December 2003 - cypherpunks-legacy

Re: Mixmaster to DOS Yet?
by loki＠obscura.com 17 Dec '03

17 Dec '03

Yes, it works. I am trying to get my cross compiler to compile the code before I certify that it is good, and attach my signature. I am recompiling gcc as I write, hopefully that will solve the problem. -Lance At 8:12 PM 4/20/96, John Erland wrote: >[Please respond netmail - I do not see this list regularly...thanks!] > >Time to ask again: Has anyone ported Mixmaster to DOS yet? > >Thanks for any info. > > JE >-- >: Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. >: Internet: kdf(a)gigo.com ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: NYT on MS Java, Net Radio
by Hal 17 Dec '03

17 Dec '03

From: John Young <jya(a)pipeline.com> > "Edge for Sun as Microsoft Embraces Java." > > By John Markoff > > http://www.nytimes.com/library/cyber/week/0425license.html >From the article: > SAN FRANCISCO -- Sun Microsystems Inc., already a stock-market favorite > on the strength of its Internet products, has secured a significant > endorsement from Microsoft Corp., which plans to announce next week > that it will incorporate Sun's Java software programming language into > the Microsoft Windows 95 personal computer operating system. > The companies would not comment, but industry executives said > Microsoft, whose Windows operating system is used on some 80 percent of > the world's PCs, will join IBM and Novell, among other companies, in > announcing plans to embed Java into their software operating systems. > Those moves, and the possibility of a similar endorsement by Apple > Computer Inc., should go a long way toward making Java an industry > software standard in the rapidly expanding Internet market. In other Java news, the report from the Princeton scientists who have found many security weaknesses in Java is now available at <URL: http://www.cs.princeton.edu/sip/pub/secure96.html >. It is very critical of the language design and implementation. I don't fully agree with the thrust of their criticisms, because I don't think provability is a practical matter with programs complex enough to be useful. But they have certainly identified an alarming number of problems. I will post later today a list of the issues they have identified. Hal

1 0

The Iron Mountain Report
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Some years ago the federal government set up a special [inaudible] group. For two-and-a-half years they met in secret at Iron Mountain, New York. Their findings were called "Report from Iron Mountain on the Possibility and Desirability of Peace." Their document, by some of the leading thinkers, was suppressed. Later, it was printed in a limited edition, with the *names* removed. Some were shocked by what they read. Throughout history, permanent peace was dangerous to established governments. War, and the threat of war, are the principal organizing force for most societies. They divert attention from *other* economic and political problems. War keeps the factories going, wasting government manpower and material that would otherwise be of surplus. Peace brings unemployment, the collapse of prices of goods and property, and knocks down the government. In simple terms, war prevents [economic] depression. (By the way, sooner or later, whatever nation loses a war is overthrown. So it has been all the centuries. The American ruling circles lost the Vietnam War. The aftermath is bound to scatter the rulers to the winds.) As the report says, in Europe, over the years, the typical standing army consisted of troops unfit for employment in commerce, industry or agriculture, led by officers unfit to practice any legitimate profession or to conduct a business enterprise. A large standing army is a form of social welfare program; a form of control of the population. War, and the threat of war, keep all levels of society busy. The newspapers are kept rich reporting it. Pundits are employed to mouth off. Wars speed up so-called scientific development. War goods do not have to show a profit or be the lowest price. In permanent peace there are vast cutbacks in research and development. And yes, wars kill off surplus population; young men with no good job waiting for them. The [Iron Mountain] report points out that the war system makes stable government of society possible. The end of war means the end of national sovereignty. Without an identified enemy, why would the CIA have a large secret budget to assassinate political leaders and overthrow other governments the White House does not like? To promote their secret agenda, the CIA has taken over a part of the savings and loan system to funnel men and money for "dirty tricks" here and overseas. The CIA likewise manipulates the federal bankruptcy courts to grab up companies for use as covert action fronts. In Chicago, this is done with the help of foreign intelligence agencies, such as Mossad. Chicago bankruptcy trustee William A. Brand (sp?) jr. is a top honcho of the CIA and other spy shops. In the name of national security, the mass media have been *ordered* to "soft pedal" or "stay shut" about spy agencies doing such things. The CIA involvement in bankruptcy court should have made headlines as the number one item on the evening TV news. Yet not one word is said by the liars and whores of the press. Play it again: Fermilab and weather modification. (312) 731-1505. New message Monday; we change it several times a week. Donations appreciated. Citizens' Committee to Clean Up the Courts, 9800 S. Oglesby (sp?), Chicago, 60617. For the latest on courts, banks, espionage agencies, political assassinations and the news media. On 24 hours.

