COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE Community ConneXion today announced Apache-SSL Commerce, a commercial version of the Apache webserver with support for Netscape Communication Corporation's Secure Sockets Layer, a standard for encrypted communications over the Internet. Community ConneXion's Apache-SSL package includes Apache v1.0.0, extensions to Apache which enable the SSL protocol, additional customizations to the webserver, and tools to aid in server and SSL maintainence. The server supports virtual hosts and an extensible API to allow for easy modifications to the behavior of the server. Apache is currently the fastest growing HTTP server, looking set to become the most used web server on the net in 1996. Sameer Parekh, President of Community ConneXion, commented on their release of the encrypting webserver, "We're very happy to make available an affordable SSL server to the Internet community. For security to work, it must be ubiquitous, which requires that encrypting servers be affordable and widely deployed." Apache-SSL is available for free to non-commercial users, and the commercial use package, Apache-SSL Commerce, is available for $495.00. Customers who own versions of other commercial encrypting webservers can upgrade to Apache-SSL Commerce for $295.00. In addition to the right to use the server in commercial applications, the commercial package includes support and free lifetime upgrades from Community ConneXion. Apache-SSL Commerce is not available outside the United States, but Apache-SSL is available for free, both commercially and non-commercially, outside the United States from Ben Laurie, of A. L. Digital, Ltd. The Apache-SSL Commerce webserver is the only commercial encrypting webserver with source available. Ian Goldberg, graduate student at U.C. Berkeley, well-known for his work on SSL security, commented on the importance of available source, "The public release of source, especially for security-critical sections of code, is vital for a product in which the public must put its trust. It's far better for me to be able to check the software that's used, say, for accessing my bank account via the Web, for security problems, than for me to be forced to trust whatever company put out the product. Companies will soon find that releasing more information about the internals of their products will lead not only to better products, but better reputations, as well." Portions developed by the Apache Group, taken with permission from the Apache Server http://www.apache.org/. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. This product includes software developed by Eric Young (eay(a)mincom.oz.au) Information on Apache-SSL is available at http://www.c2.org/apachessl/. Questions and inquiries regarding the server should be sent to apachessl(a)c2.org. Community ConneXion, founded in June of 1994, is the leading provider of privacy on the Internet. They provide anonymous and pseudonymous internet access and web pages in addition to powerful web service, virtual hosts, and web design consultation. Information is available from their web pages at http://www.c2.org/.

1 0

Re: Telcom bill report
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"futplex(a)pseudonym.com" 21-DEC-1995 18:57:06.16 >> Here's the additional info from Reuters. As usual, Clinton is being a > coward. How do you figure ? > Vice President Gore says President Clinton will sign the bill. Before > the agreement, the president had been threatening for months to veto > the bill if Republicans in Congress did not retreat on a long list of ~~~~~~~~~~~ > issues. They retreated. ~~~~~~~~~~~~~~ Clinton won on this. The Administration does not appear to have altered its position on this substantially. ---------- I am calling Clinton a coward for giving in to the Christian Coalition and not vetoing this bill due to the censorship portion. He evidently decided that following his oath of office and upholding the First Amendment wasn't worth the "porn supporter" criticism Ralph Reed and his lot would direct his way. -Allen

2 1

Cybercash security
by David Klur 17 Dec '03

17 Dec '03

What are the major security risks of the Cybercash system? I can't really find any, other than someone cracking the consumer's Cybercash client s/w password and using the victim's account to order something, or someone cracking RSA!. The following features seem to mitigate other risks... - The merchant never sees the credit card number - The Cybercash server does not store any credit card numbers (only temporarily while it is waiting for an authorizatino for a specific card purchase) - The consumer's credit card number is stored on his hard disk encrypted w/DES - The consumer sends his credit card number across the Internet encrypted w/DES and signed w/ 768-bit RSA

