December 2003 - cypherpunks-legacy

code vs cypher
by hochiminh＠alpha.c2.org 17 Dec '03

17 Dec '03

Perry E. Metzger" <perry(a)piermont.com> writes: pm> tm> Timothy C. May writes: pm> tm> Well, I was not invited to join the elite and secret pm> tm> coderpunks list, pm> It is neither elite nor secret. It is fairly high signal to noise. pm> I think only about one in every fifty or so cypherpunks pm> messages has any content at all worth mentioning. Agreed! I wasn't "invited". I simply requested access and was quickly welcomed to the list. pm> tm> but I still have some thoughts on coding and, pm> tm> especially, on the opportunities offered by Java. pm> tm> Sorry if this interferes with discussions of Rabbi pm> tm> Heir and Morris Dees. pm> You have no right to grumble about the situation here. pm> It is exactly what you wanted. Here you were, a person pm> of some personal gravitas and moral authority, and you pm> put your stamp on the "post whatever you like; don't let pm> the grumbling censors stop you". Well, as you sow, so pm> shall you reap. Its your fault, more than anyone else's. TC May was not the first person to substantialy digress from chartered topics but he certainly "ran with the ball" when he got his chance to expose his ignorance and intolerance of other races and religions ( the cypher-relevance or "charter topicality of which always escaped me). I was discouraged by the encouragement given to the murder advocating moron, Jim Bell to post his insance littany. pm> If Cypherpunks has become a cesspit, well, its YOUR cesspit, pm> Tim. Its the list you always strove to create, but it appears pm> that you now don't like the smell of your own wallow. Well, pm> sorry. Deal with it. Well put, Perry!

2 1

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 12:25 AM 4/27/96 -0500, Snow wrote: >On Thu, 25 Apr 1996, jim bell wrote: >> >> This analysis seems to assume that the entire production run of a standard >> product is subverted. More likely,I think, an organization like the NSA >> might build a pin-compatible version of an existing, commonly-used product >> like a keyboard encoder chip that is designed to transmit (by RFI signals) >> the contents of what is typed at the keyboard. It's simple, it's hard to >> detect, and it gets what they want. > > I thought that most (all?) chips already radiated on the >electromagnetic spectrum? Isn't that what tempest is about? There's a difference between trying to find a needle in a haystack, and finding a day-glo, red-hot needle that plays music at 110 decibels in that same haystack. Digital logic chips do radiate EMI, but some radiate very little (because their are few logic transitions or they occur relatively infrequently) or are buried within other circuitry and they don't have a particularly good antenna. The Trojan horse chip I'm hypothesizing would be specifically designed to radiate a fairly loud, continuous signal, on wires that are long enough to make a good antenna. Ideally, the chip would have a crystal to produce a very constant frequency, so that other noise not on that frequency could be ignored. The best place to put such a chip would be a location outside the computer's case, or at least it would have access to the outside. I think that a keyboard controller would be optimum, because I suspect that there are a relatively small number of different designs. Jim Bell jimbell(a)pacifier.com

3 2

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:30 AM 4/27/96 -0700, Mark Allyn 206-860-9454 wrote: >They are gone now. > >mark.allyn.com% lynx http://www.WhosWhere.com Try http://www.whowhere.com/ . (Rich Graves mistyped the address.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

