December 2003 - cypherpunks-legacy

Misdirected e-mail
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

There's no "sdg(a)dm.com". I don't know who this person is, but I hope s/he gets 'eir misdirected message via this mailing list. Date: Sat, 3 May 1997 06:52:58 -0400 Message-Id: <199705031052.GAA06973(a)lillith.anexis.com> From: support(a)freesmut.com (Free Smut Support) Subject: Secret Site Precedence: junk Apparently-To: <sdg(a)dm.com> Thank you, your username and password to our secret hardcore door are: Username: smut12 Password: freesmut This is an automated response to a request made on our web site. This IS NOT a bulk mailing. Our site is located at http://www.fl.freesmut.com/

1 0

Java woes on compatibility
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

in a recent "PC Magazine" the story went into the compatibility problems among different vendors versions of the Java language, predicting that the problems may become worse. in short the vendors have a hard time getting all the compliance exactly correct. unfortunately, this same story happened with Unix and C such that the libraries out there did not fully adhere to a standard, even when the standard went into meticulous detail. is it the same insurmountable problem all over again? can there ever really be a totally portable language? java was invented to solve portability problems, but is plagued with the same ones that other languages have. what's the solution? it hasn't been implemented yet, but I believe the solution is an extremely sophisticated verification package for the correctness of the Java language. this type of idea is hinted in the makefiles of some C programs that compile based on complex attempts to avoid/workaround portability glitches. I saw one that did many regression tests on "strcpy" trying to catch all the kinds of things that can go wrong. the idea is that you actually have code that tests all the key implementation aspects of the library and language. it needs to be capable of being fully automated. for example, you might have code that calls the java window kit and then actually verifies that a window is drawn correctly by reading the screen or something like this. if you find that some things are falling through the tests, you just add to your tests. the tests don't need to be efficient-- you run them once and never again. also, I think the solution would involve writing a lot of verification routines for *every* feature of java that is implemented. the vendors simply run the code on their own implementation and it gives a "pass or fail" response. ideally, the java *user* could go through this process-- then the company cannot claim themselves that their implementation pass it's all out in the open for customers to test themselves. I would suggest that anything in the Java language that can't be tested like this, could be modified slightly to support this "testable" property, and that it would really pay off bigtime. in other words, some part of the library that doesn't seem like it could be tested, could have extra little aspects added to its implementation that support regression testing of the feature. (note that this is not necessarily "regression" in the classic sense of software engineering, but is very similar). I've written software that has this property, that its verification routines are built into it and are accessable by the end user. I think it represents a major new and important design consideration. and ultimately I think it saves developers and users time in the long run, but perhaps not the short run. a lot of work? yes, but it's the only way in my opinion, and it can be done in an elegant way. if it isn't I believe that portability problems will *increase* as the article predicted, and the revolutionary possibilities of Java will be forever handicapped and shortchanged. note that some people think that you should have a certification process. I don't like this at all because then the verification tools are caught up inside the Java company when it makes sense to *distribute* these tools so vendors can debug their own software without going through a bureacracy to get the stamp of approval. the verification suite is actually an extremely powerful utility that can test Java conformance and should be available to anyone trying to support the standard. note also that it wouldn't have to be Sun that creates such a package. in fact it might be better if someone not affiliated with the creation of the Java language built such a package. if anyone from Java/Sun is listening, I would be happy to consult on this. <g>

