December 2003 - cypherpunks-legacy

Re: Moderation and the Polymorphic Virus
by serw30＠laf.cioe.com 17 Dec '03

17 Dec '03

> To: cypherpunks(a)toad.com > serw30(a)laf.cioe.com writes: > > Yes, lets create polymorphic viruses and CPU cycle stealing Java > > applets. Maybe even a new and improved Internet worm... > Dr.Dimitri Vulis KOTM writes: > "Cypher punks" can't write any code - be it mail filters, viruses, or crypto. > Aw, surely "Cypher punks" can write some sort of code. Batch files, Macros for Word, programs for Logo or Turtle graphics, tell me it isn't so! Eric

3 3

ok, htf do I get off this list?
by Si Dawson 17 Dec '03

17 Dec '03

OK, I've now sent THREE requests to majordomo to get off this list.. I got a reply back 4 hours ago saying I was off, and the next two said I wasn't a member of the list. Interesting list (minus the spamcrap obviously) and I think the moderation will be a good thing, BUT the 20 emails I've received in the last 4 hours (since I 'officially' unsubbed) is (to say the least) far more than I (or any reasonable mortal) can deal with. How do I unsubscribe? No, more importantly, how do I stop all these damn emails turning up? Thanks in Advance Simon As I think, talk, and act.. so I shall become..

1 0

Re: Sandy and I will run a cypherpunks "moderation" experiment in Jan
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:37 AM 1/7/97 -0800, Pierre Uszynski wrote: >Rich Graves <rcgraves(a)disposable.com> very correctly mentions: > >> 1) Moderator liability and anonymous posting. > >I agree that this is actually a critical problem with a filtering >moderation scheme. Such a scheme appears to provide the capability to >filter out possible "copyright violations" posts. From what I remember >of the Netcom/CoS case (without going back to the sources), that may >mean more liability for the reviewers (and the operator of the >machine). That's a major point against simple filtering moderation. I agree that this raises the spectre of liability for messages passed on, but I'm not sure it's a big problem. I see three broad categories of information which the moderation liability scheme may suppress: 1. Copyrighted items such as newspaper/magazine articles 2. Secrets which are being revealed (e.g., the alleged RC4 source, the Mykotronix trash stuff) 3. Defamation As to the loss of (1), I'm not heartbroken - much of this information is already placed online by its owners, and can be referred to with a hypertext link or a reference instead of being posted in its entirety. Also, some people (who I don't feel like singling out) currently provide access to third-party copyrighted information, but in a discreet manner. The "copyright violations" poster(s) could provide access in this way, unless they're committed to making John Gilmore and the remailer operators take the heat for someone else's actions. The loss of (2) is regrettable; but Usenet (and other unmoderated forums) are still available for hit-and-run disclosure of secrets. Also, it's unclear to what extent (2) will be lost. Given the recent California and Federal statutory changes strengthening trade secret protection, I think it's useful to be careful - but it's arguable that neither the alleged RC4 code nor the Mykotronix trash stuff would have been a trade secret violation. Also, let's weigh the value of what'd be lost (how many of these messages do we really get?) against the negative value of the crap we're currently subjected to, and the (speculative) value of posts we don't get because their authors have left the list because of disgust and annoyance. I'm not going to lose much sleep over (3). I can't call to mind a single instance of interesting or useful defamation that I've seen on the Net. >ichudov(a)algebra.com (Igor Chudov @ home) responded: > >> [in another forum] >> After long thinking, moderator board has come with the following >> solution: >> >> 1) We do not know for sure if a certain post violates >> some copyrights or not >> [and more in the same line 2,3,4,5] > >Would any of this have mattered in Netcom/CoS? My hunch is that liability for infringement will focus on defendants' actions after they knew or had reason to know that a particular act of copying or distribution was a violation of the copyright owners' rights. Copying data from one place to another is the essence of the net; holding owners of machines (or moderators) responsible for violations they couldn't have stopped is nonsensical. I predict (but cannot cite cases so holding) that moderators/listowners will be held liable for copyright violations they could have detected and stopped with the exercise of some level of care; but that they will not be held liable where no reasonable amount of effort on their part could have prevented the copyright violation. And I think "reasonable" will depend on the facts at hand. (All of the contributory infringement cases I'm familiar with have involved a defendant who was aware of, if not actively assisting with, the underlying infringement.) >Instead, a system that would forward reviewers' opinions *after the >fact* does not have any of this problem. And we have already mentioned, >it is also more powerful (real time initial feed, easy multiple >feedback feeds, fully compatible with anything else...) although it >does not reduce bandwidth requirements. Can you name a software package which runs under Windows or the Mac OS which automatically processes reviewers' opinions against a mailbox of incoming mail? Better yet, can you name a Eudora plug-in which does so? Abandoning an imperfect but workable solution because it's possible to imagine that someone will create something better someday strikes me as silly. Comparing theoretical software/strategies with currently implemented software/strategies is comparing apples and oranges. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