1 0

DejaNews and Alta Vista Search Tools, and Privacy Implications
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Side note: I seem to have returned from my holiday away from this area and away from computers to a war zone, with multiple flames and threats of legal action. Being a part of the Cypherpunks group, and potentially part of the "criminal conspiracy" to defame, am I included in the lawsuits? I wonder.) Anyway, a point of clarification of a point, lest there be the belief that _all_ Cypherpunks are opposed to comprehensive Web search tools: At 8:46 PM 12/23/95, Steven L. Baur wrote: >Furthermore, no one has mentioned the positive changes made to ^^^^^^^^? >Dejanews since it got bashed thoroughly on this list a few weeks ago. >They've significantly turned down the amount of old information >indexed, and have restricted the groups (and mailing lists) they >archive. I for one don't consider this to be a positive development. Reducing the time horizon for searches has no real effect on the compilation of dossiers (for example), but certainly makes DejaNews less useful. (And I'd be willing to bet that the time horizon was scrunched down for space and time reasons, not for reasons of privacy; the horizon will likely _increase_ as users ask for, and perhaps are willing to pay a bit for, longer time horizons.) And I don't believe the dominant thinking of folks who commented was that DejaNews was worthy of "bashing." In fact, I found it all very interesting, and a confirmation of what many of us expected would soon happen, i.e., fast access to past comments. I think I and several others commented on the major implications for privacy, especially vis-a-vis the way corporations will be able to see compilations of postings to "outrageous" groups. Indeed, I know of some people hiring programmers who are already using such tools to get a better understanding of whom they may be hiring, or not. But my comments were not in the vein of "something has to be done," but of recognition that a Brave New World is fast unfolding. Thinking that one is "safe" because a particular search service is not including all the groups or mailing lists it _could_ include is illusory (one is reminded of ostriches....). The same thinking happened several years ago when a great hue and cry in the media caused Lotus to abandon plans to sell a CD-ROM to individuals with publically available census and other data on it about neighborhoods, phone numbers, etc. Inasmuch as the non-individual entities (corporations, mass mailers, courts, law enforcement, etc.) already have full access to such databases, all the hue and cry really accomplished was to give individuals a false sense of security and privacy. A triumph of feelgood style over substance. Real privacy and security comes from steps taken to make the information private in the first place, not to ex post facto limit access. (I am not claiming that Steven Bauer or anyone else on our list is calling for laws to limit Web search engines, just giving my views about this. As a matter of fact, however, I am hearing rumblings in other places that "there ought to be a law" about these archives, indexes/indices, etc. Same old story. Kind of hard to enforce such laws when the indexes are in Holland, or Byelorussia, or "somewhere in cyberspace." ) Face it, every single word written by any of us to any Usenet newsgroup, going back to the beginning of Usenet, and expanding out to many ostensibly-private mailing lists, will fairly soon be searchable. (Add some digital cash and proxy/remailer features, and someone will be incentivized to put some really big arrays of optical disks up for searching. And if the U.S. tries to "regulate" such searches....well, I'm preaching to the choir here....) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Strategic Investments ....
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

