December 2003 - cypherpunks-legacy

Re: NT's C2 rating
by Mike Tighe 17 Dec '03

17 Dec '03

>At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>>The fine print says its insecure as soon as its connected to a network. >>Ain't nothing fine about that print. An operating system or piece of >>hardware may be C2 certifiable. But only a complete system in a specific >>configuration can be certified as C2 compliant. The way I read the orange >>book, no system with a network connection can ever be C2. To address that problem, they wrote the Trusted Network Interpretation a few years after the Orange Book Mike Tighe tighe(a)spectrum.titan.com http://www.tcst.com/~tighe/

1 0

Maybe not (was "PC: Using BIOS Wait function as a source of entr
by Deranged Mutant 17 Dec '03

17 Dec '03

I did some more tests with the variation when sampling the timer before and after a call to the BIOS Wait function on my PC. Set the delay to 977ms, which is allegedly the counter's resolution and collected samples at even intervals (various ones) and found recurring patterms. For instance, sampling every timer tick (about 55ms) produced a repeating pattern where every 16th sample had a delta well over 1200 while all the others were under 900, usually under 800. Every so often the 16th sample delta was very low instead (between 400 and 600). Plotting the samples in a noise sphere showed very definite streaks with a few spots in isolated areas. So this is NOT a good method to use after all. I'm still curious as to what causes the variation. Maybe has to do with the CPU cache or port interfaces with the CMOS timer? Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Please criticize PGP-based robomoderator
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Fri Mar 22 21:25:47 CST 1996 To: cypherpunks(a)toad.com Subject: Please criticize PGP-based robomoderator Hello, Today UVV's announced that a new group, soc.culture.russian.moderated, was voted into existence. If all goes well, it should be newgrouped soon. For this group, I wrote a robomoderator program that does the following: 1) Enforces posting style required by the charter 2) Checks PGP signatures on incoming messages and prevents some types of forgeries 3) Implement secure (PGP-based) exchange between robomoderator program and human moderators, for messages requiring their approval 4) Black lists, white lists, and lists of suspicious words (Cypherpunks may imagine that ``medusa'' would be a suspicious word for this list) 5) Signs (with Greg Rose's PMApp) approved articles to prevent posting articles with forged approval 6) supports appeals, moderators' mailing list, and more. A specification for the robomoderator is on my home page at http://www.algebra.com/~ichudov/usenet/scrm/robomod/robomod.html and your criticisms and suggestions are more than welcome. For security reasons, we cannot post the code yet. We'll do it after I systematically proofread it to make sure that it is secure. Robomoderator is written in perl and sh, with some C code. It is working, but there are sopme minor things to do (they are listed in the TODO list on my WWW Page). Thanks to Dr. Dimitri Vulis for several good suggestions that I implemented. - Igor. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVNx8sJFmFyXKPzRAQEgVwP+Il58rOpbWtlC0MW4tPrYEnuF9JC5OJET VhaWud9lYzMDo9sdiBBmmgPqs5n3/lPpvxuNX4oCNbooP/U7SE8iqqOlcEdRDI3d KCSS8jol+T+VQGyVg8GkNrjSzSrfBrnka/CYMCXzKPGCFKcj5QiO1ufuBlhcxNsa glTt8xf5BrY= =xUgQ -----END PGP SIGNATURE-----

1 0

Conference of Interest
by Black Unicorn 17 Dec '03

17 Dec '03

Interested Cypherpunks might wish to review the following: The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 While at first glance not crypto related, in past this conference has brought together a fascinating combination of spooks, private sector types, TLA's and academics. The amount of access to otherwise secretive and shadowy officials and "big name" types is significant. I have found in past that everyone at the conference is fairly approachable. The networking and back room, off topic discussions are so numerous that in some ways the title of the conference is a misnomer. Though the fees are hefty, I encourage c'punks who will be in the area to consider attending. Additional information is available at (202) 739-9180. The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 on Monday, April 1, 1996 at The Four Seasons Hotel Corcoran Ballroom 2800 Pennsylvania Avenue, NW Washington, DC 20006 Preliminary Agenda 8:00-9:00 am Registration 9:00-9:15 am Welcoming Remarks - Eugene K. Lawson, President, U.S.-Russia Business Council Introductory Remarks - Ambassador Robert S. Strauss Chairman, U.S.-Russia Business Council 9:15-9:45 am The Honorable Anthony Lake Assistant to the President for National Security Affairs 9:45-10:15 am H.E. Yuli Vorontsov Ambassador of the Russian Federation 10:15-10:30 am Break 10:30-11:00 am The Honorable Jan Kalicki Counselor to the Department of Commerce and U.S. Ombudsman for Energy and Commercial Affairs to the NIS 11:00-11:30 am Eugene K. Lawson - Financing Update 1996 11:30-12:00 am The Honorable John M. Deutch Director of Central Intelligence 12:00-12:30 pm Reception 12:30-2:00 pm Luncheon Luncheon Speaker - The Honorable Michel Camdessus Managing Director of the International Monetary Fund 2:00-2:30 pm The Honorable Lawrence H. Summers Deputy Secretary of the Treasury 2:30-3:30 pm Panel Discussion - "View from the Trenches" 3:30-5:00 pm Panel Discussion - "Russian Presidental Election and Beyond" 5:00-6:00 pm Cocktail Reception --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: Digital Signature Inititiative
by Alan Olsen 17 Dec '03

