December 2003 - cypherpunks-legacy

Re: Vexatious Litigants (was: SurfWatch)
by Martin Diehl 17 Dec '03

17 Dec '03

Henry Huang <hwh6k(a)fulton.seas.virginia.edu> at INTERNET-USA wrote: > On Mar 7, 22:29, Timothy C. May wrote: > > At 2:38 AM 3/8/96, Bill Frantz wrote: > > >At 6:59 PM 3/7/96 -0800, Timothy C. May wrote: > > >>If SurfWatch can be sued for a "bad review," then Siskel and Ebert > > >>had better find a new line of work. > > > > > >As long as a reviewer corrects errors, as SurfWatch seems to be > > >willing to do, I think they are relatively suit-proof. If they don't, > > >well - anyone can be sued for anything. I'll let the lawyers comment > > >on the possibility of success. > [snip] > Thanks for the clarification. However, this line of argument applies > only to "third-party" ratings systems. Right now, > Microsoft/RSAC/SurfWatch and SafeSurf/Cybersitter/etc. are setting up > competing standards which would essentially force people to > "self-rate" their own sites, or else be blocked out by browsers > configured to reject unrated sites (a feature Microsoft plans to add > to its Internet Explorer). > The question I have is if these systems were widely implemented, could > an Web page author or provider of content be sued for "mislabeling" > their page? If so, under what circumstances? Could the RSAC attach > legal requirements to the use of their system, and open up such a > loophole (similar to how Sun attaches conditions to the use of its > "Java" logo)? Seems to me that if the Web page author labels his page conservatively, i. e. "materials may be unsuitable for non-adults; may contain controversial material, may contain views different from your own, etc.". How can the author be liable for mislabeling? Martin G. Diehl

1 0

Review Litigation
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:59 PM 3/7/96 -0800, Timothy C. May wrote: >We need to be very careful here. A service like "SurfWatch," voluntarily >used by others, has entered into no contracts with sites to meet defined >standards of what should and shouldn't be blocked. It is essentially a >"review" service, like a reviewer of books, movies, restaurants, etc. Sure, >some books, movies, and restaurants are "hurt" by negative reviews, but >this is life in a free society. It has not yet reached the point in these >Beknighted States that a bad review can be the basis of a tort (though I >could be wrong...nothing would surprise me these days). There was a recent case of a restaurant suing over a bad review that did go to trial. The reviewer won. There has also been litigation against someone who wrote a letter to a scientific journal attacking someone else. The letter writer won. Of course both the letter writer and the reviewer had legal costs because they were unwilling to proceed in forma pauperis. DCF

1 0

Fertilizer & fuel oil as cause for suspicion - similar to cryptography?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

In the below article, the cops seem to be claiming that fuel oil, fertilizer, and bomb-making knowledge = illegal explosives possession. This idea doesn't make sense. Crypto relevance? An example of how governmental idiots are likely to take cryptography. -Allen ----------------- Copyright &copy 1996 Nando.net Copyright &copy 1996 The Associated Press CORVALLIS, Ore. (Mar 8, 1996 11:09 a.m. EST) -- Ingredients for a fertilizer bomb like the one that killed 169 people in Oklahoma City were found on a farm along with bomb-making instructions, guns and drugs, police said. Four people were arrested on weapons and drug charges. Charges involving illegal explosives were expected to be filed later, police Sgt. Dennis Carson said Thursday. Officers seized a large quantity of fuel oil and the fertilizer ammonium nitrate, two key ingredients in the April 19 Oklahoma City bombing. "My understanding is it could have made a large bomb and a rather large explosion had it been detonated," Carson said. "All they had to do was mix the parts. It would take just a few minutes." He wouldn't say how much fertilizer was found in the raid Wednesday night near this city about 80 miles south of Portland. The fertilizer, found in an 8,000-square-foot barn, was removed in a state police bomb-squad truck. Carson said investigators were trying to determine whether those arrested had plans to bomb a building or had ties to any anti-government groups. The federal Bureau of Alcohol Tobacco and Firearms is investigating. Along with the material for the fertilizer bomb, officers found 29 guns, including eight assault rifles, and material to make pipe bombs. Three ounces of marijuana and some methamphetamine were also found. [...] All were charged with drug possession and Luehring and the younger Bradley were also charged with being ex-convicts in possession of weapons. Carson didn't have details on their criminal past. [...]