8 12

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:51 AM 4/27/96, Dan Busarow wrote: >At Usenix 96 in San Diego it was pointed out that applets are an abberation. >This is a complete language designed to displace C++, Visual Basic and >other OO languages. Thinking of Java as simpy a Web enhancement tool >is short sighted. > >Personally it is more attractive than C++ for product development and >we are trying to get it on FreeBSD, SCO UnixWare and SCO OSR5. Using >Java for applets _only_ is like fucking your mother... Most of us are >not into it. Ignoring the gross violation of the CDA, I agree. I think of it (and so do a lot of others) as: - a cleaned-up C++, with features of Smalltalk, Objective-C, and Lisp - a tool with built-in hooks for Net-centric computing - some safety features that distinguish it from C++ and the like - a bytecode/virtual machine approach that means the same code can be run on any platform for which a VM exists (the key to applets, but also the key to portability...what the world might have looked like for the past 15 years has the UCSD p-system succeeded instead of MS-DOS) Is it safe to run untrusted applets on your machine? Probably not. Running strange programs probably is never safe. I don't view this as something any new language is likely to solve, unless it's a language with such limited expressability as to be "safe and boring." As Perry has noted, financial institutions can ill afford to have applets being dropped into their main computers unless they are safe and secure. Not too surprising. But, then, they also have other security issues they constantly have to deal with that others don't. I suspect the safety issues will continue to crop up, but will be dealt with in other ways. The signed classes approach, the approaches used in E, etc. Netscape's limits on what applets can do, for example, may be extended in other ways (a kind of firewall approach?). To borrow a viewpoint, I don't expect the Java-based gargoyles in "True Names" to be "trustworthy"...TANSTAAFL. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

Burns Bill
by frantz＠netcom.com 17 Dec '03

17 Dec '03

A quick read thru the text of the bill (via http://www.cdt.org/crypto/) shows none of the principle objectionable features of the Lehey bill. (Standards for key escrow agents, and additional criminal penalties for using encryption to hinder an investigation.) This bill has some obscure, to me, exceptions. The most troubling of which I think means (IANAL) that export can be restricted if there is a reasonable expectation that the hard/software will be reexported to one of the countries on the extreme bad boys list. This provision could possibly be construed to affect FTP sites, but in any case, it is not clear how passage of the bill could possibly make things worse. Its provisions preventing the Secretary of Commerce from developing standards for anyone except government agencies, and forbidding mandatory GAK/key escrow are very welcome. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: Why I dislike Java. (was Re: "Scruffies" vs. "Neats")
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:37 5/2/96, Jeff Weinstein wrote: >Perry E. Metzger wrote: >> Netscape with Java cannot be so tested because important components >> come down off the net. So no, I'm not holding Netscape with Java to a >> higher standard. I'm very much holding it to the same standard. > > The Netscape Administration Kit will allow a site security admin >to create a configuration that disables Java, and does not allow the >user to enable it. If your customers require netscape, perhaps this >is an option that will make you more comfortable. Does it prevent the user from downloading an unrestricted copy from Netscape's ftp site or installing one brought from home? Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Conrad_Burns@burns.senate.gov: Open Letter to Internet Community From Senator Burns
by Perry E. Metzger 17 Dec '03

