December 2003 - cypherpunks-legacy

Microsoft Exploratorium, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

********** http://cgi.pathfinder.com/netly/opinion/0,1042,1685,00.html The Netly News (http://netlynews.com/) January 13, 1998 Which Way the Windows by Declan McCullagh (declan(a)well.com) Looks like it's upgrade time not just for Microsoft Windows, but also for Microsoft's legal strategy. As engineers frantically debugged the Windows 98 beta last week, senior Microsoft executives roamed Washington, D.C., apologizing for their previous arrogance and saying they had been misunderstood. Call it Microsoft PR 2.0. "What we have not done is communicate" the way the software works, Robert Herbold, Microsoft chief operating officer, told The Netly News last Friday. But will Microsoft's new humility appease federal judge Thomas Penfield Jackson, who already issued a preliminary injunction against the Redmond firm? He's scheduled to hear from the company's lawyers and the Department of Justice this morning. Both have spent a good chunk of the last month complaining about each other: The government says Microsoft violated the judge's order, and Microsoft says the government is "poorly informed." As his attorneys argue the law, Bill Gates will be practicing politics -- a skill that will come in handy if Congress holds more antitrust hearings when it returns in late January. Pundits have made much of Gates's Democratic sympathies, another image he's trying to discard (or at least upgrade). Today Gates is scheduled to sit down for a private chat with technophilic House Speaker Newt Gingrich (R-Georgia), who will also tour the Microsoft campus. [...] *********** http://cgi.pathfinder.com/netly/afternoon/0,1012,1686,00.html The Netly News / Afternoon Line January 13, 1998 Microsoft Exploratorium The ugly guts of Microsoft Windows were on display today during a six-hour federal district court hearing in Washington, DC. Attorneys from Microsoft repeatedly pointed at a list of hundreds of .DLL and .EXE files and challenged the government to answer one deceptively simple query: Which files are part of Internet Explorer? The outcome of the case may well turn on the answer to that question, which lies at the heart of the Justice Department's beef with the software giant. Last month Judge Thomas Penfield Jackson ordered Microsoft to stop using its operating system's popularity to force-feed Internet Explorer to computer makers. But, again, which files belong to Internet Explorer? The government's witness ducked the question. "I can't go through your list and say which files are unique to Internet Explorer," replied author and computer consultant Glenn Weadock. "I don't think it's possible or even especially useful to define a list of files and say this is part of, or this is not a part of Internet Explorer." Which Microsoft has argued all along -- their browser is integrated into the operating system. Yanking it out, the company says, would be like amputating a leg: a person could only hobble along, at best. The government views this as a weak excuse, at best. "The court issued a very simple, broad order and Microsoft through its actions defied rather than complied with that order," said Justice Department trial attorney Phillip Malone. The government is asking Judge Jackson to hold Microsoft in contempt and levey a million-dollar-a-day fine. The hearing will continue tomorrow when Microsoft vice president David Cole testifies. - By Declan McCullagh/Washington -------------------------------------------------------------------------- POLITECH -- the moderated mailing list of politics and technology To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: subscribe politech More information is at http://www.well.com/~declan/politech/ --------------------------------------------------------------------------

1 0

Should police knock before entering - SC to decide [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > SUPREME COURT CASE: SHOULD POLICE KNOCK BEFORE ENTERING? > > SCOTUS graphic January 13, 1998 > Web posted at: 2:14 p.m. EST (1914 GMT) > > WASHINGTON (CNN) -- The Supreme Court was being asked Tuesday to > decide whether law enforcement officers should ring the doorbell or > knock before entering a building if they sense danger. > > The case focuses on a 1994 incident in Oregon. Hernan Ramirez fired > his gun after police broke in his garage window after they received > a tip that a fugitive was in the Ramirez house. It was a tip that > turned out to be wrong. > > Ramirez fired his gun without knowing that those intruding were law > officers, and once he realized who the intruders were he > surrendered. > > "The police fire back a fusillade of fire, screaming 'police! > police!' -- this is the first time Mr. Ramirez realizes that the > police are there," said public defender Michael R. Levine. > > Even though Ramirez was not the fugitive that police had been > looking for, they still arrested Ramirez on weapons charges since, > as a convicted felon, he was not permitted to possess a gun. > > A federal judge later ruled that the police search had been > unconstitutional. The federal government then brought the case to > the Supreme Court, arguing that the increased danger in that > particular case had warranted the window-shattering no-knock entry > into the Ramirez building. [text deleted] ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Privacy & Anonymous service providers?
by William Knowles 17 Dec '03

