December 2003 - cypherpunks-legacy

Re: Remailers not heard from; info?
by Bruce Baugh 17 Dec '03

17 Dec '03

At 03:25 PM 2/19/96 -0500, Dave Mandl wrote: > >I know that there's no sure-fire way to find signatures that aren't >prefixed by, say "--", but that's better than nothing. A fix along the lines of :: don't-send-anything-after-this might be readily applicable. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

Re: Remailers not heard from; info?
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 11:17 AM 2/19/96, Bruce Baugh wrote: >And as long as I'm asking questions :-), I see that some remailers >(hfinney(a)shell.portal.com, hal(a)alumni.caltech.edu, homer(a)rahul.net) preserve >subject lines while others do not. Is this a readily settable option? If so, >I'd like to commend it to other remailer operators. Even more important, I believe that many (most?) remailers still leave signatures in by default. This is extremely dangerous, and inconvenient too, since some mail programs make you jump through hoops to turn off the signature feature. I think it'd be a good idea if ALL remailers omitted them by default and, if anything, allowed the sender to optionally leave his or her signature in (though I imagine that'd be a rare request). I know that there's no sure-fire way to find signatures that aren't prefixed by, say "--", but that's better than nothing. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

2 1

Re: Encryption in software licenses...
by mch＠squirrel.com 17 Dec '03

17 Dec '03

On Feb 19, 14:25, "David J. Bianco" wrote: } Subject: Encryption in software licenses... } Does anyone have a pointer to any good discussions on how to build programs } with encrypted license keys? ftp.csua.berkeley.edu used to have such a file } (/pub/cypherpunks/cryptanalysis/license.asc.gz), but the archive hasn't } been accessible for a few days. Although I remember this to be mostly about } how to crack such schemes, it has lots of useful information about how they } are designed in the first place. license.asc.gz and some other related stuff is available on ftp://utopia.hacktic.nl/pub/replay/pub/cracking This all goes back to the familiar lesson for all of us reading this newsgroup, the easy way to break most practical applications of cryptography is to find a way to "work around" or "subvert" the cryptosystem being used. Consider two popular UNIX licence managers FlexLM - uses weak cryptography by default to produce licence keys, although vendors can plug in their own Elan (V4.1 and above) - can use DES or a 5-rotor enigma. Both of these are better cryptosystems than that used by FlexLM. Now, does anyone here think that Elan is significantly harder to crack than FlexLM because it uses better cryptography than FlexLM? I hope not. The Elan marketing literature makes the use of DES sound like a big advantage. But, it doesn't make any difference to the cracker. There is actually some good content in the marketing goo at http://www.globetrotter.com http://www.elan.com if you're willing to sift through it. Writing and debugging a floating network licence manager which is reliable and multiplatform is hard. For a real challenge, try and put in some sort of redundancy (multiple hosts), and keep everything sane. The danger for a software vendor is that they end up with a good software product, which has a licence manager that makes it unreliable and causes problems for customers. I've seen this happen a few times. In this senario, customers often abandon the product and stop paying for support and upgrades, which are a significant part of the income of a software vendor. If word gets around (and it will), that your licence manager is buggy will adversely effect new sales. I'm a sysadmin, and every time a licence manager craps out and needs to be restarted, users can't use their software until they can get a hold of me. For some products (I'm not going to mention names), this happens on a more or less weekly basis. Licence manager malfunctions are relatively rare with products like FlexLM and Elan. The home-grown licence managers tend to be a real problem from a systems administration point of view. Here are my free (and worth every penny you paid) recommendations to a software vendor considering some sort of software based licence management scheme. 1. Trust your customers (best choice!!!) and concentrate your efforts on producing good quality software. This way you'll get more customers, etc. Crackers will be able to get around any sort of licence-management scheme anyway (just check out Usenet newsgroups devoted to binary mods to unlock applications and distributing keys for applications) 2. Buy an off-the-shelf licence manager which has a good track-record. It will already have the worst bugs worked out. Better to spend time working on improving the software you are trying to licence. 3. If you must roll-your-own, avoid trying to write a network-floating licence scheme. These are harder to write and have a lot more potential to turn an otherwise good product into a worthless piece of crap. 4. If you must roll-your-own network-floating licence manager, be prepared to expend a lot of time and effort debugging and testing. Be sure to build in some sort of redundancy I mention FlexLM and Elan because I know a fair bit about them. This isn't an endorsement, etc. -- Mark Henderson -- markh(a)wimsey.bc.ca, henderso(a)netcom.com, mch(a)squirrel.com PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer - ftp://ftp.wimsey.com/pub/crypto/README.html ftp://ftp.wimsey.com/pub/crypto/sun-stuff/change-sun-hostid-1.6.3.tar.gz