2 1

Re: SAFE Bill discussion
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

The Administration hates this bill, because it threatens their ability to roll out Key Recovery. They've said as much in the letter Declan forwarded: "The bill could be read as prohibiting the United States government from using appropriate incentives to support a key management infrastructure and KEY RECOVERY." [emphasis added] Do you think that if this bill helped the Administration, that they'd be out there urging the subcommittee chairman to stop it? I think not. I'm also puzzled by the fact that CDT is being criticized pretty much solely, even though the entire Internet Privacy Coalition, and several other groups all wrote a letter of support of the bill with only a criticism of one provision. However the overall statement was of support. (see http://www.privacy.org/ipc/safe_letter.html) As far as I can tell, everyone criticizing the bill either thinks that: a) CDT actually runs all these groups behind the scenes, or b) pretty much all of the Internet advocates believe that this bill is needed and are doing the best they can with what Congress has written. You're pretty hard on CDT, but EFF, EPIC, the ACLU, VTW, Americans for Tax Reform, the Association for Computing Machinery, Computer Professionals for Social Responsiblity, Eagle Forum, the National Association for Criminal Defense Lawyers, and PGP Inc all signed this letter. Can you consider, perhaps, for a second, that critics of SAFE are being unreasonable? I would think so, as critics of SAFE include the Clinton Administration. Is that the kind of company that cypherpunks keep? Here's a great excerpt from the Internet Privacy Coalition letter: The pending bill provides a positive framework for the reforms that are long overdue in this critical area. It makes clear that the sale or use of encryption, a vital technique to promote network security and individual privacy, should not be restricted in the United States. This is the view widely shared by users of the Internet and the computer and communications industry. It was also a central recommendation of the report of the National Research Council last year. Looks like widespread support from people who study this issue for living. I'm glad to be counted among them. -S -Shabbir

9 13

BOUNCE cypherpunks@Algebra.COM: Admin request: /^subject:\s*help\b/i (fwd)
by cpunks＠algebra.com 17 Dec '03

17 Dec '03

----- Forwarded message from owner-cypherpunks(a)algebra.com ----- >From owner-cypherpunks(a)Algebra.COM Sat May 3 20:52:56 1997 Date: Sat, 3 May 1997 20:52:56 -0500 From: owner-cypherpunks(a)algebra.com Message-Id: <199705040152.UAA22185(a)manifold.algebra.com> To: owner-cypherpunks(a)Algebra.COM Subject: BOUNCE cypherpunks(a)Algebra.COM: Admin request: /^subject:\s*help\b/i >From cpunks(a)manifold.algebra.com Sat May 3 20:52:48 1997 Return-Path: <cpunks(a)sirius.infonex.com> Received: (from root@localhost) by manifold.algebra.com (8.8.3/8.8.2) with UUCP id UAA22154 for cypherpunks+incoming-cyberpass(a)algebra.com; Sat, 3 May 1997 20:52:44 -0500 Received: from sirius.infonex.com (cpunks(a)sirius.infonex.com [206.170.114.2]) by www.video-collage.com (8.8.5/8.8.0) with ESMTP id VAA13741 for <cypherpunks+incoming-cyberpass(a)algebra.com>; Sat, 3 May 1997 21:46:45 -0400 (EDT) Received: (from cpunks@localhost) by sirius.infonex.com (8.8.5/8.7.3) id SAA28274; Sat, 3 May 1997 18:49:14 -0700 (PDT) Received: from rigel.cyberpass.net (root(a)rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.5/8.7.3) with ESMTP id SAA28267 for <cpunks(a)sirius.infonex.com>; Sat, 3 May 1997 18:49:10 -0700 (PDT) Received: from mailhub.amaranth.com (root(a)mailhub.amaranth.com [206.96.254.3]) by rigel.cyberpass.net (8.8.5/8.7.3) with ESMTP id SAA08032 for <cypherpunks(a)cyberpass.net>; Sat, 3 May 1997 18:48:29 -0700 (PDT) Received: from amaranth.com (ppp20.pensacola.com [206.96.254.20]) by mailhub.amaranth.com (8.8.5/8.8.5) with SMTP id UAA13493 for <cypherpunks(a)cyberpass.net>; Sat, 3 May 1997 20:45:59 -0500 Message-Id: <199705040145.UAA13493(a)mailhub.amaranth.com> From: "William H. Geiger III" <whgiii(a)amaranth.com> Date: Sat, 03 May 97 15:28:09 -0500 To: cypherpunks(a)cyberpass.net Subject: Help!! X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.27c b9 -----BEGIN PGP SIGNED MESSAGE----- Do to some problems with my ISP I have lost several days worth of mail. :( Would someone be kind enough to zip up the cypherpunks posts from thursday to today and send them to me. Thanks, - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: What I like about MS is its loyalty to customers! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Registered User E-Secure v1.1 ES000000 iQCVAwUBM2uuPo9Co1n+aLhhAQHNMgP/bqjyLYYW9E5ZNU7mvXgt87IBwONabZUG 3UtHOkdn+y0ONDQED8HGRq8Z/1ns8yU9LfR4Y+FHvGp//3CmWwwce0MDTp3O0Mg1 QF0yX8h4qS8HpZUxn2FNnrhn2dj+dBKqZLm8ADLuOrV5lbNLeFuMFbTRGts/QEAD BDJen5/U8ZI= =bDrX -----END PGP SIGNATURE----- Tag-O-Matic: I smashed a Window and saw... OS/2. ----- End of forwarded message from owner-cypherpunks(a)algebra.com -----

