December 2003 - cypherpunks-legacy

Noise: Re: Those Evil Republicans
by Hallam-Baker 17 Dec '03

17 Dec '03

Duncan Frissell wrote: > "They believe that the Government is the problem and that what everyone > needs is to be told, 'You're on your own; go out there into the tender > mercies of the global economy; have a great time in cyberspace, and we'll > get out of your way.'" -- William Jefferson Blythe Clinton in a speech to > the AFSCME in Chicago on Friday. > I guess he doesn't want us to have fun in cyberspace -- though he didn't say > so directly. If you had heard the whole speech rather than only the portion reported on CNN you would know that you have entirely distored the meaning. The point being made was that cyberspace is being promoted as a panacea for all ills, many of which it is creating rather than curing. Cyberspace is not a replacement for an ecconomic policy, Newts idea of giving laptops to homeless people is not a solution for poverty. Actually I think that this is quite obvious from the quote you give. Given the experience of derregulating Savings and Loans institutions I don't think the country could survive another round of deregulation. As Reagan said "Gentlemen we've hit the jackpot" - and of course they had, S&L was not a fiasco for certain people, just for the poor taxpayers. > In the same speech in which he talked about people hunting ducks with rifles. Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile? Phill

2 1

AT&T bans anonymous messages
by WorldNet User 17 Dec '03

17 Dec '03

AT&T WorldNet service has banned the sending of anonymous email or posting anonymously. >From the "AT&T WorldNet Service Operating Policies": (i) Members may not post or transmit any message anonymously or under a false name. Members may not permit any other person (other than an agent acting on Member's behalf and subject to Member's supervision) to access the Service Member's account for any purpose. The no anon rule even beat the no indecency rule, which is second: (ii) Members may not post or transmit any message which is libelous, defamatory or which discloses private or personal matters concerning any person. Members may not post or transmit any message, data, image or program which is indecent, obscene or pornographic. http://www.worldnet.att.net/care/terms/#oppol

5 5

domain name zapping threat by Internic
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

surprising not to see any discussion on this here.. this is a very intersting development. all kinds of news reports are talking about the internic zapping 25,000 DNS addresses. I wonder how this will turn out. I saw in an article a claim, I think, that the internic now charges $100 "rent" per year for a domain. this is really amazing to me, because this has totally changed from a one-time only fee, if correct. is that correct? I wonder if people are going to try to find a way to "route around" this action by the internic... one wonders if this is just the first in a series of actions by the new spook owners. (SAIC) essentially, if someone wanted to implement a tax or a way to control the internet, the NIC would be an excellent place to start. I wonder if the NIC has legal authority to yank DNS address like they are doing. it seems one could take them to court and have a pretty good argument that people who run DNS servers are free to run them however they want, and that ultimately this is what determines how routing on the internet is supported, not some overseeing agency like the NIC. it seems to me that now would be a brilliant time for someone to introduce a "non NIC registration service" that sets up an alternate DNS that guarantees that members will never be charged money. of course that's what the DNS "sort of" started out as... sigh. Subject: Internic removing Domain names The news media is anouncing that the Internic will delete 25,000 domain names that have not paid their registration fees Monday. How will this work? If someone is using one of these Domains and has DNS entries to find them what can the Internic do to disable the Domain? Won't the existing DNS services keep them working? Glenn York