1 0

Re: NET_run
by Bruce Baugh 17 Dec '03

17 Dec '03

> 2-19-96. NYT: > > "In this new game, you'll never play with a full deck." > > Sometime next month a game will be played on the > Internet, challenging surfers to leap between sites, > solving puzzles and cracking codes that will give them > access to secret data hidden behind firewalls and > software barriers. Okay, I just checked with Wizards of the Coast, and here's the story. Netrunner is indeed a card game. As part of the intro publicity, some demo games will be run on the Web. (No, no info about that at the moment.) The rest is the intersection of overenthusiastic publicity folks and clueless reporters. "Go, marketing department, go" were the exact words of my friend. However, he also says that the game is an exceedingly cool one, and that those of you who like the collectable card games should check it out. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: Some thoughts on the Chinese Net
by Bruce Baugh 17 Dec '03

17 Dec '03

At 02:44 PM 2/19/96 -0600, Alex Strasheim <cp(a)proust.suba.com> wrote: >steady force towards liberalization. Once Chineese society has coexisted >with a vibrant black information market for a decade or two, making >things legal will probably seem sensible to most people -- no one will >expect the sky to fall if people are allowed to speak their minds. I'd like to agree, but I'm afraid I can't. Notice that many years of widespread use of currently illegal drugs in the US has not translated into widespread willingness to say that the drugs should be legal. Nor has the experience of decades of black markets turned into widespread Russian willingness to allow a lot more freedom: what they call "profiteering" and punish heavily is mostly what we call "wholesaling" and regard as an essential part of mundane distribution. Cognitive dissonance is really, really easy to come by, and hard to remove. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

Re: NET_run [NOISE]
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:54 PM 2/19/96 -0800, bruce@aracnet wrote: >> Sometime next month a game will be played on the >> Internet, challenging surfers to leap between sites, >> solving puzzles and cracking codes that will give them >> access to secret data hidden behind firewalls and >> software barriers. > >Netrunner is indeed a card game. As part of the intro publicity, some demo >games will be run on the Web. (No, no info about that at the moment.) The >rest is the intersection of overenthusiastic publicity folks and clueless >reporters. "Go, marketing department, go" were the exact words of my friend. Which is based on the even more cool Cyberpunk (no, not Cypherpunk, but it seems that way in my own games) traditional role-playing game. Actually, that's not a small percentage of why I keep up with all the noise on this list - you get some _great_ game ideas. <<perrygram elided>> dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMSkafjVTwUKWHSsJAQEI7gf9HwKWFS489/ljLT9OtQxpfLP5dqOtCkFg 7IW65RvYfuwS/G6bkpc9pOUGGabnsI/rak7AtzJwXlqtI6DJnTl7MSNoA+vdddQX t7eLv4d9phTSBg3s5N1upOZuLO8239pWmx+y0Rknzo1qkZ9P0pQPOFqHdhsem5TA X/AtP1nLyno8dKlOLcdcqk3p5CLQt6v3X/sZN10Y1N6JYXcxmY3VbFWMBjmWjAZi Qv9awTjBvLem+NHF/alEkRR2AIeswLwl7jB/P9zZ/R4x1NfcGYKGWRnT+6cFITrM UYH+WxqYZGcrY3ECVJ8IrylFJ/MJsBDyUpw+ZXIbh9BjQmD8GfiukQ== =TPrG -----END PGP SIGNATURE----- ----- David E. Smith, c/o Southeast Missouri State University 1000 Towers Circle South MS 1210 Cape Girardeau MO 63701 dsmith(a)midwest.net, dsmith(a)alpha.c2.org, PGP 0x961D2B09 (573)339-3814 http://www.midwest.net/scribers/dsmith/ "Reality is only for those lacking in true imagination."