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by Tim May 17 Dec '03

17 Dec '03

At 6:09 AM -0800 5/1/97, Jonah Seiger wrote: >Tim - > >It's too bad we may not see eye-to-eye on this one. > >For what it's worth, CDT shares your concerns about the criminal provision >in the SAFE bill. We believe that as currently written, the provision is >overly broad and could create a chilling effect on the everyday use of >encryption, and unnecessary because it duplicates existing obstruction of >justice law. Indeed. All reasons to withdraw support for the Bill and to actively seek to undermine and sabotage it, as I hope many of us do. Further, it is quite clear that the Bill will *not* allow strong crypto (by "strong" I mean "arbitrarily strong," the only kind most of us support!) to be exported freely. Even for "financial cryptography," as clearly any strong crypto system can--and wiil--be used eventually by some group the Administration deems to be "international terrorists." (I would classify the U.S. government as a supporter of international terrorism, for many reasons. The mining of the harbors in a country with a relatively freely elected government, for example. The support of Kurdish terrorists. The funding and equippers of sappers in Serbia. And so on. Oh, and does the use of PGP by Burmese rebels/freedom fighters/terrorists, so often cited by Phil Zimmermann as a postive example, count as use by terrorists? You get the picture. One man's terrorist is another man's freedom fighter. I support, for example, the use of strong cryptography to undermine the Zionist entity which preys upon the life of the people (TM)...does this make me a supporter of terrorists or of freedom fighters? And why do George Bush and Bill Clinton get to decide?) >We have expressed these concerns both publicly (in a letter to the >committee signed by EPIC, ACLU, EFF, VTW, CDT, and over 20 other >organizations - see http://www.privacy.org/ipc/safe_letter.html) and >privately in conversations with the committee staff. We hope to work with >the authors of SAFE to address these concerns, but, as you know, we are not >running this show and have to work with what the Congress gives us. Yoo're not "running the show," nor am I, or we, but you can withdraw support and actively oppose a bad bill. >However, despite our concerns about the criminal provisions, we believe >strongly that the SAFE bill, and the bills in the Senate sponsored by Burns >and Leahy, are vitally important and should be passed. > >As you know, the debate over encryption policy reform has been going on for >more than 4 years. Despite all of our efforts to promote the use of >encryption, crypto is still not widely used by the public. "Use a cipher, go to prison" will hardly engender more public support for cryptography. More importantly, what the hell does the SAFE bill have to do with Americans using crypto? Crypto is completely unrestricted, at least by law, anywhere in the U.S. for use by American citizens and (most) others. If Americans aren't using crypto, it's for other reasons. "Use a cipher, go to prison" will not help in this process. >The Clinton administration has not backed off from their commitment to a >global key-escrow/key-recovery system with guaranteed law enforcement >access to private keys. And despite the brilliant work of EFF on the >various legal challenges to the export restrictions, we feel this issue >will only be fully resolved through legislation. > >The status quo, in our view, is not good enough. Because of the export >controls and the lack of a coherent US encryption policy, Internet users do >not have access to the privacy protecting encryption products they need. > >Congress needs to stand up to the Administration and say, with a strong >voice, "your policy is a failure - we need a different solution". That's >what SAFE, Pro-CODE, and ECPA II do. Sorry, Johah, but these are just platitudes from a press release. More detailed analysis is called for, not just mouthings about Congress standing up to the Administration, etc. For example, answer this question: Will "unbreakable" (*) cryptography, using full-strength RSA and drop-in 3DES, IDEA, Blowfish, AES, etc., be allowed for unrestricted export? If "yes," then this is indeed a good deal. But the weasel words in nearly every section clearly say it is not. If "no," then crypto is still crippled for export...the details just vary (or maybe they don't, actually, as nothing is spelled out). (* "Unbreakable" is a dangerous term. By "unbreakable" I mean here an algorithm and key distribution mechanism (or no KD, as in PK systems) which surpasses any known breaking attempts by some comfortable margin. Cf. the study by the noted cryptographers, and use keylengths like 128 bits of work factor...that ought to be "unbreakable" by the standards of the next few centuries!) Importantly, the putative goals of the SAFE Bill could be much more simply handled this way: "SAFE -- Security and Freedom Through Encryption: Computer software shall be treated as any other form of speech is. Software shall not be subject to restrictions on dissemination, export, or possession." --Tim May, still a felon, and still using encryption to further prosecutable offenses. Fuck Congress. -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