8 8

Re: info assembly line, "flits" (long)
by Josh Sled 17 Dec '03

17 Dec '03

On Sun, 23 Jun 96 17:27:25 -0700, Vladimir Z. Nuri wrote: >>think about the the number of atoms that are necessary >>to hold the information for a single page, let alone an entire book... > >yep. not saying what I am talking about is feasible this moment. >"moore's law" But I don't think that it's feasible at ANY point in the near future... in fact, I think a better question is WHY? What would we use this newfound ability for? >>in a virtual reality "cyberspace", this would be an insurmountable data >>storage... on the small-scale. > >not insurmountable. quite practical and sensible in say 10 years. Ok... maybe practical to store the data... but I don't think sensible. Think: if we had this ability with atoms, what would we use it for? Maybe tracking crimes... or political prisoners (where have the atoms in this anonymous leaflet spelling out steps for rebellion come from?) or just curiousity... sure, there are justifable uses, but does the "savings outweigh the cost", so to speak? >to move a pencil I only pick it up and set it down. to move a >document through cyberspace, >the process is infinitely more complex, requiring an >immensity of thoughts and coordinated actions. when we create >a system that matches the real-world difficulty, then we will >be approaching the limit. we are very, very far from that limit >even though we have climbed the ladder a long ways as you note. I think we're too far from the limit to even begin to guess about how information would be stored in such a medium. But that's just my thought. For the sake of argument: why would we want to have this level of complexity in a simulated world. There is so much that can be assumed that is repetative and wasteful in the real world, why would we want a computer-generated system that must keep track of all this waste? >>I think the thing that's most important in this sentence is _"move"_ ... >>this is the main problem for computers... it's SO easy to DUPLICATE >>information... but near impossible to make sure that you've MOVED it... > >indeed, the concept of "moving" information implies TIME-- at one >time, it is at one place, at another time, it is in a new place. >but it is the SAME INFO. today, the disconnected idea of a "bit" >does not give you this *continuity*. I make a copy somewhere else >that is not tied to the original document. That's why it's so easy to make a copy... that's why we can have backups and the cypherpunks list and almost everything on the Net. If we had to keep track of flits and update them constantly, things would slow down a lot... but you're compensating for that by having arbritarbily advanced computer technology. >imagine the same thing on a totally universal cyberspatial level, >not merely within a single company or university. I agree, we have >rudiments of what I'm talking about in place. but my point is >mainly that they are rudiments compared to what is possible. the >web is a very good sample framework for the kind of seamlessness >I'm talking about. like I say, the future information assembly >line will be built on top of it. it has a long ways to go too. Ok... in a far advanced level of technology, this and more would be possible... but, the question is: do we need it? >in a sense, I think the flit concept is a magic bridge between bits >and atoms. bits are too abstract. atoms are too real. flits are >a nice compromise. we have to get our bits to behave more like >atoms: persistence, etc. there are a whole lot of very nice >"properties" of atoms that are staring us in the face that we >would benefit from immensely implementing in cyberspace. For some reason, distributed objects come to mind... though I'm not knowledgeable enough on the subject to know why... >>It means that you'd have an INSANELY large ammount of storage for a >>single small document. > >early stages would not be much different than RCS systems already in >use in companies. But I think that this is the best system available for today's or the future's needs... if we extended this concept to document fragments (ie, if you use a quote from a document, that section of your document has the same revision history, changed as necessary), then we have a system that could be in use for a long time. >you could have mechanisms that don't keep the entire history of the >flit. I agree, a flit as a 0 or 1 is very unlikely in the near future. >but at a document level, i.e. a document as a flit, we already have >it in RCS systems that companies are struggling to implement well >as we speak. Again, I think a document system is the best suited for information storage... the flit concept seems to be a great overkill. >I'm saying that in the information assembly line of the future, >they *must* have context. they must be tied together. you only >have disconnected chaos otherwise. Hmm... the only problem is that the "context" would be completely machine enforced... you can't actually MOVE or COPY the bits off a computer onto another computer... each side just would have to intrepret the bits as being moved or copied... and unless you propose storing flits in something other than bits, the disconnected chaos you refer to is nothing other than software understanding bit patterns... same as ASCII or a word processor file or an OpenDoc document. >again, this requires the human to interpret the changes. what if >there was an actual "link" between the old and the new document >that is "stuck" to the new document? and furthermore, software >could traverse these links? that's more what I have in mind. And if the old document moved? How would the new document continue to know where the old document is? >data doesn't have to be disconnected. I told you this was a radical >paradigm shift that I was proposing. you obviously have the previous >concepts down quite well. I'm not arguing that what you are saying >is the conventional system. I pointed out exactly that. *nod* You're right... I don't understand your shift in thinking... it doesn't make sense to me. I think that conventional systems are very well suited to information creation, retrieval and transport, and that virtual reality, though still in development, wouldn't benefit from the flit concept. >>But cyberspace is NOT real space... > >it will evolve to become more and more like a real space, a point >of my essay. I sure hope not... why do you think so many people escape to muds... real space is bad... virtual space has the potential to become so much more. >>VERY VERY VERY far... > >10 years or so, I would say, before people implement things that >sound like they came right out of what I was talking about. Perhaps... I hope not, because I don't think that it's a reasonable concept for working with data in an on-line or even mostly digital environment, but perhaps... >right. I think it is much more realistic to speculate that we will >be virtually unlimited than limited, and to ask the question, >what would we implement if we truly were unlimited? to build something >limited when you are unlimited shows an impoverished imagination. well... I'll continue to think about the present, and you can continue to dream about the future.... Take care, Josh PS I wonder: do you envision flits being able to be created out of thin (virtual) air?