This can be some interesting ..... **************************************************************************** ********** GLOBAL STRATEGIC SYSTEMS NEWSLETTER December, 1995 Strategic Management Investments, Asset Allocation, Evaluation and Review Strategic Management System (SMS) investments are long-term investments and total ROIs of these investments can only be evaluated after several years from the initial decisions and activities. However, this does not mean that the organization can not evaluate many specific elements and short-term projects of the whole SMS project separately and obtain some good feedback and information about the short-term performance within one year or sooner. The implementation of an overall SMS can be divided into small development projects such as back-up system, customer complaint processing, environmental communication and employee recruiting system development. Specific Return on Investment and other financial and cost objectives can be established for these projects, and they can be evaluated and monitored on a quarterly and/or annual basis. However, the main strategic objective, the aim of the SMS, can only be achieved, when all elements of the SMS have been implemented, integrated and operated effectively. To justify, specific investment decisions, both short-term and long-term financial indicators can be used, which can satisfy many passive investor's requirements to commit to the long-term investments. Depending on the field of technology and business complexity, the organization can spend up to 30 % of its annual revenue in the strategic investments including system development and any new technology R&D activities. In some cases, costs can be higher. What is the portion of this amount that is invested in the development of the SMS? With some rough information, it was possible to calculate that about 25 % of the total annual strategic investment was spent in one ISO 9000 quality system development. This 25 % was invested in organizational capability, improved quality assurance and additional equipment, manpower and machine acquisitions. Using the above estimation, the management estimated that it had invested up to 7.5 % of its annual revenue in the strategic management system development activities. The major portion of this investment can be used in tactical, short-term development projects such as returned goods processing and test and equipment control, where the investment performance data can be obtained faster; and the rest of the SMS investment can be used for project/program management and coordination, organizational restructuring, responsibility and authority definition, document and data control and any other supporting system development activities, the financial monitoring can be more difficult. The major cost categories in the SMS development projects are: 1. development, implementation and training time (manpower excluding external training, consulting and assessment activities), 2. equipment and machine acquisitions, 3. materials such as office supplies and 4. external project activities. Investments in the development of any SMS can be either tactical or strategic. The financial performance of the tactical investments is very often much easier to evaluate than the evaluation of the long-term investments that may not have specific and measurable investment objectives and/or the accounting information to evaluate the performance against any specific objectives which can be difficult to obtain. It is possible to develop specific budgets for each element of the SMS development project and identify the sources of development benefits and cost reductions that can be used for evaluating the financial performance of each project. The financial performance (including the maintenance of development budgets and the achievement of investment performance ratios such as Return on Investment and Investment Payback Period) can be reviewed and evaluated on a quarterly and annual basis. Any consolidated investments in the whole Strategic Management System development and the SMS development progress can be reviewed in the annual Strategic Planning activities by the top management in the same way as any specific tactical investments can be reviewed and analyzed in the departmental level to identify any problem areas, any potential problems and to determine and initiate necessary corrective and/or preventive actions to achieve or maintain all financial performance objectives and targets. The organization should manage its investments in the SMSs such as ISO 9000, ISO 14000 or Information Security Systems as it manages all its capital expenditures or any investments in financial instruments such as stocks and bonds. These investments have to be controlled, managed, reviewed and improved upon on an on-going basis by the managerial level. Each element of the SMS development can have its own budget and budget responsibility. The organization may establish its own unique accounting system for each SMS development project including specific cost and expenses categories, and identifying specific sources of financial benefit information that can be used to calculate financial ratios. Any over spending or other negative financial performance issues can be brought to the attention in the management reviews, which may lead to the initiation of necessary corrective and preventive actions. It is easy to overspend and waste financial resources such as the waste of manpower without adequate accounting, record keeping and monitoring systems and methods. The utilization of actual financial performance measures helps the organization also to see actual financial benefits from the strategic investments and to justify additional SMS development activities. However, we still have the question: "How much should the organization invest in any specific SMS to satisfy its future business requirements?"