17 Dec '03

I'm working on a web page that would include a list of Internet providers that either offer anonymous accounts or a better degree of privacy not usually seen by regular ISP's. Below is a list of providers that offers these services that I have been able to put together, I'm wondering if there are some that I am missing. To avoid noise on the list and I'm no longer a member of the cypherpunks list, please e-mail me privately. Paranoia http://wwww.paranoia.com Data Haven Project http://www.datahaven.com L0pht Heavy Industries http://www.l0pht.com Offshore Information Services http://www.offshore.ai Cyberpass http://www.cyberpass.net SkuzNet http://skuz.wanweb.net LOD Communications http://www.lod.com The Nymserver http://www.nymserver.com Sekurity.org http://www.sekurity.org Hotmail http://www.hotmail.com Thanks in advance! William Knowles erehwon(a)dis.org == The information standard is more draconian than the gold standard, because the government has lost control of the marketplace. -- Walter Wriston == http://www.dis.org/erehwon/

1 0

Talk of Banning Research into Human Cloning
by Tim May 17 Dec '03

17 Dec '03

This has some tangential list relevance in that it involves the Brave New World, so to speak, of the government deciding what research is legal and what is not. Clinton is asking Congress to ban research into human cloning. Importantly, this is not a proposal to cut federal funding of such efforts, as this would be unexceptionable (except to certain obscurantists). That is, the NSF or HHS or NIH or whatever is free to not fund all sorts of research projects. (Obviously many of us would cut nearly all such funding.) No, Clinton is asking for Congress to *ban* such research, regardless of where the funding came from. "Clone a cell, go to jail." "Clinton's proposal would make illegal any attempt to create a human being using the so-called somatic cell nuclear transfer technology that produced Dolly the sheep, in which an adult cell was fused with an egg. " Though I'm not a constitutional expert, this would seem to me to be a violation of various rights. A First Amendment right to speak and publish as one wishes for one, a Fourth Amendment right against search and seizure and to be secure in one's papers, and probably more general rights that have long-held that government agents cannot tell people what books they may read, what thinking they may do, and whom they may asssociate with (if the Civil Rights Act is viewed as the unconstitutional anomaly it is). Only a very few types of research are banned. And these are all ostensibly "national security" areas. Namely, chemical and biological warfare research, heavily regulated (private companies can do such research, but only with government approval, supervision, and generally _for_ the government). And nuclear weapons research (probably as part of the Atomic Energy Act). (If anyone can think of other "bans on research," besides weapons areas, let me know.) But a ban on cloning research would not be a matter of "national security," only of ethics and religious beliefs. Whatever the arguments for banning unapproved research into CBW and nuclear weapons, banning cloning research is an entirely different set of issues. Will Congress pass such a ban? Unknown. (They didn't pass the last such ban Clinton asked for.) Will the Supreme Court hear the case if such a ban is passed and then challenged? Unknown. Any implications for crypto? If Congress can successfully make certain types of science illegal, felonizing the search for truth, why not a ban on certain types of mathematics research? --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 3

mobile agents paper
by Adam Back 17 Dec '03

17 Dec '03

Nelson Minar <nelson(a)media.mit.edu> pointed out in email to me the relevance of his thesis proposal and paper "Computational Media for Mobile Agents" to the discussion on autonomous agents as a means to deploying eternity servers and remailers etc. http://www.media.mit.edu/~nelson/ (Not read it yet). Adam

1 0

Re: (eternity) mailing list and activity
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

On 11 Jan 1998 18:48:24 -0600, Adam Back <aba(a)dcs.ex.ac.uk> wrote: >Wei Dai suggested that documents should be secret split in a redundant >fashion so that say 2 of 5 shares are required to reconstruct the >document. If the shares are distributed across different servers, >this ensures that one server does not directly hold the information. What prevents the operator of such a server from being charged with "conspiracy to provide child porn" or whatever? If he is holding a portion of such contraband, isn't he as liable as if he was holding the whole article(s)? -- Phelix

3 2

What it means to be in America...
by Jim Choate 17 Dec '03

17 Dec '03

America's abundance was created not by public sacrifices to "the common good," but by the productive genius of free men who pursued their own personal interests and the making of their own private fortunes. They did not starve the people to pay for America's industrialization. They gave the people better jobs, higher wages, and cheaper goods with every new machine they invented, with every scientific discovery or technological advance- and thus the whole country was moving forward and profiting, not suffering, every step of the way. - Ayn Rand In the United States the majority undertakes to supply a multitude of ready-made opinions for the use of individuals, who are thus relieved from the necessity of forming opinions of their own. - Alexis de Tocqueville ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

unsolved billing problem
by CLAUD W WELCH 17 Dec '03

17 Dec '03

I cancelled my membership prior to the end of two days. i would like a refund.