2 1

unsuscribe
by Brian Andrew 17 Dec '03

17 Dec '03

unsuscribe

2 1

SAFE Forum--some comments
by tcmay＠got.net 17 Dec '03

17 Dec '03

I was at the "SAFE" forum yesterday. Too many things to report on, so I'll just add comments here and there. And here I'll comment on Ken Bass's excellent comments (there were many excellent points). Bass is a D.C.-area lawyer with the prestigious Venable law firm (the venerable Venable firm?), and a former Reagan Administration official. He pointed out that the driving force for crypto policy is probably the _law enforcement_ camp, not the _intelligence agency_ camp. And that the NSA is regretting the ITAR stuff, as it has sparked an "arms race" to develop stronger crypto. Bass noted that people now equate permission to export with weakness, and that had the U.S. not restricted exports, users probably would've been "fat, dumb, and happy" to keep using breakable crypto. (Many interesting points to make. Bass is no supporter of Clipper and Escrow, and made many points about why the policy won't work. His later dialog with Michael Froomkin and Jerry Berman, about the constitutionality of crypto laws was a highpoint for me.) His comments fit in with the points made by Diffie that the 40 bit restriction is unlikely to satisfy either the user community or the surveillance community. 40 bits is too weak for a targetted attack, but too strong for "vacuum cleaner" intercepts such as NSA SIGINT uses. (Diffie also gave an excellent summary of cryptographic work factors, using 30 bits, 60 bits, 90 bits, and 120 bits as examples. For example, 30 bits needs about a billion operations to brute force, which any modern PC can do in several seconds. 60 bits is a billion times harder, which NSA machines can handle, and 90 bits is beyond current capabilities...) I said I wouldn't do a summary, but I'll make a few comments: -- Both Congresswimmin, Eshoo and Lofgren, seemed genuinely interested in the issues -- Senator Leahy, on t.v. from Vermont, emphasized _privacy_ and made the Cypherpunk/libertarian/ACLU point that he and his neighbors are not criminals and don't think the government has any right to demand that communications, computer files, diaries, and the like be "escrowed." -- Senator Conrad "I ain't no Democrat" Burns was there in person and was entertaining and strongly blasted key escrow and the ITAR restrictions. I found his comments refreshing. -- The whole affair was "preaching to the choir," as many speakers noted. That is, there was little controversy and little disagreement. This was a point made nicely by Phil Zimmermann, who told a humorous story of going to Congressman Dana Rohrabacher's office, seeing the picture of Ollie North on the wall (much laughter), but finding Rohrabacher's staffers aghast at the crypto laws and ITARs. Then, Phil took a hotel shuttle and ended up talking to the driver, who was also aghast. "Where else can you find this kind of consensus?" (A point many of us have made as well, that nearly everyone who has the issues explained to them comes down on the side that the government has no right to tell us we can't use codes and ciphers, that it's all similar to Big Brother demanding video cameras in our homes....) -- Craig Mundie, currently of Microsoft, made excellent points about the costs of a key escrow infrastructure. (By the way, those who read "The Soul of a New Machine" should be interested that Mundie was the leader of the North Carolina research facility of Data General that lost the "shootout at HoJos." If this means nothing to you, read the Kidder book--soon!) -- Michael Froomkin, a law professor (and member of our list of course), pointed out despite the various constitutional issues, the crypto laws are mostly having their desired effect, namely, slowing the deployment of crypto and creating confusion. (That Windows 95 has no crypto modules, and that most browsers and mail programs have nothing built in tells us that the FUD worked.) In summary, for me the SAFE forum was a success. Though it was periods of boring platitudes we all agreed with interspersed with good insights from the speakers and audience. Not much that was new to a Cypherpunk, of course. (In fact, the forum was almost a kind of Cypherpunks physical meeting, in terms of the topics, and in terms of who attended....it was even where we've been having recent physical meetings.) A day well spent. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 5