2 1

a new idea: stocks == currency
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I've been mulling over recent essays on digital cash by diverse authors that have popped up here and elsewhere and I'd like to highlight a revolutionary new "meme" of high cpunk relevance I see emerging, which I've not seen promoted by any single author yet (although I have seen some prominent cpunks argue the opposite). the basic thesis is as follows. digital cash obviously leads to an entirely new economic system in which the nature of routine future transactions may be radically altered. one of the chief alterations discussed ad infinitum on this list is the rise of economic freedom from taxation etc. however there is another interesting theme that is worth exploring at length that is at least as significant as this (bugaboo) taxation issue. one might look at the modern world and suggest that there is an increasing unification of currencies. the EU (European Union) is an example of this "trend". however I'm going to argue the opposite and suggest that the trend is toward increasing diversity of currencies. I believe we are moving toward a new system in which explosively more "currencies" will exist than do today. where will these come from? answer: stocks. I believe that future company stock will be considered a kind of currency issued by the company. when you are buying and selling stocks, what you are really doing is buying and selling currencies backed by different corporate entities. I have seen EH argue here and elsewhere that only a government has the legal capability of creating a currency. his view is that a currency is backed through *liability* that is enforced through laws. this is an interesting statist-flavor argument coming from a radical libertarian. what I would propose instead is that what a government has is *credibility*. this is the old "reputation capital" issue discussed here frequently too. a government is a massive entity larger than many companies that uses its full legislative "force" to back its currency. in another word, *trust*. however, I don't believe there is fundamentally a major difference between a company and a government, particularly in this area. (go ahead, flame me to oblivion for saying this, but I believe it is actually a very libertarian argument.) the only difference is in size and influence. it seems to me when a private company issues "cash", the basic principle is the same. the person who uses this cash is *trusting* the entity that issues it to back it with whatever they say they are backing with it. to use my stocks == currency analogy, the stock or currency of that company is backed by that company's assets and profitability. the interesting theme behind this is that it unifies the entire economic picture. suddenly the difference between currency and a stock tends to blur when stocks 1. can be exchanged readily 2. there is no government intervention/regulation in the exchange 3. middleman ("stockbroker" etc.) costs are minimized 4. (other similar elements yet to be identified) note that all these things appear to be the inevitable trend of uniting an economic system with cyberspace. -- my view of all this is somewhat blasphemous. the current system says that we have to have a government entity called the SEC to ensure that stocks are safe for those who invest in them. however, what I am suggesting is that a free market can actually devise its own methods of sorting out bogus from valid currency/stocks without government intervention. in fact, in my opinion that's precisely what investment advice is. this is exactly analogous too to the way that capital "naturally" moves away from unstable currencies and economies (of course capital does not do it, but the intelligent human forces that guide it amount to this basic effect). hence what I am proposing is a sort of currency spectrum. stocks are high risk but greater profit, and currency is low risk (stable) but subject to inflation or loss of value. they are two ends on a currency spectrum. and what I am proposing is that in the future, this currency spectrum will tend to emerge out of economic transactions in cyberspace. this currency spectrum will be recognized as a basic function of the cyberspatial economy. this economy will evolve overall to cut out middlemen and anything that decreases cash value. hence, you will see things such as companies offering their own cash (stock) directly to "consumers" without the large overhead associated with today's stock market (which will be considered a rather backward way of running an economy