17 Dec '03

I am glad to see this clarification on the signature policy. (Sorry for the paranoia, but I have reasons to be wary of plans made in Redmond...) The article that I quoted in the first post was quite misleading as to a number of points. (Which is why I should not believe things written in one page articles, but that is another point...) With the author's credentials, I would have expected a wee bit more accuracy (or clarity). I do have a number of comments on what you posted, however... At 04:04 PM 3/22/96 -0800, Stuart Theodore wrote: >Good afternoon, > >I am the program manager at Microsoft responsible for putting the >digital signature program in place. I am sending this mail in response >to a recent mail string sent to these aliases appearing at the bottom. > >To summarize some important points of the program: > >* The program creates a certificate authority infrastructure which >consists of thrid party non-software affiliated companies such as >VeriSign and GTE who will act to grant certificates to allow code to be >signed. The policies defining who can be a certificate authority and >what it means to be a trusted software publisher will be a matter of >public policy(standard). The point being that Microsoft does NOT >control who can/cannot sign code. This is a good thing. (This was clarified after I posted by a developer who had returned from an MS developers conference on Internet Apps.) It is also nice to see that there will be more than one option of signing services. Hopefully the policies will not be such as to shut out the small, independant web designers/developers. >* This approach solves the problem of identity and integrity, and is >viewed by MS as complementary to the sandboxing approach used by Java >scripting, which we view to be incomplete and unsatisfactory by itself. >We believe that Java needs to sign platform dependent Java classes in >addition to their sandboxing scheme. Actually it protects against mallicious code (for the most part), but not against badly designed code. I can see where improperly tested and designed code could cause problems on host machines. I have not seen anything that makes OLE code more secure (or more stable) in the real world environment. (Just lots of paperwork being signed that says "We will not use these powers for Evil".) With Java, there has been alot of work to make the language less subject to abuse. I have not seen anything in that regards involving OLE. >* The W3C is creating a working group in this area to develop standards >around the policies mentioned in the first point, and the formats of the >certificate and signature formats. Microsoft is committed to making >this a open, industry, x-platform standard... This is a good thing. And I hope that they release them to the rest of the world before implementing them and releasing in a bunch of MS products. (This is one of my big beefs with Microsoft. I have seen a number of cases where APIs are released to developers MONTHS after they appear in Microsoft products. Not cool.) >* regarding the mac question - there already is a version of Internet >Explorer for the Macintosh, available for download at >www.microsoft.com/ie. Microsoft is has already announced its committment >to building cross-platform internet products. I am glad to hear it. Before this thread i had not heard of a Mac version. (Maybe it is becuase my friends who use the Mac have dropped using any Microsoft products. Come to think of it, it was because of how Word for the Mac implemented OLE... (Among other things.)) >I would be happy to answer more questions you may have about this >program, inluding proving more information. The part that interests me about the signing of executables is not for distribution over the web. (I beleive that OLE is not abuse proof enough for that yet.) What I would like to see is an API (or internal routines) to allow the app to check the signature opon loading and perform checks to detect tampering within the executable. This I see as a very useful thing, mpore so than the web applications. Is such a thing planned? Also, is there a web page that has additional information/plans about this API? --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

So what? I've gone years without filing a damned tax return because I don't owe anything. And the couple of times I realized they owed me something I filed tax returns a year or two late. They don't give a shit unless they think you owe them money (or technically, if you actually do even if they don't know it). CP-Lite warning: no crypto. CDA Warning: Fuck you too. gjeffers(a)ns.htc.net (Gary Lee Jeffers) scritten: >From STRATEGIC INVESTMENT March 20, 1996 ... > Is the IRS a paper tiger? ... > As the IRS teeters on the brink, a fellow named Eddie Kahn has stepped >forward and may be about to push the whole creaking mess over the edge. >He hasn't got an arrow in his back yet, so he might just succeed. Dis- >dainful of "tax protests" such as 5th Amendment or legal tender arguments >that quickly get their advocates behind bars, Eddie looked into the stru- >ture of federal law. When Congress passes a law, codified as a statute, >it then delegates to a regulatory agency the authority to issue the im- >plementing regulations specifiying to whom and under what circumstances >the statute applies. These regulations must, by law, be published in the >Federal Register. Lacking these implementing regulations, the law cannot >be applied and has no force. Well, it turns out that the implementing re- >gulations for IRS' enforcement statutes-things like the requirement to >file a tax return and the authority to place a lien-cannot be found in >the Federal Register. When queried on this, the General Counsel for the >Office of the Federal Register, Michael White, replied in writing, "Our >records indicate that the Internal Revenue Service has not incorporated >by reference in the Federal Register a requirement to make an income tax >return."