Sameer got plugged on C-SPAN
by Alex Strasheim 17 Dec '03

17 Dec '03

Janlori Goldman, at the Center for Democracy & Technology, just mentioned Sameer's anonymizer on C-SPAN during a segment of Internet privacy. They showed a shot of the screen and everything.

1 0

Re: rsync and md4
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Look the point is that Ogren seems to think this is some sort of a > minor technicality and that we can safely ignore it most of the > time. Thats simply not prudent. Once you find that the key properties > of your cryptographic hash have fallen and you have to be > exceptionally careful about what you put through the hash lest an > attacker somehow influence it, you've lost the game. MD5 is no longer > trustworthy. I agree that one needn't run screaming in the streets, > but Ogren made it sound as though this wasn't a matter of > concern. Thats simply wrong. Saying that leads people to a completely > incorrect conclusion. And I told myself I wouldn't respond to this thread anymore. Oh well. I just don't want to be misinterpreted. I never meant to imply (and don't think that I did), that the attacks against MD5 were insignificant. As I said, I'm moving to SHA in any software I develop from now on. What I said was the attacks were insignificant in the application being considered (rsync) and that MD5 was not completely broken. Come on, all the guy wanted was a fast 128 bit checksum. For example, I am still using PGP clearsigning which, of course, uses MD5. Dobbertin indicates that his attack cannot be used against me as long as I only sign messages that I create myself. Yes, PGP would work better with SHA. I'd be able to sign documents that others created with (more) certainty. But that doesn't mean that I should stop using PGP. P.S. I apologize to the list for flooding this list recently. Unfortunately, I took it a little too personally when Perry told me to "stop spewing inaccurate information" and to "quit posting". It was late, and I let him bait me more than I ordinarily would. Now I find myself running in circles trying to make sure that I've made myself clear and that no one else (other than Perry) is misintepreting what I'm saying. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMdgDbuSLhCBkWOspAQGPeQf/QJB109Gjd3s/ALodykZgH0S6FCs3wHK7 OiTUpxBF5lwojhBSrz7ej1RnAW+Uq5Lcz/GyWqH6rvYPPI1uZ3023UAV3nqH8qXY nnznPfvTkUQgSjaQu/YRvWlTWwrNsW/KIR6iVbwVDnbUnvuAjUJskWyAg1Wz4zIV 8PV8RnrHSTT06j5LrCtiD0eWr/NgmpgIFS5+ID5z9/ikMV6xF4zSrlubELFFJUUT M3nZWDlr7SaU0hFLQt3yu6oSqAjKSGrPsU1QCJ/Y1zdS49R/cLIzOzbQ42R1Cyot hMnAayTqNdUI/goa2WAbda3gYpRodTA2GpciNj7u3xs0Ik/1TIEqlw== =4x7D -----END PGP SIGNATURE-----