in the future because of the horrendous dissipation of capital involved in merely moving it from place to place). -- in the end, the government and various bankers lose their economic monopoly on "creating" cash, which affords them no end to manipulative capabilities. governments will compete with all other entities that desire to create cash systems. cash will move where governments and entities most "respect" it. oppressive tax laws etc. will be considered a lack of "respect" for cash. I know that the opposite trend seems to be happening: an increasing clampdown on "black cash". I think this may actually succeed in the short run, but the eventual movement of the economy is toward unrestrained cash in the same way there is a clear movement to an unrestrained cyberspace. there may be "blips" or "disturbances" on the way, but they'd merely be anomalies. my own view is that governments are either legitimately created or they are not ("consent of the governed" etc.). if they are legitimately created and maintained, then people will continue to support them even when it seems they have the choice not to (such as evade taxes). if they are not supported, then they are not legitimate. putting one's money where one's mouth is is the ultimate test of legitimacy in our reality. that is, support of a government by its people is the ultimate test of its legitimacy, and the the ultimate test of support is *cash*transferred*. no amount of policemen thugs pointing machine guns at tax protesters attempting to intimidate the entire population will change this basic reality imho. in fact I believe that many systems of today that are based on intimidation are going to dissolve as cyberspace becomes more prevalent. the scientology battle is a good example of this. before the internet their litigious intimidation tactics may have succeeded (and arguably did). however the tactics are becoming increasingly discredited in my view. but I am not saying this will happen without a struggle. I believe this will be the ultimate conclusion after a lot of turbulence and perhaps even bloodshed. -- today we think that cash moves around the world very readily, in the blink of an eye. but I suggest that today we actually have tremendous amounts of "friction" that are dissipating economic value of "currencies" merely as it moves through the system (the stock market would be one example). looking only at today's *cash* systems, indeed there is low friction, but when considers that *stocks* are actually cash, then our overall economic system is quite backward. cyberspace will act as a sort of economic lubricant of the highest degree in decreasing this friction. I will debate intelligent opposition to these ideas in this essay, but frankly I think what I describe is a reality that is going to emerge completely independent of my own promotion or anyone else's opposition. the famous Gilmore quote is that "cyberspace sees censorship as a defect and routes around it" has an analogy in the economic realm: "cash sees the middlemen as a defect and routes around him". inflation is one example of instability or lack of resiliency (a defect) of a currency. it can be seen as the exact opposite effect the growth of a stock is: loss of economic capital due to dissipation. I imagine one of the main claims against my essay will be as I anticipated above: only governments have the force and power necessary to back a currency. but I believe this is an anti-libertarian view. it suggests that cash only works when the government is involved, and the force associated with that government is employed as a means of keeping the system in check. can one have an economic system not based on mandatory obeisance to a government? I think it is clear to most on this list such a thing is not only possible but advantageous, desireable, and preferrable. the "trust" that a person places in a company stock is absolutely no different, in essence, from that placed in a currency of a government-- only the scale and the participants are different. I don't really believe that the legal framework associated with a government is what holds commerce together. there are many situations where companies simply eat their losses even when they are in the "right" legally and could sue and win. cyberspace will tend to prefer "anticipation" to legalities. in other words, it will tend to prefer to develop systems that anticipate failure (such as currency crashes) before they happen. courts will be seen as the absolute last resort for any kind of arbitration. in my view this has already happened today.

