December 2003 - cypherpunks-legacy

Excessive Crap & Flamage
by Mike Ingle 17 Dec '03

17 Dec '03

This list is becoming completely unreadable! First the POISON PILL and now PGP IN FIDO just seem to go on and on. And how many before that? (Troglodyte mind-rapists, etc) I've got about a meg of utter crap in my email file, most of it unread or skimmed. If people want to fight, why not do it in private mail, back up your positions, and then post your conclusions if you manage to come up with any. Please don't CC all your flames to the list. And please don't echo a three-page post to add one line of comments to it. What happened to all the idealism? Total privacy, cryptophones, digital cash, zero-knowledge cooperation, bringing down governments and setting the world free? That's what the list is for, not mindless flaming. Aargggh! MikeIngle(a)delphi.com

1 0

POISON PILL WIMPS
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I've just about had it with posts like Matthew Gream's: . . . attempting to play 'smart-ass' to your investigators is only going to result in more problems for you. Its a non-ideal world, and they definitely have the ability to cause you substantial problems. . . . I feel it is essential to show them everything that they think is there, and convince them (as they will not be as competent in cryptographic analysis as yourself [at least you hope]) that there is nothing hidden. Didn't any of you appeasers and apologists read and *understand* HACKER CRACKDOWN? Once you are the focus of an investigation, they are already causing you substantial problems. Cooperation only gives your tormentors more ammunition. You are not going to convince them of anything. You cannot talk your way out of anything. What you can--and will--do is dig yourself in deeper. After that, you will probably try to get off the hook by rolling over--like a bitch in heat--on your friends and associates. The ONLY thing that works is (a) stonewall, stonewall, stonewall until you get competent legal representation, then (b) do what your lawyer's says. Period. Consider this your wimp wakeup call. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: TRAVELLER'S ADVISORY
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

At 3:48 PM 10/1/93 -0400, Sandy wrote: > >I think this is a real danger for outspoken Cypherpunks or other >high-profile individuals such as Phil Zimmermann. Unfortunately, >I don't have any bullet-proof solutions. Suggestions? > > S a n d y Speak softly and carry a big magnet?

1 0

Re: FIDOnet encryption (or lack thereof)
by Jim.Cannell＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In a msg on <Sep 30 12:15>, mnemonic(a)eff.org of 1:216/21 writes: m> From owner-cypherpunks(a)toad.com m> From: mnemonic(a)eff.org (Mike Godwin) m> To: mdiehl(a)triton.unm.edu (J. Michael Diehl) m> Date: Thu, 30 Sep 1993 11:45:09 -0400 (EDT) m> Cc: yerazunis(a)aidev.enet.dec.com, cypherpunks(a)toad.com m> Well, there's no doubt that users of his system can agree to m> allow the sysop to read their mail. But what about people m> whose mail passes *through* his system on the way to somewhere m> else? m> He has no agreement with them. FidoNet policy has a statement allowing monitoring of all intransit mail. I guess I'm going to have to dig my copy of Policy out of the archives to post the relevant paragraphs. This is a very shortsighted policy. Although financial restraints have curtailed my operations here making a lot of this moot, my own policy allows all users and passthru mail to be encrypted. I neither monitor nor censor. Jim PGP key 1024/72C6A7 fingerprint = F5 74 29 3D 9C F8 A7 32 C7 98 F1 FE C4 85 FA 70 Protect your right to privacy. Say no to Clipper/Skipjack and key escrow -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLK8tCZuaN9X1csanAQFh6QP/bcfC21gOOnBMAAKoGTVON7u7NEda9Nqr JtH1voGXQKArnRveoVffSTTlESjBC+yaBzi3t4Z1E37uELkd31r70M6OLIWDmw8o QLvZXtoQJgCTzyzHUlY+K94XW3QznHllMVx2oYVJ53tKPn/HmrjwIN5Ml0orBU70 vhek/pyCXnk= =f+Pj -----END PGP SIGNATURE----- -- =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= (Gated via FidoNet Node 1:1/31) Jim Cannell Internet: Jim.Cannell(a)f21.n216.z1.fidonet.org

