December 2003 - cypherpunks-legacy

ALERT - DOJ TO APPEAL CDA says Interactive Week
by rodger＠interramp.com 17 Dec '03

17 Dec '03

From a draft to be posted shortly at http://www.zdnet.com/intweek By Will Rodger Wahington Bureau Chief Inte@active Week The Department of Justice will appeal to the Supreme Court a federal court decision that stayed enforcement of a controversial Internet indecency law, sources close to the court challenge told Inter@ctive Week Thursday. Department of Justice lawyers gave Sen. J. James Exon, D-Nebr. news of the appeal in a three-line letter delivered to the law's chief sponsor Wednesday. A copy of the letter was obtained by Inter@ctive Week. Exon welcomed the news. "We needed the Justice Department to make a final decision on the appeal, which I am pleased that they have done with the full support of the White House," Exon said. "This will now go to the Supreme court and I believe we will get a more thoughtful decision out of the top court than what the court in Philadelphia ruled." Attorneys on the other side seemed equally pleased. "This is wonderful news because it means the Supreme Court will have a chance to speak on these issues," said Mike Godwin, staff counsel of the Electronic Frontier Foundation. "We feel certain the Supreme Court will uphold the lower court's finding that the statute is unconstitutional." The Communications Decency Act, passed as part of telecommunications reform legislation last February, would have banned indecent images and speech from any areas open to minors on the Internet. Under the law, operators of Internet sites would have been required to segregate indecent content into adults-only areas that required a credit card or other form of positive identification for access. Drafters based their restrictions in large part on regulations governing broadcast media which still prohibit indecency over the airwaves, as well as some local ordinances which require segregation of indecent materials from others. But a coalition of civil liberties groups, for-profit and non-profit organizations challenged the Act in a consolidated suit before a federal court in Philadelphia. The law, plaintiffs claimed, was unconstitutional since it set up restrictions on indecent but constitutionally protected speech. The CDA, moreover, would place a "chilling effect" on free speech as Internet users unnecessarily limited their speech in order to comply with an impermissibly vague law, plaintiffs claimed. In place of the CDA, plaintiffs suggested evolving technologies in the hands of responsible parents would better protect children while preserving adults' First Amendment rights. The Philadelphia Court agreed with the plaintiffs on all counts, striking down the law June 12. In a unanimous decision, a three-judge panel found that the democratic nature of the Internet entitled it to at least as much protection as print, traditionally the least regulated of all media. The court also found that the statue was impermissibly vague and would thus unnecessarily restrict speech. The court also ruled the government had failed to show the law was enforceable with current technology. Cheers. Will

1 0

New mix/ghio.remailer.2 remailer up: jam
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As anticipated, I've put up a ghio.remailer.2. The email address is <remailer(a)cypherpunks.ca>. Here's the public key: Type bits/keyID Date User ID pub 1024/734C3A3D 1996/06/28 John Anonymous MacDonald Remailer <remailer(a)cypherpunks.ca> sig 734C3A3D John Anonymous MacDonald Remailer <remailer(a)cypherpunks.ca> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzHUH7sAAAEEAKi9dAsHtUYzWu8u/0O3HKfWMYYfuwlo9y5W1x+lvNdZ9RL0 T1znvGaaoGmVF76qzl3aAabuoiKTdeGyUtZ5kZ/Ka+DpMaRQUaTY7i4wf3vD8u1I y2mTGYv945BwBdhcpDeTVCK81J6krnY1iAi6o8GqtATQHeJskDz5wkNzTDo9AAUR tDtKb2huIEFub255bW91cyBNYWNEb25hbGQgUmVtYWlsZXIgPHJlbWFpbGVyQGN5 cGhlcnB1bmtzLmNhPokAlQMFEDHUH+c8+cJDc0w6PQEBIC0D/jMBXNlMBSokNveZ 7LvWpWKfOlHwNSNGT3p403o21bIG9txsPk9e/wDurG310hJglKBuovoenqwClxy/ m6lldAe+11VMpLimzUCE0W4LeJxW84N+Jg/SGmP7YF1N0OmAc0snfvJhhgI0kWHl DMu+pWAc6UXLEPln0wtb936TFxbA =WL1j - -----END PGP PUBLIC KEY BLOCK----- It also accepts Mixmaster messages: jam remailer(a)cypherpunks.ca c2178bf3018c062a8d0fabd066e50ed9 2.0.3 - -----Begin Mix Key----- c2178bf3018c062a8d0fabd066e50ed9 258 AATgExB26IdURw+itvFEQsWjv/mQFgg3Tu2avLU2 fdW55aqKqKDeiIWf8nY24HG+i08s65cp8zCm2w7E ZvzgcBxLQu91Sg1UbQlkYMYqx8NpeKjxnkU+5KqC mswqrAbOn0qqcmNz7/3TsGS0p22+Dsw9rLjwDk4o udzR2maCUTuDvwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Note that the above mix line should be used instead of the one (called "jammix") I posted yesterday. For Raph's remailers file: $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; - Ian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdQs3UZRiTErSPb1AQHC9gP+KT5KfwsHdK6S7Urg2iVxbLAqci5+gZhi E6UKqsolDv8BMCr5nJuMClEHfdJBGrGeyrazgcxESmOzAoj/TfHbIU6seg46/q9c pSpASazX39YE8Os5hMomgcEfFBVFE8+m9XUWGNnpCvyO8ZtlfVyQS+vG0aS2o0hE /59pTd0iTAM= =J5Hd -----END PGP SIGNATURE-----