1 0

Re: [NOISE] Re: Ecash API about to be released
by jim bell 17 Dec '03

17 Dec '03

At 02:49 PM 3/22/96 -0500, t byfield wrote: >9:34 AM 3/22/96, jim bell: > >> For obvious reasons, I am interested in ecash with full payee, as well as >> payer, anonymity. Last I heard, Digicash didn't provide this. Any updates? > > Finally setting up shop, eh? No, just keeping the pot boiling. > I can see your shingle already: > > ------------------------------------ > | | > | JIM "Yeah, THOSE Daltons" BELL | > | | > | Anonymous Assassination Broker | > | | > | "redefining | > | random violence | > | since 1996" | > ------------------------------------ One reason I can say with a good degree of confidence that I've already won the debate is that my opponents are stuck with fielding silly "feel-good" one-liners such as the one you've crafted above. Nothing I've said indicates that I'm in favor of "random violence": the kind I would _enthusiastically_ facilitate is a highly-directed form of violence, in the direction of people who have historically maintained a high degree of implied and potential violence in this society for decades. That's right, government employees. You know, the ones who can attack you (as they did Rodney King), illegally search your house (as they did OJ Simpson), shoot up and eventually burn your residence (a la Waco) and kill innocent people in a standoff (Ruby Ridge.) Oh, yes, I can't forget Donald Scott's fate, to be killed in a hail of police bullets fired during a search obtained with perjured testimony. Not to mention the collection of well over a trillion dollars in individual and corporate income taxes, none of which could be collected without the ultimate threat of violence against those who resist. Naturally, the closet (and not-so-closet) statists see nothing wrong with this kind of government-authorized violence, and therefore they would object to any attempt to prevent it as I am doing. The only way you will ever be able to effectively challenge my opinions is if you're forced to deal with reality: This society is already saturated with violence and the threat of violence, and the only way to stop it is to disable those who maintain that violence. The best way is to force them to resign, or eliminate them if they do not. Care to try again with a more credible argument? Jim Bell jimbell(a)pacifier.com

1 0

Re: Free speech debate on MSN Encarta
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 10:17 PM 3/21/96, Raph Levien wrote: >So here's a random idea: have an ISP that essentially firewalls the >Internet connection to the house, so that it is very difficult to get >unwanted stuff over the wire at all. The ISP can maintain and update the >latest high-tech tools, including filtering by URL, filtering by >keyword, and other stuff like detecting proxies. While they're at it, >they can filter out junk email. This is easily done from a technical standpoint. There is a set of patches for the CERN server that lets you have it automatically delete advertisments from certain prominent sites (used to be called NoShit, I heard they changed the name) when you're running in proxy mode. You can even have it change profanity into "EXON EXON" on the fly. Running something like this is probably a good thing for the ISP as running a cache will allow them to get more mileage out of their net connection. However, I don't think it likely that many ISPs will go this route from a liability point of view - if some parent is paying them to filter out smut, and little Zippy finds a brand new x-rated site, chances are some irate parent will sue them. With the proliferation of new pages, it is impossible for anyone to keep up, unless the authors voluntarily include some smutscan codes in their pages. >Raph (whose son, Alan Mathison, was born Sunday morning at 5:01 am) Congrats. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

2 1

Re: protection on IoMega ZIP drives
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

re: >This is in regard to the now popular ZIP disks, the removable 100MB >cartridge for PC's/MAC's. > >Anyone have any idea how secure the ZIP disk is once it is "protected?" I >know that the disk will refuse to be mounted without the passkey, but what >is really happening here? In my experience (on a Mac) the Zip doesn't get any slower once protected so I expect it is probably some mickeymouse bit that gets set somewhere, and the Iomega driver simply refuses to mount the disk. I don't think Linux would even blink before mounting the purportedly "protected" volume. If you're concerned about securing your carts, I recommend creating a CryptDisk file on the Mac disk. I don't use DOS/Windows, so I can't suggest anything for that, but I'm sure someone else on the list will jump in. Matt Blaze recently posted an announcement of a new release of his secure filesystem for unix to the list, which I believe also runs under Linux. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

Re: LET'S ROCK!!!!
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 8:26 AM 3/22/96, WThinker wrote: >Ok, here is the situation. I have a person mad at me in one of my mailing >lists. Turns out, this person was the owner of the mailing list! Well now >I'm stuck, knocked out of the list. The owner can not see any of my mail, >no matter how hard I try. I need some ideas to eather get through to her, >or really fuck up the mailing list. > >Any ideas? Learn to spell, write a really poignant suicide note, and then cut off your head with a chainsaw. That'll make her sorry. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0