3 3

fido encryption.
by Jim.Cannell＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In a msg on <Sep 30 06:18>, mdiehl(a)triton.unm.edu of 1:216/21 writes: m> Hi all! I just conducted an experiment whose results m> indicate how far we (Cypherpunks) have to go in educating the m> American Public WRT encryption technology: Agreed. There is a large education project ahead. m> I send an encrypted message via fidonet! (awk!) m> m> I had heard a rumor that fidonet forbade encrypted e-mail, m> but I had to find out for myself. Well, they do. Now I m> understand that these sysops are spending their own money and m> equipment to provide these services and have the right to m> regulate it in any way they see fit. That's not the point. This is _NOT_ true. There is no prohibition on encrypted messages within FidoNet. There is a large number of people within FidoNet that use wishful thinking to support such a ban. FidoNet policy states only that routing of encrypted traffic through a system that has not previously authorized such traffic is considered annoying behavior. Contrary to what many would have you believe, that is the _ONLY_ rule about encrypted traffic in FidoNet. m> The point(s) is/are: m> m> 1) They ACTIVELY enforce this policy. They don't simply say m> "no," they check (presumably) all of their user's email to m> enforce this policy. There is a great deal of paranoia within FidoNet about encryption. There are many who will not allow encrypted traffic on their systems. Of course, most of these have never heard of the term, steganography. I have a simple message that I like to send to these folks. Even though the hidden message is just reading down the first column, many people, especially those who claim they don't allow encrypted messages on their system, miss it. When PGP 2.0 first came out, I ran into these paranoids who said "There will never be any encryption on my system". I decided that an end run around these bozos was in order, so I created the SecureMail system. SecureMail is a group of FidoNet sysops who have agreed to route any and all mail through their systems without any form of censorshiop or monitoring. It now covers every part of the U.S., with some overseas links. I can post a list of those participating if you would like. Encrypted traffic now flows regularly through the SecureMail system. m> 2) They seem to be afraid to pass/store encrypted messages on m> their system. This indicates to me a lack of understanding of m> the concept of privacy. They seem to buy into the idea that m> "only BAD people encrypt email." I fully agree with this assesment. They do not understand that they cannot be responsible for a message that they cannot read. I continually run into the "What have I got to hide attitude". There are a number of us in FidoNet actively promoting privacy and the use of PGP. We are making slow and painful progress. m> We need to educate the electronic community before we can m> hope to educate the general public. The text of the messages m> follow with the names removed. BTW, the text of the plaintext m> message was "this is a test." Just thought you'd be m> interested. Comments? I can probably guess the names that you deleted. I get this type of message frequently. It's sad, but true that these people do need educating. Unfortunately, there are many with the closed minds so well demonstrated in the message that you posted. The primary internet/FidoNet gateway system (zeus.ieee.org) has agreed to pass encrypted traffic from FidoNet to the internet and vice versa. However, much of the internet/FidoNet traffic passes through other gateway systems which do not necessarily allow encrypted traffic. Even traffic that passes through zeus.ieee.org may be routed through FidoNet systems that don't allow encrypted traffic. The trick in passing encrypted traffic between the internet and FidoNet is in making sure that the routing sends it through a gateway system that allows encrypted traffic and provides a direct link into the SecureMail system. You can send mail to any FidoNet system by addressing the message to me at: Jim.Cannell(a)f21.n216.z1.fidonet.org Put a line at the beginning of the text identifying the ultimate addressee and his FidoNet address. Right now, I will have to manually process all such messages, but maybe if I get enough traffic, it will motivate me to write a remailer program. Then we can can have anonymous remailing within FidoNet as well. That really ought to set the paranoids off :-). There are others that will probably provide this service as well. I'll post their names as they give permission. By the time I received this message (I only get updates to this list three times a week), the discussion has been extensive. I have neither the time nor the desire to respond to everything on the thread. Rest assured that I have read it. Since it has stirred up so much controversy, I will introduce the topic in the approritate places in FidoNet. It needs exposure there. Since FidoNet systems are for the most part privately owned, it is there especially that privacy needs to be encouraged. Jim PGP key 1024/72C6A7 fingerprint = F5 74 29 3D 9C F8 A7 32 C7 98 F1 FE C4 85 FA 70 Protect your right to privacy. Say no to Clipper/Skipjack and key escrow -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLK8sq5uaN9X1csanAQFEHAP/U0L8SFiz7L1MgtmsTYP5utBp1/mXjq9k QT3th/KWZqKJ6wqrAt0q97/04EFdazYKGJqme63CTBzaTAonorOX4HJP6zT/56z9 +fGbK84uAL+ilgE5kxQ5OB0eY0MF6H/k0F7eBQk392nz9b9wecdhdmM70ozTTL1b FhvTXiIaBvg= =7tus -----END PGP SIGNATURE----- -- =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= (Gated via FidoNet Node 1:1/31) Jim Cannell Internet: Jim.Cannell(a)f21.n216.z1.fidonet.org