3 2

cyberpass.net down?
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is cyberpass.net down? I have posted several messages but have not received any of them. - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: If Windows sucked it would be good for something. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Registered User E-Secure v1.1 ES000000 iQCVAwUBM2wNNY9Co1n+aLhhAQELwwQAkpj04nDm0nldgAHpFdfSa4aMa4XqNMWP DDblV3g3QRF/e2+FXk43xl2R611zNIQGchzEiMipPal7NKw1O/RZBlS/QtU7iBeG ScPYxEnom/Nq9xqdlCS0bhP2A6soikaK/SRAdX96w6iUtELbHWSN5GSSAD3LkN5B 0GEFhWgAF1M= =mviw -----END PGP SIGNATURE-----

1 0

Re: Bypassing the Digicash Patents
by Robert Hettinga 17 Dec '03

17 Dec '03

Someone, whose reputation is bigger than God, in the hope of sparing me public humiliation from the error of my ways (the very paradigm of a lost cause :-)), wrote to me offline on this topic. I'm posting it here, because frequently people reply to me with stuff which is extremely relevant to the argument at hand, and which should be heard in public. The main consideration I use is that none of the information in the reply can be used to identify the person who sent it, or mess up whatever plans they're laying, something you can clearly see in the following... At 4:48 pm -0400 on 5/3/97, somebody wrote: you write: > > I further claim that the most efficient digital bearer certificate is an > > anonymous one. > > Hal's point is this. There are two types of "anonymity": one where > the bank says "I swear I won't keep any records based on the name > you gave me" (the benign bank), and the other where we use Chaumian > blinding so the bank never even sees the identity information (the > untrusted bank). Right. Let's call the first one the Microsoft model, because I feel especially vicious this evening, and the second one the "Real" Chaum model. > Now, it seems to me that the "benign bank" sort of anonymity can't > cost any more (and in fact will even cost less) than the "untrusted > bank" Chaumian anonymity. Not true. With Chaumian anonymity, all the underwriter does is keep a database of spent digital bearer certificates, which they keep down by expiring certificate issues and the keys which generate them periodically. When someone double-spends a certificate, the underwriter has enough information to reveal their public key, but only when someone double spends and not before. With the Microsoft model, the underwriter knows who's buying your certificates, *and* the shared secret which makes the cash valid, *and* what time the certificate was issued, *and* what your shoe sizes, and the name of your sister's first date, and, and, and,... Anyway, I claim that the very Chaumian inability to *ever* know who bought the certificates you underwrite keeps you from ever *trying* to keep track of any other data, which, of course, is inherently cheaper. > Yet your arguments for anonymity apply > equally to both situations. No they don't. There's a qualitative difference between a system where you can't ever know who some one is, but you can still trust them, and a system where you always know who someone is and they have to trust *you*. :-). I say that one of the additional virtues of the former system is significantly reduced transaction costs, and finally, that that happy side effect will eventually result in a shift away from the latter kind of system, if it ever is useful to begin with. By the way, an additional cost of the system, which is obviously more in line with the privacy concerns of cypherpunks, and possibly less germaine to the transaction cost issue we're discussing, is the cost of the risk of breaking the confidentiality of systems like the Microsoft idea. I have a hunch that all it takes is one big information leak, and such systems will be dropped as a form of digital cash underwriting, but I'm going pretty far out on a limb to make that particular assertion. Should we call this the "Clipper effect", just to rattle peoples' chains? > Therefore, I say your arguments, taken > to their logical