1 0

NET_run
by John Young 17 Dec '03

17 Dec '03

2-19-96. NYT: "In this new game, you'll never play with a full deck." Sometime next month a game will be played on the Internet, challenging surfers to leap between sites, solving puzzles and cracking codes that will give them access to secret data hidden behind firewalls and software barriers. The new game is Netrunner, set in the "dark techno-future" in which "ruthless corporations scheme to accomplish secret agendas as they build elaborate fortresses of data." In opposition to such plots, "anarchistic netrunners hack the system, infiltrating data forts to liberate information." It was created by Richard Garfield, who applied his doctoral training in combinatorial mathematics -- a field that studies the interaction of objects in complex systems. " 'Magic' Casts a Spell on Players." Magic was invented by Richard Garfield, who revels in his shoelessness. "I like to wear socks or slippers indoors," he said, padding around the Puck Building in thick. off-white socks. Developing the game took Mr. Garfield, who has a doctorate in combinational mathematics, all of a week. NET_run

2 1

Fuck Islam and the Apologists Cluttering Up this List with Defenses of It
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:08 AM 2/20/96, Sean Gabb wrote: >I did say I wouldn't send this review. But having broken purdah once >already this evening, I see no harm in doing so again. > >Sean Gabb. ... All of you in the following list please take me off your list of responses: Sean Gabb <cea01sig(a)gold.ac.uk>, Alan Horowitz <alanh(a)infi.net>, Ashfaq Rasheed <ashfaq(a)corp.cirrus.com>, jpb(a)miamisci.org (Generally, I don't see why people keep letting the cc: and To: fields get cluttered up with additional names, unless someone is not reading the CP list, in which case who cares if they don't get it?) Please don't send me separate copies (in addition to what is sent to the IslamPunks mailing list) of this Muslim crap....it's bad enough seeing the pro-Muslim apologists explaining why the Word of Allah (hollow be his name) is more liberating than any decadent, Western system can be, about how women are more free under Islam because they have the freedom to be obedient to the will of her husband and Allah (hollow be his name), the freedom to be beaten with sticks if they show their face in public, and the freedom to have their devil organs removed. And don't send me any more apologies about how it is only "Arab Islam" that is barbaric and authoritarian...the Persians don't exactly like to be called Arabic, and yet the Persian/Iranian branch (Shiite) is amongst the most backward of all the Muslim sects. (Women dismissed from their professional jobs when Khomeini took over, forced to wear the chador, death warrant on Rushdie, and so on.) --Tim May [This Bible excerpt awaiting review under the Communications Decency Act] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said. "Dad's getting old. I say we should fuck him." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

1 0

Re: Remailers not heard from; info?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:31 PM 2/19/96 -0800, bruce@aracnet wrote: >A fix along the lines of > >:: >don't-send-anything-after-this > >might be readily applicable. Don't some remailers support the "Cutmarks" header, which does essentially that? A useful reference for this is Raph's remailers list; among the numbers and cryptic little charts is a listing of which remailers support which features. dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMSkaFDVTwUKWHSsJAQGCjAf+K5TW4yRol6a0L2xclbrU84MMA3FtmpCE xyx016KEOxEfVGBflsg3phRYSfY13Ezjxkrmkv449wsOAlRamwFpgCTcpDNU+dKk YXrJGnQ2PMNYPXZNNK/CObHEFA2xl3peITMF27NrLcGkC2On4r+geajyV8QZo+RF bNmPJ6fc5FTyl1BNAe0L/spucxx1wDG+IgKZP9IX+I3niJJBdxj73N4AAz3loesq +qwB9NRceFtNYdoigYUxC9nhB0s90C1fJtkc0/M8Jv0Qd0S4FosU+e1HSCkNLgXU ALuoXkhhRFmBAIW9Qf6aLKK4ANgt9DfmKIoHaBYy1B1GBKhxLHEWqw== =Fzjc -----END PGP SIGNATURE----- ----- David E. Smith, c/o Southeast Missouri State University 1000 Towers Circle South MS 1210 Cape Girardeau MO 63701 dsmith(a)midwest.net, dsmith(a)alpha.c2.org, PGP 0x961D2B09 (573)339-3814 http://www.midwest.net/scribers/dsmith/ "Reality is only for those lacking in true imagination."

1 0

Re: Remailers not heard from; info?
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think it would be better to use some commands indicating the start and end of the messages... ::begin-body [message goes here] ::end-body - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSke8ioZzwIn1bdtAQEQBgGAq91bmP74lyy4PIiTrZmYkg3zDBbt3Ke/ fLcVQNmXFZuYR5s5FkfX9DKLmY3Vkg1v =jI5z -----END PGP SIGNATURE-----

1 0