7 6

Re: About ICF(International Cryptography Framework)
by Pass me another! 17 Dec '03

17 Dec '03

John Young wrote: > > Here are two docs on ICF which might be helpful: > > http://jya.com/halicf.htm (Hal Finney's critique posted to c'punks) > > http://jya.com/declan.htm (news reports) > > John Thanks a ton...I appreciate it...I checked them out. They say that this tech may not be available for some time...however, I feel that may not be necessarily true...tech is coming and going much faster these days and according to Ray Bamford's stance at HP, he seems to think that this may soon(within the next year) become a viable reality. Can I ask what your stance and views are on this issue? And any ideas as to what we as a community can do about this NAZI-istic progression of freedoms?? -spanky

1 0

About ICF(International Cryptography Framework)
by Starr 17 Dec '03

17 Dec '03

Has anyone heard anything or been paying attention to the development of the ICF(International Cryptography Framework) standard. This seems to be an attempt of the US Gov and a FEW of our favorite corps to completely control cryptography standards as well as to have the keys to all cryptographical content. The only information I've found so far is on HP's website http://www.dmo.hp.com/gsy/security/icf/main.html I've also managed to get a hold of Ray Bamford (ray_bamford(a)hp.com)at HP who seems to have some PR role in this wool over the eyes attempt. It seems to be just another (souped-up, in disguise attempt at the clipper chip except on an International basis). When I spoke to him he told me that the only information that has been issued is what you seen in the technical paper, and that the info they have is extremely exclusive, even if you are a legitimate company working on cryptography issues, etc. Check it out...I would definitely like to hear your opinions as well as if any of you have more information on this subject(newsgroups, mail lists, etc). -spanky

2 2

IBM Key Recovery Propaganda on United Airlines
by dimple＠pacific.net.sg 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Aeon Flux
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

-

1 0

Let you know!!
by sls123＠prodigy.net 17 Dec '03

17 Dec '03

Hi, Please forgive me for this e-mail, but I felt I just had to let more people know about this and get in on the ground floor! If you don't want to read it, please type "REMOVE" in the subject line. I won't contact you again. The program I am involved in incorporates "Spillover". Spillover is probably one of the best ideas ever developed for network marketing. Here's why: Anyone I sponsor after you, will probably be placed under you. You then earn commissions on these new people as if you had signed them up! Why? The way the program works I am trying to fill my downline and I can only have so many people on each level. After a given level is full, anyone else I sponsor "spills over" to the next level. This is where they start getting placed under you. So you see, it doesn't matter if you sign them up or I do, in the end the result is the same. I just signed up Monday and I already have 10 members in my downline, just from SPILLOVER! Nest Egg is in pre-Launch until April 1st, 1997 * You will receive check each month * * Free Sign Up! * The program just started, in fact it has less than 550 members. This IS the ground floor! The company is advertising in several major print publications next month! I have been in several MLM's and I can finally say; "This is the one I've been looking for!" If you know what it's like to lose sleep because your so exited, email me NOW! Don't miss this opportunity, email me for URL & sponsor information. Thanks, Mark

1 0

Free Samples, Software, and MoreI would like to invite you, as an internet user, to be part of a marketing test where you can get FREE software, FREE Samples, and FREE computer related money making offers from manufacturers nationwide. You may be asked to give your opinion, but there is no obligation.
by dans＠pleaseread.com 17 Dec '03

17 Dec '03

even if you had their addresses! If do not want to get anymore e-mail reports like this, please send email to dans(a)pleaseread.com with the word "REMOVE" in the subject or the body. -Lisa