1 0

FW: "CyberPayment Infrastructure"
by Blanc Weber 17 Dec '03

17 Dec '03

>---------- >From: Dick Moores[SMTP:rdm@netcom.com] >Sent: Sunday, June 30, 1996 2:13 PM >To: SEASIGI >Subject: "CyberPayment Infrastructure" > >"CyberPayment Infrastructure" is the title of a new article from the >Journal of Online Law. I have an email subscription, but there's also >a >web site, http://www.wm.edu/law/publications/jol . The new article >should be on the web site soon, but if it's not, I'll send it to anyone >who asks. It's about 20k. Here's the abstract: > > {Article 6} > > CyberPayment Infrastructure > Henry H. Perritt, Jr. [NOTE 1] > > [Cite as Henry H. Perritt, Jr., > "CyberPayment Infrastructure," > 1996 J. Online L. art. 6, par. ___] > >Abstract > >{par. 1} An essential requisite for commerce on the Internet >is the existence of a reliable and secure system to handle >payment for goods and services purchased. The basic >technology for such systems is public key encryption. >Professor Perritt explains how this technology can be used >to create a variety of "payment infrastructures." Any >payment system must meet certain requirements: merchants can >depend on it to be paid; consumers have access to the means >of payment through intermediaries like "certificate >authorities;" these intermediaries understand their >responsibilities and risks; and existing financial >institutions understand their responsibilities in the world >of non-paper-based financial instruments. Much of what is >necessary can be accomplished within today's legal framework >without need of new laws. > >----------------------------------------------------------------- > >Dick Moores rdm(a)netcom.com > >

1 0

Re: [Fwd: Doubleclick]
by Tim Dierks 17 Dec '03

17 Dec '03

At 10:24 AM 7/1/96, Scott Wyant wrote: >At 12:43 PM 6/30/96 -0700, jon(a)aggroup.com wrote: >>> > >From: Scott Wyant <scott_wyant(a)loop.com> Subject: COMMENT: >>> > > >>> > >If you're like me, you never went to a site called "doubleclick." >>> > >So how did they give you a cookie? After all, the idea of the >>> > >cookie, according to the specs published by Netscape, is to make a >>> > >more efficient connection between the server the delivers the >>> > >cookie and the client machine which receives it. >>> > >But we have never connected to "doubleclick." >> >>Scott must have. Navigator is very picky about where a cookie comes >>from and what is put in the domain field of the cookie. > >Nope. I'm afraid your information is incorrect here. I've also watched >other sites hand me a double-click cookie. The way doubleclick works is that the sites who contract with them to sell advertising space insert a URL into their page which fetches the doubleclick ad banner. For example, the guys at TroutHeads, Inc. (www.troutheads.com) would insert an HTML IMAGE tag with an HREF referring to ad.doubleclick.net; that then results in _your_ browser doing an HTTP transaction with ad.doubleclick.net; doubleclick can then hand you all the cookies it wants. Anytime you fetch an image, you're visiting a site, and because it's automatic, you can easily visit a lot of sites you never knew you were going to. >From <URL:http://www.doubleclick.net/web_sites/htmlchange.htm>: For any HTML document you wish to display an ad banner for, simply add the following HTML tags: <CENTER><A HREF="http://ad.doubleclick.net/jump/MY_URL"> <IMG SRC="http://ad.doubleclick.net/ad/MY_URL" WIDTH=468 HEIGHT=60 ISMAP></A> Click on graphic to find out more!</CENTER> Where MY_URL is the URL for the HTML document displaying the ad banner. For example: <CENTER><A HREF="http://ad.doubleclick.net/jump/www.iaf.net/htmlchange.htm"> <IMG SRC="http://ad.doubleclick.net/ad/www.iaf.net/htmlchange.htm" WIDTH=468 HEIGHT=60 ISMAP></A> Click on graphic to find out more!</CENTER> - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org "...when ketchup finally comes out of the bottle, it is going a good 25 miles a year.... It rolls along at three-thousandths of a mile an hour. Heinz knows the speed because it has a device called a Bostwickometer, a chutelike contraption that calculates the speed at which ketchup travels." - The New York Times, June 12, 1996

1 0