2 1

Plan 9's auth() function - partialy secure distributed computing
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From ravage(a)ssz.com Tue Jan 13 17:51:44 1998 Date: Tue, 13 Jan 1998 17:51:42 -0600 From: Jim Choate <ravage(a)ssz.com> Message-Id: <199801132351.RAA29535(a)einstein.ssz.com> X-within-URL: http://plan9.bell-labs.com/magic/man2html/6/auth To: ravage(a)einstein.ssz.com Subject: auth [search] [index] delim $$ define lbr ' roman "{" ' define rbr ' roman "}" ' NAME ticket - authentication service DESCRIPTION This manual page describes the protocols used to authorize connections, confirm the identities of users and machines, and maintain the associated databases. The machine that provides these services is called the authentication server (AS). The AS may be a stand-alone machine or a general-use machine such as a CPU server. The network database ndb(6) holds for each public machine, such as a CPU server or file server, the name of the authentication server that machine uses. Each machine contains three values important to authentication; a 56-bit DES key, a 28-byte authentication ID, and a 48-byte authentication domain name. The ID is a user name and identifies who is currently responsible for the kernel running on that machine. The domain name identifies the machines across which the ID is valid. Together, the ID and domain name identify the owner of a key. When a terminal boots, the user is prompted for user name and password. The user name becomes the terminal's authentication ID. The password is converted using passtokey (see auth(2)) into a 56-bit DES key and saved as the machine's key. The authentication domain is set to the null string. If possible, the terminal validates the key with the AS before saving it. For Internet machines the correct AS to ask is found using bootp(8). For Datakit machines the AS is a system called p9auth on the same Datakit node as the file server the terminal booted from. When a CPU or file server boots, it reads the key, ID, and domain name from non-volatile RAM. This allows servers to reboot without operator intervention. The details of any authentication are mixed with the semantics of the particular service they are authenticating so we describe them one case at a time. The following definitions will be used in the descriptions: $CH sub c$ an 8-byte random challenge from a client $CH sub s$ an 8-byte random challenge from a server $K sub s$ server's key $K sub c$ client's key $K sub n$ a nonce key created for a ticket $K lbr m rbr$ message $m$ encrypted with key $K$ $ID sub s$ server's ID $DN sub s$ server's authentication domain name $ID sub c$ client's ID $UID sub c$ user's name on the client $UID sub s$ user's name on the server A number of constants defined in auth.h are also used: AuthTreq, AuthChal, AuthOK, AuthErr, AuthTs, AuthTc, AuthAs, and AuthAc. File Service File service sessions are long-lived connections between a client host and a file server. Processes belonging to different users share the session. Whenever a user process on the client mounts a file server (see bind(2)), it must authenticate itself. There are four players in an authentication: the server, the client kernel, the user process on the client, and the authentication server. The goal of the authentication protocol is to convince the server that the client may validly speak for the user process. To reduce the number of messages for each authentication, common information is exchanged once at the beginning of the session within a session message (see attach(5)): Client->Server Tsession($CH sub c$) Server->Client Rsession(${CH sub s},~{ID sub s},~{DN sub s}$) Each time a user mounts a file server connection, an attach message is sent identifying/authenticating the user: Client->Server Tattach($K sub s lbr AuthTs, ~ {CH sub s},~{UID sub c}, ~ {UID sub s}, ~ K sub n rbr , ~ {K sub n} lbr AuthAc, ~ {CH sub s}, count rbr )$ Server->Client Rattach($ K sub n lbr AuthAs,~{CH sub c},~count rbr$) The part of the attach request encrypted with $Ksubs$ is called a ticket. Since it is encrypted in the server's secret key, this message is guaranteed to have originated on the AS. The part encrypted with the $K sub n$ found in the ticket is called an authenticator. The authenticator is generated by the client kernel and guarantees that the ticket was not stolen. The count is incremented with each mount to make every authenticator unique, thus foiling replay attacks. The server is itself authenticated by the authenticator it sends as a reply to the attach. Tickets are created by the AS at the request of a user process. The AS contains a database of which $ID sub c$'s may speak for which $UID sub c$'s. If the $ID sub c$ may speak for the $UID sub c$, two tickets are returned. UserProc->AS $AuthTreq, ~ CH sub s , ~ ID sub s , ~ DN sub s , ~ ID sub c , ~ UID sub c$ AS->UserProc $AuthOK, ~ K sub c lbr AuthTc, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr , ~ K sub s lbr AuthTs, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr$ Otherwise an error message is returned. AS->UserProc $AuthErr$, 64-byte error string The user passes both