1 0

AOL: The Happy Hacker
by SECRET AGENT 66 17 Dec '03

17 Dec '03

From: IN%"destiny(a)crl.com" "David Cassel" 9-JAN-1997 05:27:47.48 To: IN%"aol-list(a)cloud9.net" "The AOL List" CC: Subj: The AOL List: The Happy Hacker Return-path: <owner-aol-list(a)cloud9.net> Received: from cloud9.net ("port 1250"@cloud9.net) by delphi.com (PMDF V5.0-7 #10880) id <01IDZXJME7BK90PW97(a)delphi.com>; Thu, 09 Jan 1997 05:27:33 -0500 (EST) Received: (from majordomo@localhost) by cloud9.net (8.8.4/cloud9-1.0) id EAA02888 for aol-list-outgoing; Thu, 09 Jan 1997 04:42:59 -0500 (EST) Received: from crl.crl.com (unknown(a)crl.com [165.113.1.12]) by cloud9.net (8.8.4/cloud9-1.0) with SMTP id EAA02882 for <aol-list(a)cloud9.net>; Thu, 09 Jan 1997 04:42:56 -0500 (EST) Received: by crl.crl.com id AA27763 (5.65c/IDA-1.5 for The AOL List <aol-list(a)cloud9.net>); Thu, 09 Jan 1997 01:32:41 -0800 Date: Thu, 09 Jan 1997 01:32:39 -0800 (PST) From: David Cassel <destiny(a)crl.com> Subject: The AOL List: The Happy Hacker Sender: owner-aol-list(a)cloud9.net To: The AOL List <aol-list(a)cloud9.net> Message-id: <Pine.SUN.3.91.970109004403.24862A-100000(a)crl.crl.com> MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Precedence: bulk T h e H a p p y H a c k e r ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ In 1995 a hacker named Happy Hardcore wrote a program that granted unlimited free access to AOL. Yesterday AOL issued a press release applauding his conviction in a court in Virginia. (http://www.prnewswire.com/pdata/19970108-DCW022.html) According to press accounts, Nicholas Ryan -- who studies computer science at Yale university -- was found guilty of a felony offense under the Computer Fraud and Abuse Act: he illegally accessed AOL "and violated AOL's terms of service". But AOL's press release doesn't tell the whole story. The Washington Post reported that in fact, AOL dropped over 370,000 subscribers between March and June of 1996 "for credit card fraud, hacking, etc." [9/16/96] Up until September of 1995, AOL didn't even verify the authenticity of credit card information submitted for free-trial accounts. (And as of last year, they'd distributed over 100 million of them.) Monday AOL shut local phone access to the entire nation of Russia because it couldn't collect enough accurate information to cover their expenses. Ryan was targeted because he created a program used by other hackers--and because he publicly taunted AOL in the program's documentation. He included internal AOL e-mail (stolen by other hackers) discussing the company's plans to thwart his program. Ryan wasn't charged with creating the program, but for accessing the system illegally--a crime he shared with nearly half a million others. For six months of access, he faces a maximum of five years in prison and $250,000 in fines. Under AOL's new value plan, the stolen time would have a cash value of $60. AOL's public statements indicate they want to appear tough on hackers -- especially now that they're seeking revenue from on-line transactions. A press release announcing the appointment of a vice president to AOL's optimistically-named "Integrity Assurance" division stressed her previous employment at the CIA--saying Tatiana Gau wants to "improve the world's most secure online environment". (The phrase "most secure" appeared three times.) Yesterday's announcement even asserted AOL had achieved "the first successful computer fraud prosecution involving an Internet online network." (One technology correspondent quipped, "Maybe it means that Kevin Mitnick is just a figment of Tsutomu Shimomoura's imagination.") AOL's announcement went so far as to claim that AOL is safer than the internet because AOL uses a private network. But safety still depends on how a network is administered. In 1995, a beta of AOL's telnet client put users directly behind their firewalls--and earlier that year, AOL's mail server was accessible via telnet, allowing forged mail from any AOL address. Hackers even took the stage during a 1995 celebrity appearance on AOL--then taunted the scheduled guest and the event sponsors. (http://www.aolsucks.org/security/recondite.html) "I am sure Corporate Communications will be getting some questions about it," read an internal e-mail titled "Hacker Attack In the Rotunda Last Night". Ironically, that message later ended up on the AOL Security Page--"What AOL Does Not Tell You." http://www.netvirtual.com/blank/aol) The next month AOL's CEO Steve Case wrote a letter to all users about hacker problems, arguing that "it happens everywhere", and adding that "when we discover hackers", AOL "aggressively take measures to head them off". But within days of that announcement, hackers were posting internal mail that they'd stolen to the internet. They continued undaunted, posting internal memos, and even Case's home address. In probably the most embarrassing development, in-house mail ABOUT the hackers was being circulated BY The hackers (ftp://ftp.crl.com/users/de/destiny/aol/hacker1) At the time, AOL spokeswoman Pam McGraw told me, "We've encountered these problems in the past, and we make changes to the service as appropriate-- and as we can". The hackers had reverse-engineered AOL's "Rainman" software, which had been mistakenly stored in AOL file libraries accessible by their hundreds of remote staffers. The company fumbled for an explanation--Pam McGraw told the press AOL believed the heist was effected with the Visual Basic macro program AOHell. (Some later attributed her remarks to a deliberate