4 3

[PASSWD] good MCI password..."1234"?
by Dave Del Torto 17 Dec '03

17 Dec '03

[from RISKS 18.06] ................................. cut here ................................. Date: 19 Apr 1996 21:07:06 GMT From: chadm(a)unhinged.engr.sgi.com (Chad Ray McDaniel) Subject: MCI recommending bad security practices Taking advantage of yet another incentive offer, I recently switched my long distance carrier to MCI. They sent me the standard yet-another-piece-of-plastic-to-stick-in-my-wallet calling cards. The way these cards work is that you call an 1-800 number and type in your code consisting of your phone number followed by your PIN (Personal Identification Number) which happens to be printed on the card. Enclosed with the cards was a piece of paper in which MCI wisely suggests that you change your PIN to something other than what they assigned to you and printed on the card: Customizing your PIN Choosing your own four-digit number is the best way to assure you'll never forget your PIN. Make it the month and year of a loved one's birthday or use the same password you have for your voice mail or computer. We'll quickly replace the PIN we assigned you with any four digits you choose - just call 1-800-476-7306 For some strange reason MCI is recommending you to do exactly the opposite of what good security practices would proscribe! Not only do they suggest that you use an easily-breakable password such as an important date, but they recommend a practice that would weaken the security of potentially more sensitive information in a voice-mail or computer system. Of course, what probably prompted note from MCI was a desire to prevent MCI's customer service department from being inundated with calls from people who forgot their PINs. This alludes to the associated risk of requiring people to remember Yet Another Password (YAP). -chad

1 0

NYT on MS Java, Net Radio
by John Young 17 Dec '03

17 Dec '03

April 25, 1996 "Edge for Sun as Microsoft Embraces Java." By John Markoff http://www.nytimes.com/library/cyber/week/0425license.html ---------- "FCC Backs Cheap Link to Internet by Radio." By Edmund L. Andrews http://www.nytimes.com/library/cyber/week/0425radio.html

1 0

International Capital Flows Called Criminal
by Duncan Frissell 17 Dec '03

17 Dec '03

Financial Times, April 24, 1996, p. 8. US prosecutor attacks bank secrecy laws By Clay Harris Mr John Moscow, assistant district attorney for Manhattan: "Bank secrecy statutes in international finance are used by crooks, tax evaders, securities fraudsters, and capital flight fellows; they are used by narcotics dealers. But they are not needed by honest folks engaged in honest transactions." Now the last time I looked, 'Capital Flight' was as legal as church on a Sunday. Or is this a proposal for exchange controls. Is this guy a state or federal prosecutor? He was also unable to come up with legitimate reasons for $3 Billion to go from Egypt to the Bahamas. I can think of any one of a number of legal reasons, one being "International Tax Planning." DCF

1 0

Re: arbiter/escrow agent for hire
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 0:23 4/25/96, Rich Graves wrote [paraphrased] >So are there any arbiters out there who would deal in non-digital cash? Or >someone who would convert US$ to Ecash for a smalle fee? I will be happy to do USD to Ecash conversions for a nominal fee. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Anonymous banking
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

4/24/96, E. ALLEN SMITH wrote: >>But Washington last year ranked Austria alongside Colombia, Venezuela and >>Thailand in a league table of nations that tolerate money laundering. Ha ha! The U.S. and Panama probably exceed all of the above in laundering, but of course the USA/CIA doesn't notice those, since they're "in the family". -rkm