conclusion, imply that we'll end up with "benign > bank" anonymity, rather than Chaumian "untrusted bank" anonymity. Again, I don't think so. However, what we really need is some actual estimates and analysis to prove it, barring the existence of any actual transaction cost data, of course. :-). Something I'm not qualified to do, though I bet there are people here who can get those answers. > But "benign bank" anonymity is a very very weak form of anonymity > indeed -- it's not what most cypherpunks (or cryptographers) mean > when they talk about anonymous digital cash. Amen. Only people mired in the book-entry way of looking at things think otherwise. I believe the economics of the marketplace will soon teach them the serious errors of their ways... > "Benign bank" anonymity > is the sort of thing that Cybercash or other traditional systems > provide; "untrusted bank" security is what Digicash provides. And, again, I assert that the paradox of all this is that the cheapest form of commerce is a form where you don't trust anyone, or, better, trust, but verify, everyone. That's the beauty of the blind signature algorithm, it allows you to do all that, and not keep books, which cost money. > So, if I understand your argument correctly, you're saying that > we'll inevitably end up with some weak form of anonymity, but it > will be far weaker than what most cypherpunks want. I hope you can see by now, after I've taken another shot at explaining it better, what I was getting at. > That sounds more like a cause for a call to arms than a reason to > sit around reassuring ourselves that everything will turn out fine > without us! Nah. I don't do calls to arms. It's much better to change the world by making money. An especially important focus to have when you're building transaction systems. :-). I strongly beleive that you can easily knock three, maybe four, decimal places off the cost of any transaction you can care to mention just by using strong financial cryptography and anonymous digital bearer certificates on a ubiquitous geodesic network. That remains to be seen, however. I will say that I'm working as hard as someone with my limited skillset can to prove that hypothesis. :-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Ready for PrimeTime: FUD! The Newsletter of Fear Uncertainty and Doubt
by geeman 17 Dec '03

17 Dec '03

See this new exciting venture. Cards and Letters Welcome; use "FUD" in the subject header. www.best.com/~geeman

1 0

YOU ARE APPROVED!
by YES!＠netcom.es 17 Dec '03

17 Dec '03

$4000 MAJOR CREDIT CARD... GUARANTEED!! EVERYONE QUALIFIES...UNSECURTED CREDIT CARD!!! * NO Credit Checks! * NO SSN Number Required! * Major Credit Card $4000 Limit, UNSECURED!! * 4.95% Interest Rate Per Annum! * LINE OF CREDIT...$15,000 UNSECURED, 5.95% Interest Rate Per Annum! * Offshore For Complete Financial Privacy! * WORLDWIDE Acceptance At More Than 8 MILLION Locations! * INSTANT CASH ADVANCES At More Than 350,000 Banks & ATM's!! * MLM With $25.00 Fast Start Bonus! * 3X6 Forced Matrix... With High Demand, You'll Fill It Within 30 Days!! ABSOLUTELY GUARANTEED!!!!! For complete information AND application go to: FAX ON DEMAND: 415-273-6168 Doc# 1 ************************************************************* *IMPORTANT* In order for your application to processed properly, please use sponsor id# 542 ************************************************************* ABSOLUTELY GUARANTEED!!!!!

1 0

No Subject
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Quoting: http://www.msnbc.com/onair/nbc/mtp/default.asp Tune in to Meet the Press with Tim Russert on Sunday... check local listings for details. Sunday: Meet the Press will look at crime, terrorism, national security, and foreign campaign contributions. Moderator Tim Russert will speak with FBI Director Louis Freeh. This week's panelist will be NBC's Pete Williams, and the roundtable guest will be Elizabeth Drew, author of Whatever it Takes. Meet the Press transcripts are usually available three hours after the show airs.

1 0