1 0

Rawbutt Day
by John Young 17 Dec '03

17 Dec '03

Rasping rawbutts for National Whiners Day here's a duo of pinhole puckers about the shut-your-filthy-hole bill: ---------- The Wash Post, Dec 25, 1995: Internet Football The Internet provisions are still in flux along with the rest of the host telecommunications bill, in which this newspaper and its parent company have an interest. If these provisions go through in anything like their present form, then their vulnerability to challenge on First Amendment grounds seems clear. It makes sense for a court to sort out the constitutional from the technical aspects of this new form of "speech," and the sooner the better. It won't be easy. The main legal questions about the proposed Internet indecency regulations as they now stand are inextricably wound up with technical issues. Can the "transmitters" of material that is deemed "indecent" ensure to a reasonable degree of certainty that underage computer users cannot get to it? If they fail, how can they show they tried? Several ideas here are flags for trouble. No legally solid test exists for the "indecency" standard now in the regulations -- patterned on those used for earlier dial-a-porn legislation but addressing totally different technologies. The coalition of moderate conferees had tried to replace the term with the more explicit "harmful to minors" but failed by a single vote. The Justice Department said in a letter last week that a "harmful to minors" standard was more likely than "indecency" to pass scrutiny but that "an overly broad restriction would likely not withstand constitutional scrutiny regardless of the standard chosen." That brings up the meaning of "transmit." Who is responsible for "transmitting" a smutty text that, say, a high school student locates by using an ordinary commercial account to (1) find, download and install free software that searches the Web, (2) use that tool to find a pornographic bulletin board overseas, and (3) make a copy to store in his own computer? The regulations now would punish anyone who "uses any interactive computer service to display [indecent material] in a manner available to a person under 18 years of age." But the bulletin board overseas isn't subject to U.S. Iaw. Most likely it will be up to the commercial providers to demand ID for certain types of accounts -- or up to account-buying parents to limit the scope of their kids' accounts. Whether providers can actually wall off sectors of the electronic world without cooperation from the adults paying the bills has more to do with the available electronic gizmos than with the laws governing the world to which they give access. There is much complicated back-and-forth about whether providers such as America Online and Prodigy will be held responsible for the effectiveness of the measures they take. But only the courts can decide what truly works. A court muddled its way through the Prodigy case on this topic in New York State recently. It declined to modify its own judgment that the provider was more liable because it had tried to create a "PG bulletin board" than if it had not. Whether or not this stands, it's a measure of the disconnect that persists as this legislation stumbles toward final enaction. ---------- The NY Times, Dec 26, 1995: Mr. Hollings Saves the Phone Bill House and Senate conferees seemed ready to negotiate a damaging telecommunications compromise until Senator Ernest Hollings of South Carolina, the chief Senate negotiator, altered that destiny last week. Wielding the threat of a filibuster and a deft legislative hand, he rescued the best parts of flawed House and Senate bills passed earlier, added some good new ideas and threw out most of the rot. His draft bill could spark innovation and set off consumer-friendly competition among television, cable and telephone companies. Its biggest flaw is a heavy-handed and probably unconstitutional effort to ban "indecent material" from the Internet. The original bills sought to break down barriers that keep media companies from entering each other's markets. But three mistakes were made. The bills would have deregulated cable rates before competition by other video companies could protect customers from price-gouging cable operators. Local phone companies would have been allowed to enter the long-distance market before they faced competition from cable or other companies. Worse still, the bills would have allowed broadcasters, cable operators, telephone companies and newspapers to merge too easily. That could expose consumers to a frightening concentration of information sources. Mr. Hollings, with the help of key Republicans like Senator Larry Pressler, fixed most of these flaws. His draft bill would hold up entry of local phone companies into long-distance service until the Federal Communications Commission says O.K. after giving weight to an antitrust review by the Justice Department. The bill leaves it up to the F.C.C. to set reasonable guidelines for mergers. It would put off deregulation of most cable rates for three years -- enough time for phone and satellite services to take on cable operators. The one serious error is a prohibition against transmission of allegedly indecent materials over the Internet -- the network of millions of on-line computer subscribers around the world. The indecency standard is probably unconstitutionally vague and restrictive. The standard is also unnecessary. The law already forbids sending obscene materials by computer. To protect children, parents can buy easy-to-use programs that block indecent materials from any source. The draft bill threatens to trigger further Government control of electronic communication -- which has blossomed so far precisely because Government has stayed on the sidelines. Fortunately, Republican leaders like Speaker Newt Gingrich are troubled by the indecency standard. There is a good opportunity to knock the provision out before Congress takes a vote. Some Republicans, miffed when Vice President Al Gore declared the draft an Administration victory, threatened to withhold support. But telecommunications, the heart of a high-tech economy, is too important for small-minded sparring. Congress should take up the draft bill, remove the indecency provision and put Mr. Holling's good deed into law. ---------- [The coccyx of a 12-26-95 WSJ eunucher]: First Amendment advocates, who have criticized the bill because it cracks down on Internet indecency and sets up a rating system and show-blocking circuitry against TV violence, got one small gift: The bill contains a provision for an expedited legal review of the constitutionality of those provisions. On the other hand, it also sets up a new law allowing 10-year prison terms for anyone who, using interstate phone calls, mail or other means, "persuades, induces, entices, or coerces" a minor to engage in any illegal sexual act.

1 0

Re: COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE
by James A. Donald 17 Dec '03

17 Dec '03

At 01:12 PM 12/26/95 -0800, sameer wrote: > The Apache-SSL Commerce webserver is the only commercial encrypting > webserver with source available. Ian Goldberg, graduate student at > U.C. Berkeley, well-known for his work on SSL security, commented on > the importance of available source, Thanks for the great work. This protects the web against GAK far more effectively than any political campaign ever could. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0