1 0

trusting the processor chip
by us028272＠interramp.com 17 Dec '03

17 Dec '03

On Fri, 29 Mar 1996, JEFF C FLYNN wrote: > Does anyone know of articles regarding the possibility of subverting > processor chips? Is this a realistic threat? Is it possible to hack vhdl > compilers to embed intentional security flaws in silicon? Known cases? > Attempts? > TIA, > Jeff I received several responses to this question. My favorite was as follows... >This is probably science fiction, particularly at the VHDL level. >Maybe someone could make a crime of opportunity out of a microcode >flaw, but there's a risk of it being found out during testing. > >To do it right would require collusion of the design and test teams. >They need to ensure the back door stays closed, isn't tickled by >"normal" testing and only opens when really requested. So a lot of >people are in on the secret even before it gets exploited for >nefarious purposes. > >And what nefarious purposes would pay for the risks and costs of this? >If the secret got out, the design team, product line, and company >would be dead in the marketplace and probably spend the rest of their >lives responding to lawsuits. What could you use this for that is >worth the risk? > >Trying to do it to the compiler (like Thompson inserting a back door >in login using the Unix C compiler) is, again, theoretically possible. >But the only reason to hack the compiler would be to do the deed >without involving the processor development team. Risky in terms of >building a reliable back door and the risk of detection. It might not >work and the changes might be detected. To do it right would probably >involve as many technical people as the processor development itself. >Even "high grade threats" have finite resources -- there aren't that >many processor design gurus in the world to start with. > >At best, this might make a good plot element for Tom Clancy.> > >Rick. >smith(a)sctc.com secure computing corporation Still, I'm left feeling a little uneasy. My reasons for this are 1) Trusting the processor means trusting something I don't fully understand. 2) Processors these days are extremely complex. 3) On April 3rd, at Interop, Peter Neumann (in his keynote presentation) disclosed that a random number generator chip used in slot machines had been compromised. This lead to a huge bogus jackpot, and an investigation that revealed the scheme. It looks like I may have no other option than to give some processor some degree of trust. Which processor I should choose, and why that one? TIA, Jeff _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Specializing in the Design and Implementation of SECURE NETWORKS JEFF FLYNN & ASSOCIATES NETWORK SECURITY CONSULTING 19 PERRYVILLE IRVINE, CALIF. 92720 JEFF FLYNN TELEPHONE (714)551-6398 PRINCIPAL _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

1 0

coderpunks not elite
by Hal 17 Dec '03

17 Dec '03

From: tcmay(a)got.net (Timothy C. May) > Well, I was not invited to join the elite and secret coderpunks list, but I > still have some thoughts on coding and, especially, on the opportunities > offered by Java. As far as I know, the coderpunks list is neither secret nor elite. I joined it about a month ago, andd there wasn't any problem. Just send mail to majordomo(a)toad.com saying "subscribe coderpunks". It's just as easy as cypherpunks. According to majordomo, coderpunks has 355 subscribers, compared to 1284 for cypherpunks. These numbers are hardly representative of an elite list. The biggest difference between the lists is volume. Some days coderpunks gets a dozen or more messages, but for the last two or three days for example there haven't been any at all. The other difference of course is that coderpunks is for technical discussions. Where philosophy comes up it is more in terms of issues of security and reliability than politics. I do share Tim's concern about the political views of coderpunks subscribers. Despite the "punks" in the name it seems to be somewhat more of a mainstream group. Nevertheless I am determined to act as though the group favors unlimited access to privacy tools by individuals and to post under that assumption. If it comes to the point that someone complains there may have to be some air clearing but I don't think it's likely to come up. If the archives at hks.net ever come back people could take a look and see if they would be interested in subscribing. Mostly the discussions are pretty dry. A lot of them are on specific issues that are of interest probably to only a few people. It remains to be seen really whether the list can sustain itself. This has been the problem in the past with offspring lists. Cypherpunks continues to have a lot of vitality. What I object to most is the back and forth arguments people get into. I don't mind reading one message off-topic, but to have the thread drag on for days, with dozens of messages, is wasteful. People should just make their points and let them stand. They shouldn't feel they have to keep coming back and refuting the other guy. Hal

1 0