1 0

Internet SEcurity Scanner (ALERT)
by Anonymous 17 Dec '03

17 Dec '03

=========================================================================== CA-93:14 CERT Advisory September 30, 1993 Internet Security Scanner (ISS) --------------------------------------------------------------------------- The CERT Coordination Center has received information concerning software that allows automated scanning of TCP/IP networked computers for security vulnerabilities. This software was posted to the comp.sources.misc Usenet newsgroup. The software package, known as ISS or Internet Security Scanner, will interrogate all computers within a specified IP address range, determining the security posture of each with respect to several common system vulnerabilities. The software was designed as a security tool for system and network administrators. ISS does not attempt to gain access to a system being tested. However, given its wide distribution and ability to scan remote networks, CERT feels that it is likely ISS will also be used to locate vulnerable hosts for malicious reasons. While none of the vulnerabilities ISS checks for are new, their aggregation into a widely available automated tool represents a higher level of threat to networked machines. CERT has analyzed the operation of the program and strongly recommends that administrators take this opportunity to re-examine systems for the vulnerabilities described below. Detailed below are available security tools that may assist in the detection and prevention of malicious use of ISS. Finally, common symptoms of an ISS attack are outlined to allow detection of malicious use. Vulnerabilities probed by ISS ----------------------------- The following vulnerabilities are currently tested for by the ISS tool. Administrators should verify the state of their systems and perform corrective actions as indicated. Default Accounts The accounts "guest" and "bbs", if they exist, should have non-trivial passwords. If login access to these accounts is not needed, they should be removed, or disabled by placing a "*" in the password field and the string "/bin/false" in the shell field in /etc/passwd. See the system manual entry for "passwd(1)" for more information on changing passwords and disabling accounts. For example, the /etc/passwd entry for a disabled guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false lp Account The account "lp", if it exists, should not allow logins. It should be disabled by placing a "*" in the password field and the string "/bin/false" in the shell field in /etc/passwd. Decode Alias Mail aliases for decode and uudecode should be disabled on UNIX systems. If the file /etc/aliases contains entries for these programs, they should be removed, or disabled by placing a "#" at the beginning of the line and then executing the command "newaliases". Consult the manual page for "aliases(1)" for more information on UNIX mail aliases. A disabled decode alias should appear as follows: # decode: "|/usr/bin/uudecode" Sendmail The sendmail commands "wiz" and "debug" should be disabled. This may be verified by executing the following commands: % telnet <hostname> 25 220 host Sendmail 5.65 ready at Wed, 29 Sep 93 20:28:46 EDT wiz You wascal wabbit! Wandering wizards won't win! (or 500 Command unrecognized) quit % telnet <hostname> 25 220 host Sendmail 5.65 ready at Wed, 29 Sep 93 20:28:46 EDT debug 500 Command unrecognized quit If the "wiz" command returns "Please pass, oh mighty wizard", your system is vulnerable to attack. The command should be disabled by adding the following line to the sendmail.cf configuration file containing the string: OW* For this change to take effect, kill the sendmail process, refreeze the sendmail.cf file, and restart the sendmail process. If the "debug" command responds with the string "200 Debug set", you should immediately obtain a newer version of sendmail software from your vendor. Anonymous FTP Anonymous FTP allows users without accounts to have restricted access to certain directories on the system. The availability of anonymous FTP on a given system may be determined by executing the following commands: % ftp hostname Connected to hostname. 