disinformation campaign--especially when, to suppress the program's distribution, AOL later told Boardwatch magazine AOHell contained built-in child pornography. ftp://ftp.boardwatch.com/aohell.txt) But AOL's attempts to cover-up security breaches left their members even more vulnerable. "I went to a bunch of new member chat rooms, used AOHell to fish for passwords, and got 25 of them," one Usenet poster gloated. "Doesn't AOL tell its users to not do that?" There were worse abuses. When AOL realized hackers could "sniff" passwords during TCP/IP connections, staffers say they were warned--but not the customers. "I hope that AOL alerts the General Membership to this problem in a timely manner," one staffer complained, "and not, as in the previous situation, wait until they are forced to by negative news coverage." Sources had told the Wall Street Journal that the 1995 security breach included hackers distributing customer credit card numbers in AOL hacker chat rooms, and AOL had warned staffers about the breach--but didn't tell their users (until the story broke in nationwide news reports.) The staffers complained AOL's hush-hush policy was aimed more at protecting their image than protecting their customers. In a memo warning staffers not to speak to the press, Steve Case countered that "We need everyone's support...to protect AOL's interest". That even applied AOL's content providers. Shortly before hackers took the stage at his live event, the producer of AOL's MacWorld area asked AOL about earlier problems. He told me AOL had attributed them to "some security holes that AOL promised were closed." It was when hackers took the stage that he found they were not. Even AOL's latest statements are suspect. The press release claims that AOL "immediately upgraded its security measures to prevent AOL4FREE or any similar software from working". But Nicholas Ryan told a different story. "AOL found a way to detect users of AOL4Free," began the program's documentation. "However, with only a few lines of additional code AOL4Free is again undetectable!" Tatiana Gau's claims that AOL has a "zero tolerance" policy for hackers is patently implausible. Macromedia's software piracy suit fingered 67 screen names in 1995. And over 70 came into play for the "Hacker Riot" that November--a coordinated attack on the New Member Lounges (http://www.getnet.com/~onion/work/planetmag/current/features/aolside.html) lasting several hours and affecting hundreds of users. This August AOL's Chief Financial Officer even pointed to the fake accounts as a possible culprit for the high figures on their subscriber churn rate. And just six weeks ago hackers doctored text at AOL keyword: legal. (http://www.news.com/News/Item/0,4,5712,00.html) Even yesterday, aolsucks.org received the comment, "AOL SUX!!!!! Thats why I make fake accounts with them!!!" Ironically, the documentation for AOL4Free ends with the classic hacker manifesto "The Conscience of a Hacker." The 1986 document ends, "I am a criminal. My crime is that of curiosity..." And most technology pundits agree. AOL's MacWorld area was mailbombed for a week and a half, with dozens of junk posts to its bulletin boards. "We hate that," their producer told me. "Does that mean the FBI needs to be brought in? Probably not." Chris Flores of Microsoft's Developer Division agreed. "If a Visual Basic program can automate hitting this key and hitting that key, the blame should be on AOL for allowing a certain keystroke to be hit... They should think of AOHell as a blessing. Since they know about it, they know that they have a fault in their system." MacWorld's producer added, "You've got to admire the hacker ethic in a certain way, because it's how things get done...how holes get patched." Indeed, as a result of the hacker presence, AOL began accompanying all e-mail and instant messages with a warning in red letters--that AOL staff will never ask you for your password. One Florida resident with a degree in criminology pointed out on Usenet that this alone wouldn't be sufficient--because password-fishers were incorporating the warnings into their scams! ("Enter your password to confirm that you understand the warning below." "Enter your password now to turn on pass-block, which offers protection beyond the simple password warning given below.") Now AOL's 3.0 software requires users to download small software changes before they can access the system. Unfortunately, there's no way to opt out--which creates a major security hole waiting to backfire. In any case, the hacker presence belies AOL's claims of the "highest level of security". In fact, Wired News reported that "Gau is confident, but she knows she has her work cut out for her. She's already spotted a link on the Web announcing her arrival. It was titled 'Hackers are laughing.'". It was my page. THE LAST LAUGH Within days of its creations, AOL threatened the AOL Security page with charges of copyright infringement. Unfortunately, the tactic inspired three other sites to mirror the documents--which are still there to this day. David Cassel More Information - http://www.wco.com/~destiny/time.htm ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~ Please forward with subscription information and headers in-tact. To subscribe to this moderated list, send a message to MAJORDOMO(a)CLOUD9.NET containing the phrase SUBSCRIBE AOL-LIST in the message body. To unsubscribe send a message saying UNSUBSCRIBE AOL-LIST to MAJORDOMO(a)CLOUD9.NET ~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~++~

1 0