December 2003 - cypherpunks-legacy

[Contact Information]
by Black Unicorn 17 Dec '03

17 Dec '03

I'll be off the list for a time. I am going to be traveling where there are no net connections to be had so I am unsubscribing to keep the mail box to a sane level. E-mail will be held, but not read for some time. -- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland

1 0

Electric Library Gift Idea
by Electric Library 17 Dec '03

17 Dec '03

** Special Holiday offer to Electric Library Trial Users and Customers ** Purchase a 6 month gift subscription for only $39.95, save more than 30%!! -------------------------------------------------------------------------- Are you looking for the perfect last minute holiday gift? Now you can give an Electric Library Gift Subscription to the entire family, a friend or your favorite student! Why give one book or magazine when you can give thousands of full-text newspapers and magazines, extensive photo archives, complete encyclopedias, and more! This great cybergift includes 6 months of unlimited access to the most complete reference library online. Our special holiday offer is a terrific value, at only $39.95, over 30% off of the regular price! And, it is fully guaranteed. To give an Electric Library Gift Subscription online simply place your order and then print a stylish gift certificate - or - choose from our selection of electronic gift packages. Be the first to give a cybergift online! Preview the gift certificates and wrapping options by connecting to http://www.cardsandgifts.com. The online Gift Center is open around the clock (except from 4am-7am EST). The Electric Library Gift Subscription is a limited time offer and available for new subscriptions only. Please visit http://www.cardsandgifts.com for more information.

1 0

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

Ray wrote: > And I'd be happier running the signed ActiveX control, written by Peter > Trie, or anyone else within a Sandbox regardless of signature as it > increases security. We're in violent agreement here Ray. Sandboxes are good, signed code is good, having both is very good. We differ on the relative importance of the two techniques but I suspect that is because we are coming from different contexts. My work is all intranet so the users trust the software produced for them by definition. Obviously the factors are different on the net at large. > The above says that you wouldn't want to run ActiveX in a sandbox while > you would want to run Java in a sandbox. The difference between > technologies is that one runs native the other emulative. I wouldn't > want to run ANY foreign code outside a sandbox. Java or ActiveX. It's not a Java vs ActiveX thing for me at all. What is important is that some of the applets I write can't function in a sandbox, they need access to the disk and other resources for business reasons. For this type of thing signed code without a sandbox is the only choice. What I'd really like is the sort of thing Bill Frantz is describing on another branch of this thread. Signed code and an administrator defined policy that specified for a given signature exactly what types of resources should be accessible. Anything from don't execute and audit a security alarm to complete access to the whole machine. > The whole point of this was creating a distributed network of DES > crackers. Yes, but in good cypherpunk fashion I've hijacked the original topic into a new direction. :-) > > If you choose to run an unsigned control all bets are off. On a related note, > > I recently saw a Java implementation of a board game that recommended > > the user download the zipped up .classes and run it locally. How many > > average users realize this would disable the Java sandbox entirely? > > How many users know how to download the jdk and run the java vm locally? They don't need to. All they need to do is unzip the java classes into their classpath and all of the normal restrictions on an applet are ignored. Think it would be very hard to persuade a user to do just that in order to play a kewl java game? More importantly it shows that even expert users don't always know where the holes in the sandbox are. regards, -Blake

2 1

Re: ITAR -> EAR; loss of First Amendment Rights.
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:43 PM 12/14/96 -0500, Peter D. Junger wrote: >: I am not aware of any prior time when the government >: attempted to claim that printed material, freely >: available in bookstores and newsstands to US citizens, >: became contraband when sold or given to a non-citizen. > >A literal reading of the ITAR's provisions relating to cryptography >leads to exactly that result. And there have been strong suggestions >that that is the intended result in some of the statements made by >representatives of the State Department. > >If you are interested in this you might look into MIT's experiences >when they published the book with the PGP source code. Look back at the first few volumes of Cryptologia in which this debate was documented -- back in 1978 ff. The NSA under Adm. Inman tried to get crypto declared born classified, just like atomic weapons work. Congress told him NO. Perhaps it's time for Congress to speak again. You'd think these folks would take 'no' for an answer.... - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrg46VQXJENzYr45AQEyKwP+NEErSUEv/nOQvN5C6sLLq2CxDR/YYEsp mUvwtNxUjXT6iL71hA/5Pn7n1tdRUipkOeUXx5OGoOJ4rtZ/USIEXtqogLsCjXHo OsECu1ytMT/d9MFkSjM3ARenVXE5u39Q4HBSJ+RGnU9mTbB7r2R4dYsjeTQF2rkG pKEVFxNFMio= =5cLt -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

pdf and ps files
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

does anyone know of any routines and/or scripts to extract text from .pdf or .pd files (acrobat or postscript, that is). crypto relavance, of course, i am trying to extract the gwbasic code from the army crypytanalysis manual that just appeared on the web. (-: cheers, -paul

1 0

Ping of Death?
by james＠hotwired.com 17 Dec '03

17 Dec '03

Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of hostile code, disguised as a mere ping, that can lead to server rebooting. James Glave Technology Assignment Editor, Wired News, http://www.wired.com/ Producer, Packet, http://www.packet.com/ Phone: 1.415.276.8455 Fax: 1.415.276.8499

4 3

Parolees Can't Possess Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

The new federal parole guidelines that will ban some cons from the nets will also ban them from posessing crypto software which will also make virtually any computer use impossible. "Main Justice" does say that with the Klinton Admins plans for universal access counter this proposal since the cons will have access at schools, libraries, etc. (not to mention Internet Cafes). DCF

2 1

Re: [NOT NOISE] Microsoft Crypto Service Provider API
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:13 AM 12/18/96 -0500, Marc Horowitz wrote: >You're right, you haven't looked at it closely. Although it doesn't >have Key Escrow, new cryptosystems can only be added if they are >signed by a private key held by Microsoft. Of course, Microsoft has >agreed with the State Dept. to sign only export-"strength" crypto. I should let Microsoft defend their own turf, but they told me they will sign anyone's CSP. Once the CSP is signed, Microsoft is off the export hook. It's now *your* problem to obey the export laws or keep your CSP inside the country. That's what's so brilliant about the MS CSP design. By getting them off the hook for enforcing export laws, they can write S/W to call the CSP and just plain ignore the export hassles. If you can't handle it yourself, delegate it! - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrhda1QXJENzYr45AQH4CAP+Kv9cEqV3z1aRVTTdA4DcLyQSF0D59xip QUAJWXMZJomqX/qE4PduGG8OZbvgkmLfHwJrm6v1HbjndmLhbp9FnKHLT2i5IL1B ilkGGEvglc19SwprsGnjGYZRbjQRxbObQmr/Qc8R9Z5jWzAdpxsWM/vAXTvTkevT TIYnt7AvehA= =r+qm -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

More on Van Eck
by John Young 17 Dec '03

17 Dec '03

Steve Schear has provided a 1988 follow-up article on Van Eck's 1985 study of EMR snooping. It includes a letter by Van Eck explaining why he omitted certain information in the original article, and why his employer "classified" more sophisticated studies of "compromising emanation." We've put up HTML and PDF versions: http://jya.com/bits.htm (12 kb plus 2 images) http://jya.com/bits.pdf (85 kb)

1 0

RE: The virus I got...
by Internaut 17 Dec '03

17 Dec '03

From: Mark Rosen[SMTP:mrosen@peganet.com] Sent: Wednesday, December 18, 1996 04.37 PM >Oh, and as far as I know, no virus was installed, >though you should check for one just for good measure. There was one, though I don't remember what it's name was. Maby it was Monkey. I already deleted it. --Internaut

1 0