220 host FTP server ready. Name (localhost:jdoe): anonymous 530 User anonymous unknown. Login failed. The above results indicate that anonymous FTP is not enabled. If the system instead replies with the string "331 Guest login ok" and then prompts for a password, anonymous FTP access is enabled. The configuration of systems allowing anonymous FTP should be checked carefully, as improperly configured FTP servers are frequently attacked. Refer to CERT Advisory CA-93:10 for more information. NIS ISS attempts to guess the NIS domainname. The program will try to grab the password file from ypserv. See CERT Advisory CA-92:13 for more information regarding SunOS 4.x machines using NIS. See CERT Advisory CA-93:01 for more information regarding HP machines using NIS. NFS Filesystems exported under NFS should be mountable only by a restricted set of hosts. The UNIX "showmount" command will display the filesystems currently exported by a given host: % /usr/etc/showmount -e hostname export list for hostname: /usr hosta:hostb:hostc /usr/local (everyone) The above output indicates that this NFS server is exporting two partitions: /usr, which can be mounted by hosta, hostb, and hostc; and /usr/local which can be mounted by anyone. In this case, access to the /usr/local partition should be restricted. Consult the system manual entry for "exports(5)" or "NFS(4P)" for more information. rusers The UNIX rusers command displays information about accounts currently active on a remote system. This may provide an attacker with account names or other information useful in mounting an attack. To check for the availability of rusers information on a particular machine, execute the following command: % rusers -l hostname hostname: RPC: Program not registered If the above example had instead generated a list of user names and login information, a rusers server is running on the host. The server may be disabled by placing a "#" at the beginning of the appropriate line in the file /etc/inetd.conf and then sending the SIGHUP signal to the inetd process. For example, a disabled rusers entry might appear as follows: #rusersd/2 dgram rpc/udp wait root /usr/etc/rusersd rusersd rexd The UNIX remote execution server rexd provides only minimal authentication and is easily subverted. It should be disabled by placing a "#" at the beginning of the rexd line in the file /etc/inetd.conf and then sending the SIGHUP signal to the inetd process. The disabled entry should resemble the following: #rexd/1 stream rpc/tcp wait root /usr/etc/rexd rexd See CERT Advisory CA-92:05 for more information regarding IBM AIX machines using rexd. Available Tools --------------- There are several available security tools that may be used to prevent or detect malicious use of ISS. They include the following: COPS The COPS security tool will also detect the vulnerabilities described above. It is available via anonymous FTP from cert.org in the directory /pub/tools/cops/1.04. ISS Running ISS on your systems will provide you with the same information an attacker would obtain, allowing you to correct vulnerabilities before they can be exploited. Note that the current version of the software is known to function poorly on some operating systems. ISS may be obtained via anonymous FTP from ftp.uu.net in the directory /usenet/comp.sources.misc/volume39/iss. TCP Wrappers Access to most UNIX network services can be more closely controlled using software known as a TCP wrapper. The wrapper provides additional access control and flexible logging features that may assist in both the prevention and detection of network attacks. This software is available via anonymous FTP from cert.org in the directory pub/tools/tcp_wrappers. Detecting an ISS Attack ----------------------- Given the wide distribution of the ISS tool, CERT feels that remote attacks are likely to occur. Such attacks can cause system warnings to be generated that may prove useful in tracking down the source of the attack. The most probable indicator of an ISS attack is a mail message sent to "postmaster" on a scanned system similar to the following: From: Mailer-Daemon@hostname (Mail Delivery Subsystem) Subject: Returned mail: Unable to deliver mail Message-Id: <9309291633.AB04591@> To: Postmaster@hostname ----- Transcript of session follows ----- <<< VRFY guest 550 guest... User unknown <<< VRFY decode 550 decode... User unknown <<< VRFY bbs 550 bbs... User unknown <<< VRFY lp 550 lp... User unknown <<< VRFY uudecode 550 uudecode... User unknown <<< wiz 500 Command unrecognized <<< debug 500 Command unrecognized 421 Lost input channel to remote.machine ----- No message was collected ----- --------------------------------------------------------------------------- The CERT Coordination Center would like to thank Steve Weeber from the Department of Energy's CIAC Team for his contribution to this advisory. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.org Telephone: 412-268-7090 (24-hour hotline) CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous FTP from cert.org (192.88.209.5).