1 0

Review Litigation
by sasha1＠netcom.com 17 Dec '03

17 Dec '03

What if somebody gets a positive review they do not deserve, or has incorrect data? Can somebody file a "public against reviewer" lawsuit? Who would collect damages (public, competitors)? ----------------------------------------------------------- | Alexander Chislenko | sasha1(a)netcom.com | Cambridge, MA | | Home page: http://www.lucifer.com/~sasha/home.html | -----------------------------------------------------------

1 0

Where to find krypto?
by MFN＠FRCU.EUN.EG 17 Dec '03

17 Dec '03

Dear friends, Can you advice where to find krypto or any good cryptanalysis software. Yours sincerely, Mohamed Farouk

1 0

steganographic trick
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

here is an interesting trick/algorithm that I've not seen before, although I admit I'm not intimately familiar with all the crypto formulas that others here may be aware of, so this may have been toyed with before. in pondering steganography, it seems to me there could be made a distinction between two types. in the "classic" type, say hiding data in the low bits of a digitized image, the whole existence of an encrypted "covert" message is totally concealed. that is, not only is the message concealed but the existence of it is as well. now consider a different kind of steganography, in which it is clear there is an encrypted piece of data. the problem with all steganographic crypto is that to use your data, you have to have your stego tools handy, and the "feds" could see these tools and accuse you of hiding data. imagine an application where you freely admit that you have your cryptographic tools, and that you are even willing to tell the "feds" the key for your data. they run the crypto program, and indeed the file decrypts. however, unknown to them, you have given them a key that decrypts the file into something meaningful yet benign, such as a cookie recipe, not your plans for the overthrow of the state. in other words, "interlaced" or "coincident" within the same file is your secret data. given one key, it decrypts into one set of data, and given another key, it decrypts into another set of data. there are probably many different ways to do this. of course the distinction of what I am proposing and two different files, each with different keys (which is already feasible), is not all that crisp. anyway, I pursued this anyway to come up with an algorithm. pick a large prime, P. now pick two other large primes that are less than sqrt(P), P1, P2 (actually all that is required is that P1*P2 < P). the data in the file is organized into blocks of information modulo P. P1 is the "harmless" key for message 1 (M1), and P2 is the "real" key for message 2 (M2). now the trick is to put data into your file one "piece" at a time such that it decrypts into either the corresponding "piece" of M1 given decryption by P1, or M2 given P2. I think some people can anticipate what comes next: the encoding of the data for M1 is contained in the "segment M" modulo P1, and M2 is contained modulo P2. the chinese remainder theorem lets us find the unique number N such that N mod P1 = M1, and N mod P2 = M2. "N" is the data that is stored in the file. I'm being a little sloppy in notation here: the overall message is broken into segments mod P-- the above algorithm is simply repeated over each "segment". given all the caveats about complexity of factoring etc., if P1, P2 are large and not "close" to each other (i.e. one could find P1 by searching in the "vicinity" of P2), this would be a secure algorithm as far as I can tell. to decrypt, the file is broken up into pieces mod P, and then each of these pieces has a value mod P1 or mod P2 that is used as the value of that piece. hence, we have an algorithm in which data is stored "coincident" or "adjacent" in a file. the feds could potentially observe that the key you give them, P1 < sqrt(P), and realize that there is "room" left over to store a secret message. but if you store all your files that way, they have nothing to go on. in fact you could assert, "yes, that was once a file with two messages in it, but I deleted the other one. it's key used to be Px". Px is a random number. of course, this method could be expanded so that any file has any number of secret pieces interspersed in it, each only available given knowledge of its secret key. again, the same thing can be accomplished by concatenating multiple files, each with a different key, or even alternating bytes or bits in a file, but I thought it would be interesting to find something that had this "coincident" or "adjacent" property based on the modulo and large prime properties used everywhere in modern crypto.

2 1

Re: Assassination Politics(tm) was V-chips, CC, and Motorcycle Helmets
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 16-FEB-1996 03:25:12.58 >At 02:18 PM 2/15/96 -0800, Bill Frantz wrote: >BTW, for the record, just a couple of days ago Clinton probably passed >within a mile of my house, "Slant range", in a helicopter, with a day's >warning. (The term, "slant range", is a "term of art," for those not in the >know.) Yes; one could also take out a great deal of Washington DC via toxic gas. (If it weren't flammable, hydrogen cyanide would work nicely; just mix potassium cyanide and hydrochloric acid). Unfortunately, this would also kill a lot of innocent people (including, under my system of ethics at least, some governmental types. Look at Governor John P. Altgeld if you don't believe that any can exist; he pardoned the Haymarket riot scapegoats, and ruined his political career by doing so). >Now, imagine you were a government employee in this line of work, and a >fellow employee was bumped off due to a well-publicized incident. Next time >you're asked to engage in a Waco-like operation, what do you think you'll >say to your manager? "Is this trip necessary?" >This is called, "deterrence." You have a point. Of course, this gets back to the ever-present debate over whether the death penalty causes deterrence or not. I suspect it doesn't for most gang members; whether the actual (as opposed to rhetorical) psychology of governmental employees would predict the same is an interesting question. >Now, I think statistics show that each year, about 800 billion dollars in >individual income taxes are collected. If we assume that the equivalent of >only 1% of that value was donated to solve the "IRS problem," that's 8 >BILLION dollars, which at $10,000 per person would buy 800,000 deaths. >THat's 7 times the current employment of the IRS. >You tell me: What would the average person pay THIS YEAR to avoid paying, >say, a $100,000 tax bill NEXT YEAR? (Hint: How much do rich people pay >their accountants, TODAY, to avoid taxes?) You've got a "tragedy of the commons" problem. Everyone would assume that everyone else would do it. (Admittedly, that libertarians have among the highest charitable donation rates of any group may argue otherwise). Now, targeting whoever audited you is a quite likely possibility. >Another Hint: Consider Bill Gates. His wealth is variously estimated at >over 10 BILLION dollars, probably almost all of which is in long-term >capital gains (Microsoft stock), for which he will have to pay somewhere >around 30% in Federal income taxes if he should choose to cash out. He >would be 1.5 Billion dollars ahead if he donated $1.5 billion dollars to an >organization which would eliminate his requirement to pay the total 3 >billion dollar tax bill to the IRS. That alone is the equivalent of about >$14,000 for each IRS employee. You have an interesting point here. -Allen