1 0

Re: CIA Fears UmpTeen InfoNukes
by Rick Smith 17 Dec '03

17 Dec '03

frantz(a)netcom.com (Bill Frantz) writes about the miserable state of computer security, and I'll comment on some statements, hopefully taken not too far out of order and context: >I think that backward compatibility requirements are a significant part of >the reason we see this problem. The other part is, of course, that there >is no market for security. The phrase "backward compatibility" is, in my experience, a code phrase for peoples' annoying habit of wanting to stay with things they've finally made useful as opposed to having them replaced by something "better" that is more expensive, less convenient, and in general less familiar. The components of the latest release of MS Office come to mind as a good example, and they didn't even include public key crypto to atone for it. I agree that it's seductive for us security weenies to think the tail wags the dog, but let's remember what's really supposed to be happening. The requirement isn't "backwards compatibility," the requirement is that people get their work done. If the security threat keeps them from getting their work done, then backwards compatibility is no longer a major requirement. >The problem, in general, isn't the system administrators. If management >gave the same priority to security that it does to joining new users or >installing new hardware, sysadmins would have the time to install the >patches. Most sysadmins are up to their asses in alligators. Security is >something to put off. If the managers were judged on the security of their >systems (perhaps via independent audit), then they might give the problem >some priority. The problem (or at least the difference) is in the priorities established by an organization's culture. Some would rather take the risks and do things in a fairly open, if unpredictable, environment. Some prefer and even thrive on predictability. Either approach can and does produce valuable results. However, few people want to use a bank that takes the "open, if unpredicable" approach. Banks have auditors. >The ideal situation for them would be to use public key authentication >because it would be entirely user-transparent. ... Nonsense. The mere fact that it's not currently deployed guarantees that it won't be user transparent. Vendors will include it on some rewrite of whatever software it's embedded in. Memory requirements go up and delays are introduced when the crypto computations are performed. Security will be added only if it gives customers more things they can do, so there'll be other functional changes as well. In any case, working crypto *can't* be entirely user transparent. People need to handle keys, choose the one to use, and update them occasionally. There is a lot of training and cultural awareness involved here that just doesn't exist yet. And there will be *billions* in fraud before people finally learn, then maybe it'll attenuate to mere millions (and I'm probably still optimistic by orders of magnitude). Look at credit and ATM cards. A dozen years ago a bank issued us some ATM cards, and the clerk insisted on writing the PIN code ON the cards. Very few banks do that any more. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: [NOISE] Ga Law/No False Identity
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:43 PM 6/27/96 -0400, AwakenToMe(a)aol.com wrote: >falsely id a person?? Well it seems to me ya just wanna get the messages >OUTTA there and arent trying to 'act' as that person in the sense that you >are posing to NO person that you really are that person. I just wonder how the law is going to effect all those web servers posing as nobody (uid #-1). "When SUID is outlawed, only outlaws will become sysadmins." --- |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

DUO_pol
by jya＠pipeline.com 17 Dec '03

17 Dec '03

We offer cypherpunk Jim Ray's column in The Miami Herald of June 24 on suppression of political freedom in Florida by the Democrat-Republican duopoly. http://pwp.usa.pipeline.com/~jya/duopol.txt (5 kb) DUO_pol

1 0

Yet another mailing list
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

For those of you who are privacy-cypherpunks - there is another list (run by big-brother) out there on the issue. >From the list-of-lists: PRIVACY Subscription Address: PRIVACY-REQUEST(a)FTC.GOV Owner: John Audette <ja(a)mmgco.com> Last Update: 12/28/95 Description: A mailing list created bt the US Federal Trade Commission to allow interested parties to discuss the issues surrounding the privacy interests of consumers visiting web sites. It is part of the FTC's "Privacy Initiative" to investigate whether the information collected at websites (either that affirmatively submitted by a visitor via a form or information collected based upon a visitor's selection of pages at a site to reflect personal interests) should be the subject of regulation by the FTC. ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: MS-Mail Security
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-=> Quoting In:wywong2@cs.cuhk.hk to Harka <=- In> I would like to gather informations of whether the MS-Mail server In> is secure or not, is anyone heard of somebody, say, disguise as other In> user or read other user e-mail? I'd also like to know how secure the MS-Mail files are (*.mmf). They are password protected and should be encrypted but does anybody know how secure? Harka ___ Blue Wave/386 v2.30 [NR]