tickets to the client's kernel using the fauth system call (see fsession(2)). The kernel decrypts the ticket encrypted with $K sub c$. If $UID sub c$ matches the user's login ID, the tickets are remembered for any subsequent attaches by that user of that file server session. Otherwise, the ticket is assumed stolen and an error is returned. Remote Execution A number of applications require a process on one machine to start a process with the same user ID on a server machine. Examples are cpu(1), rx (see con(1)), and exportfs(4). The called process replies to the connection with a ticket request. Server->UserProc $AuthTreq, ~ CH sub s , ~ ID sub s , ~ DN sub s , ~ xxx, ~ xxx$ Here xxx indicates a field whose contents do not matter. The calling process adds its machine's $ID sub c$ and its $UID sub c$ to the request and follows the protocol outlined above to get two tickets from the AS. The process passes the $K sub s$ encrypted ticket plus an authenticator generated by /dev/authenticator from the $K sub c$ ticket to the remote server, which writes them to the kernel to set the user ID (see cons(3)). The server replies with its own authenticator which can be written to the kernel along with the $K sub c$ encrypted ticket to confirm the server's identity (see cons(3)). UserProc->Server $ K sub s lbr AuthTs, ~ CH sub s , ~ UID sub c , ~ UID sub s , ~ K sub n rbr , ~ K sub n lbr AuthAc, ~ CH sub s , ~ 0 rbr $ Server->UserProc $K sub n lbr AuthAs, ~ CH sub s , ~ 0 rbr$ Challenge Box A user may also start a process on a CPU server from a non Plan 9 machine using commands such as con, telnet, or ftp (see con(1) and ftpfs(4)). In these situations, the user can authenticate using a hand-held DES encryptor. The telnet or FTP daemon first sends a ticket request to the authentication server. If the AS has keys for both the $ID sub c$ and $UID sub c$ in the ticket request it returns a challenge as a hexadecimal number. Daemon->AS $AuthChal, ~ CH sub c , ~ ID sub c , ~ DN sub s , ~ ID sub c , ~ UID sub c $ AS->Daemon $AuthOK$, 16-byte ASCII challenge Otherwise, it returns a null-terminated 64-byte error string. AS->Daemon $AuthErr$, 64-byte error string The daemon relays the challenge to the calling program, which displays the challenge on the user's screen. The user encrypts it and types in the result, which is relayed back to the AS. The AS checks it against the expected response and returns either a ticket or an error. Daemon->AS 16-byte ASCII response AS->Daemon $AuthOK, ~ K sub c lbr AuthTs, ~ CH sub c , ~ UID sub c , ~ UID sub c , ~ K sub n rbr$ or AS->Daemon $AuthErr$, 64-byte error string Finally, the daemon passes the ticket to the kernel to set the user ID (see cons(3)). Password Change Any user can change the key stored for him or her on the AS. Once again we start by passing a ticket request to the AS. Only the user ID in the request is meaningful. The AS replies with a single ticket (or an error message) encrypted in the user's personal key. The user encrypts both the old and new keys with the $K sub n$ from the returned ticket and sends that back to the AS. The AS checks the reply for validity and replies with an AuthOK byte or an error message. UserProc->AS $AuthPass, ~ xxx, ~ xxx, ~ xxx, ~ xxx, ~ UID sub c$ AS->UserProc $AuthOK, ~ K sub c lbr AuthTc, ~ xxx, ~ xxx, ~ xxx, ~ K sub n rbr$ UserProc->AS $K sub u lbr AuthPass, ~ roman "old password", ~ roman "new password" rbr$ AS->UserProc $AuthOK$ or AS->UserProc $AuthErr$, 64-byte error string Data Base An ndb(2) database file exists for the authentication server. The attribute types used by the AS are hostid and uid. The value in the hostid is a client host's ID. The values in the uid pairs in the same entry list which users that host ID make speak for. A uid value of * means the host ID may speak for all users. A uid value of !user means the host ID may not speak for user. For example: hostid=bootes uid=!sys uid=!adm uid=* is interpreted as bootes may speak for any user except sys and adm. FILES /lib/ndb/auth database file /lib/ndb/auth.* hash files for /lib/ndb/auth SEE ALSO fsession(2), auth(2), cons(3), attach(5), auth(8) Copyright © 1995 Lucent Technologies. All rights reserved.

1 0

Plan 9 ordering info [rather expensive]
by Jim Choate 17 Dec '03

17 Dec '03

If you're interested in getting Plan 9 in CD format: Harcourt Brace & Co. 800-782-4479 Plan 9 (full distribution on CD w/ source) ISBN 0-03-017143-1 $367.50 + 8% s/h + state tax (8.25% in Tx) Usualy takes 24 hours to setup an account with them. Apparently they don't ship this through retailers. When I called this morning for up to date info the #3 selection for individuals and professional didn't work. Just select the operator option and be done with it. I advised them their VRU didn't work correctly. If you talk to EJ tell her thanks again. If you just want to play then go to plan9.att.com and get the disk set they offer for playing around. It lacks all source but it will install a minimal system on an Intel box. Should work on most systems though I do suggest that you use a SCSI based system. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0