1 0

Internet Commerce
by Goldberg＠eit.com 17 Dec '03

17 Dec '03

EIT/VERIFONE IS A RECOGNIZED PIONEER IN THE DEVELOPMENT OF SOFTWARE AND SERVICES FOR ELECTRONIC COMMERCE ON THE INTERNET. EIT IS A WHOLLY OWNED SUBSIDIARY OF VERIFONE, A LEADING GLOBAL PROVIDER OF TRANSACTION AUTOMATION. EIT/VERIFONE RECENTLY ANNOUNCED AN AGREEMENT WITH NETSCAPE COMMUNICATIONS TO CREATE COMPREHENSIVE INTERNET PAYMENT SOLUTIONS AND AN AGREEMENT WITH ORACLE TO COMBINE ORACLE'S POWERFUL WEBSERVER SOFTWARE WITH VERIFONE'S HIGHLY REGARDED AND SECURE PAYMENT SOFTWARE, TO PRODUCT THE FIRST PAYMENT-ENABLED WEBSERVER ON THE MARKET. LEARN MORE ABOUT EIT AT WWW.EIT.COM 1) Internet Engineer, SET Implementation Be a member of a team that will implement the SET protocol module (used for secure credit transactions over the Internet.) This candidate must have at least five years experience as a developer writing commercial grade software using C++. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Experience writing software using ASN encoding rules * TCP/IP network programming * Significant cryptographic experience * Cross platform development experience using both Unix and NT. We will be pre-disposed to candidates who have significant experience in: * Internet protocols * Java * Financial networks * Site security work * Systems programming 2) Internet Engineer - SET Development Be a member of the SET development team. This candidate must have at least three years experience as a developer writing commercial grade software using C++. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Cross platform development experience using both Unix and NT. and meets at least two of the three following requirements: * Experience writing software using ASN encoding rules * TCP/IP network programming * Significant cryptographic experience We will be pre-disposed to candidates who have significant experience in: * Internet protocols * Java * Financial networks * Site security work * Systems programming 3) QA Internet Engineer - SET Development Be a member of the SET development team. The candidate must have solid experience as a QA professional with at least five years of experience in commercial software development and testing. This position will entail test design, test writing, and code coverage analysis of the SET protocol modules. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Cross platform development experience using both Unix and NT. * Working knowledge of C++ * Previous experience in White Box testing * Detailed understanding of modern QA processes We will be pre-disposed to candidates who have significant experience in: * Java * Financial networks * Systems programming * Communications Security and Data Security EIT offers a stimulating work environment along with competitive salaries and benefits. We are interested in full-time, contractors, and new graduates Please send your resume to Carole Goldberg via email, fax, or mail Fax: (415) 617-8019 e-mail: Goldberg(a)eit.com EIT, 800 El Camino Real, Menlo Park, CA 94025

1 0

Reasons for codes
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>Totally untrue. The use of encryption for business purposes goes back >centuries, In fact there are lots of reasons for codes. One not mentioned that has a long and glorious history involve CHARLESTON, TABLEDRUGS, or BLACKHORSE and can be seen in commercial use today. Warmly, Padgett

1 0

POTP Jr.
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 03/04/96 07:59 pm ## Subject: POTP Jr. ] >Date: Sun, 18 Feb 1996 19:20:55 -0800 (PST) >From: Wink Junior <winkjr(a)teleport.com> >Subject: Internet Privacy Guaranteed ad (POTP Jr.) > If an individual, or any group of individuals, break the IPG > Privacy System, IPG will sell them the company for $1.00, and > even give them the dollar to buy it with. If you think you > can, just try and you find out that it is impossible. There > may be rumors that someone has broken the system, but that is > not possible, it will never happen. Surely I can't be the only person who's noticed the obvious--that if you break their system, their company is worth nothing, since this is their only shipping product. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTujK0Hx57Ag8goBAQHxBQQAkUKL0h0eqxJ5rNGg7dDF6Beskem/RUWA IZYNoHBG/WZYv86dDrFSVXOllqyumlo5enH0xwXBfDf0TN+kasjIaH/UYHncXYiL yw/31wBDt4H1PzmF7Yg5zfSBaN18l9dFT+rLGRJKRjWFgzGIAJZ6Jmga7RJ0P+/k TWCgt4AdIIc= =eI1Q -----END PGP SIGNATURE-----

1 0