2 1

Re: CIA Fears UmpTeen InfoNukes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:51 AM 6/28/96 -0500, Rick Smith wrote: >frantz(a)netcom.com (Bill Frantz) writes: >>I think that backward compatibility requirements are a significant part of >>the reason we see this problem. The other part is, of course, that there >>is no market for security. > >... > >The requirement isn't "backwards compatibility," the requirement is >that people get their work done. If the security threat keeps them >from getting their work done, then backwards compatibility is no >longer a major requirement. Absolutely. However, from a vendor's point of view, customers have a wide range of security problems. Some run in an open environment and have no use for security. They may still be using those VT100s. These are the customers the vendor considers when thinking of backwards compatibility. >>The ideal situation for them would be to use public key authentication >>because it would be entirely user-transparent. ... > >Nonsense. The mere fact that it's not currently deployed guarantees >that it won't be user transparent. Vendors will include it on some >rewrite of whatever software it's embedded in. Memory requirements go >up and delays are introduced when the crypto computations are >performed. Security will be added only if it gives customers more >things they can do, so there'll be other functional changes as well. There are several "users" at issue. I fully agree that those administrators responsible for upgrading the software and hardware for the change will notice. The people who have to pay for it all should also notice. But the actual end user may find the logon simplified. If is sufficent to mearly identify the machine and not the person, then the new software can eliminate end user involvement in the logon. The administrator is responsible for installing the private key in the machine and the end user never sees it. On the other hand, if users still must be identified, it is possible to give them a logon interface which is unchanged from the old, non-one-time-password, interface, while still giving them the benefits. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: Alternic.net (was domain zapping)
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:42 PM 6/26/96 -0700, jfricker(a)vertexgroup.com (John F. Fricker) wrote: >Well, Karl's IETF draft is certainly serious. A Karl is a bit more than a >kid with a linux box having started one of the largest ISPs in Chicago and >being a component in the anti CIX fiasco. > >I still fail to see why decentralizing control of namespace is a bad idea. Decentralizing control is a good thing; after all, that's what the domain name hierarchy is _for_. One cost of decentralized control is the need for coordination between different parts of the namespace. Another cost is the need to move between namespaces if the namespace owners either fail or implement policies you dislike. Having one namespace owner per country plus a couple extra for non-nationalist namespaces is a convenient approach for accomplishing it, and worked well when the number of users was small enough that managing namespaces was a low-volume non-political effort. That's no longer true. And as long as the namespace management is coupled with nameserver administration, which it probably needs to be, the number of toplevel domains will need to remain small, and the namespace managers will be motivated to charge money for names as a way to pay for the nameservers and administration. Opening up the top-level namespace lets you out of NSI's control, if you can coordinate with them and the country-based namespace owners, but doesn't solve the basic problem. If you don't do it carefully, you'll end up needing a bunch of Above-Top-Level nameservers that serve the names of the tens of thousands of top-level domains. Karl's draft is an interesting approach; don't know if it'll work. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

crypto and bagpipes [NOISE]
by vinnie moscaritolo 17 Dec '03

17 Dec '03

>>>A Missive From: David Kovar (kovar(a)nda.com) >>> >>>What is the connection between crypto and bagpipes? Well >>>crypto is regarded as an armament by the US ITAR regulations. >>>Later this month a British court is to rule as to whether >>>bagpipes are still classified as "instruments of war"! >>>The story is in today's Times newspaper (The British one) >>>It seems that a piper is being taken to court for practising >>>on Hampstead Heath, which has a bye-law forbidding music. >>>Mr Brooks, the piper, has denied the charge, citing a case in 1746, >>>where bagpipes were declared to be instruments of war, not musical >>>instruments, and a subsequent Act of Parliament which specifically >>>stated that they were weapons. He claims he wasn't playing a musical >>>instrument, but practising with a weapon! >>> >>>The imagination boggles if his claim is successful! Will it >>>be possible to sue pipers for assault with a deadly weapon? >>>Will airports be equipped with bagpipe detectors? >>> >>>David Wadsworth | Wohin der Weg? Kein Weg! >>>dwadsw(a)etna.demon.co.uk | Ins Unbetretene. (Faust) Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

5 4