17 Dec '03

Yes, I know this will probably be forwarded five hundred times. However, I thought I ought to try to be the first. ------- Forwarded Message Date: Thu, 2 May 1996 19:39:04 -0400 From: Conrad_Burns(a)burns.senate.gov To: Multiple recipients of list <com-priv(a)lists.psi.com> Subject: Open Letter to Internet Community From Senator Burns OPEN LETTER TO THE INTERNET COMMUNITY May 2, 1996 Dear friends: As an Internet user, you are no doubt aware of some of the hurdles the federal government has put up that limit the growth and full potential of exciting, emerging technologies. One of the most egregious of these has been the governmentally set limits on so-called "encryption" technologies. Today I am introducing a bill to address this major problem for businesses and users of the Internet. If the telecommunications law enacted this year is a vehicle to achieve real changes in the ways we interact with each other electronically, my bill is the engine that will allow this vehicle to move forward. The bill would promote the growth of electronic commerce, encourage the widespread availability to strong privacy and security technologies for the Internet, and repeal the out-dated regulations prohibiting the export of encryption technologies. This legislation is desperately needed because the Clinton administration continues to insist on restricting encryption exports, without regard to the harm this policy has on American businesses' ability to compete in the global marketplace or the ability of American citizens to protect their privacy online. Until we get the federal government out of the way and encourage the development of strong cryptography for the global market, electronic commerce and the potential of the Internet will not be realized. The last thing the Net needs are repressive and outdated regulations prohibiting the exports of strong privacy and security tools and making sure that the government has copies of the keys to our private communications. Yet this is exactly the situation we have today. My new bill, the Promotion of Commerce On-Line in the Digital Era (Pro-CODE) Act of 1996, would: - Allow for the unrestricted export of "mass-market" or "public-domain" encryption programs, including such products as Pretty Good Privacy and popular World Wide Web browsers. - Require the Secretary of Commerce to allow the unrestricted export of other encryption technologies if products of similar strength are generally available outside the United States. - Prohibit the federal government from imposing mandatory key-escrow encryption policies on the domestic market and limit the authority of the Secretary of Commerce to set standards for encryption products. Removing export controls will dramatically increase the domestic availability of strong, easy-to-use privacy and security products and encourage the use of the Internet as a forum of secure electronic commerce. It will also undermine the Clinton Administration's "Clipper" proposals which have used export restrictions as leverage to impose policies that guarantee government access to our encryption keys. The Pro-CODE bill is similar to a bill I co-authored with Senator Patrick Leahy of Vermont, except that it highlights the importance of encryption to electronic commerce and the need to dramatically change current policy to encourage its growth. My bill does not add any new criminal provisions and does not establish legal requirements for key-escrow agents. Over the coming months, I plan to hold hearings on this bill and encourage a public debate on the need to change the Clinton Administration's restrictive export control policies. I will need your support as we move forward towards building a global Internet that is good for electronic commerce and privacy. I look forward to working with the Internet community, online activists, and the computer and communications industry as this proposal moves through Congress. I'd like to hear from you, so please join me on two upcoming online events to talk about the new bill. The first is on America Online in the News Room auditorium at 9 p.m. Eastern Daylight Time on May 6. The second will be on Hotwired's Chat at 9 p.m. EDT on May 13. In the meantime, I need your help in supporting the effort to repeal cryptography export controls. You can find out more by visiting my web page http://www.senate.gov/~burns/. There you will find a collection of encryption education resources that my Webmaster has assembled. I trust that the entire Internet community, from the old-timers to those just starting to learn about encryption, will find this information useful. This bill is vital to all Americans, from everyday computer users and businesses to manufacturers of computer software and hardware. I very much look forward to working with you on this issue. Conrad Burns United States Senator ------- End of Forwarded Message

1 0

Re: Why I dislike Java. (was Re: "Scruffies" vs. "Neats")
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"perry(a)piermont.com" 3-MAY-1996 16:49:35.61 >The users can't afford not to have the numbers they are watching not >in front of them, even for brief periods. Its a real problem. Hmm.... has anyone ever created a specialized computer (or computer running a specialized program) that would put multiple screens on the same screen, perhaps with some GUI manipulation capabilities? If they're trying to read Netscape material while watching the other numbers, they're then in the exact same situation from their viewpoint. >And yes, this isn't a joke. They all eat lunch on the trading floor so >they don't have to leave their desks. They race back and forth to the >bathroom. The environment is tough. I should have remembered this from reading Liar's Poker; thank you. (One wonders if any of them will start using catheters...) -Allen

2 1

Re: EET on PGP API Quash
by minow＠apple.com 17 Dec '03

17 Dec '03

> ... the State Department is taking > an increasingly hard line on PGP. Where once the State had > restricted itself to warning developers against exporting > source code with PGP file-encryption routines, it is now > arguing that application programming interfaces (API) > allowing PGP program insertion should be subject to control > under arms-trading statutes. It would seem that any computer system that permits the use of an externally-supplied computer program (i.e., Windows, DOS, MacOS, Unix, Java, Microsoft Word macro languange) would fall under this restriction. I wonder how much thought went into this decision. Martin Minow

1 0

Finally Found You :^)
by 56098393＠rocketmail.com 17 Dec '03

17 Dec '03

This site is the best that I have seen. They Have Everything ;^) Meet me in the chat area between 8pm and 1am. I will be either in the Male or Female area, I like them both. http://www.adultfunshop.com I am there every night :^) I Miss You Jenny ;^0~ P.S. Sorry I didn't write you earlier But my computer crashed and I lost your email address. Found you on one of those People search engines.

1 0