1 0

Austin Cypherpunks organizational meeting
by mccoy＠binky.cc.utexas.edu 17 Dec '03

17 Dec '03

Digital Freedom: By any means necessary. Austin Cypherpunks Meeting October 9, 1993 1:00 pm Taylor Hall 2.006 -- UT Campus (24th and Speedway) The Austin Cypherpunks chapter will be holding its first local meeting on Saturday the 9th of October at 1:00 pm in room 2.006 of Taylor Hall (UT Campus). This will be an organizational meeting for the local chapter and will give you an opportunity to meet other cypherpunks from the Austin area. For the first time, information technology is giving people the opportunity for more privacy instead of less. For instance, we will have digital money soon; will it be used to track you every time you spend, or will it give you more security and convenience than a credit card with the anonymity of cash? Both are possible outcomes, but you will only keep your privacy if people get together and take action. Please join us, either in person or through our mailing lists, and help work towards a future where your privacy is guaranteed, not just legally, but by the best encryption and authentication tools available. Some of the items on the agenda for this first meeting include: -Education Hands-on demonstration of encryption tools and anonymous remailers; we will be distributing PGP (bring your disks!) and handing out information about the infamous "Clipper Chip". We should also have the latest information on the subpoenas served on various distributors of cryptographic software. -Political action Strong tools for privacy are perceived by most governments as a threat; cypherpunks have joined the fight against government attempts to restrict or ban encrypted communications, as well as the now-useless export ban on effective cryptographic software. -Public Key Exchange. Swap public keys with other members. We will have Macs and PCs on hand for you to sign and exchange public keys with other cypherpunks members. -Digital Credit Union Project Local cypherpunks are already working on forming a new credit union which will provide secure banking and commerce across the net using strong cryptography. [Location Instructions: Go to Taylor Hall on the UT campus. This building is at 24th and Speedway. The directions to room 2.006 are a little complicated for words, but a map will be posted on all of the doors to Taylor hall.] To subscribe to our full mailing list, send mail to: austin-cypherpunks-request(a)bongo.cc.utexas.edu To subscribe to our announcement-only mailing list, send mail to: austin-cypherpunks-announce-request(a)bongo.cc.utexas.edu Put the word 'subscribe' in the subject of your mail. Our file archives are available in /pub/cypherpunks via anonymous ftp at: ftp.cc.utexas.edu The Austin Cypherpunks chapter will continue to meet on the second saturday of each month in conjunction with local cypherpunk chapters across the country. The location of future meetings will be announced on local newsgroups and the local cypherpunks mailing list. Cypherpunks: There is safety in numbers... large primes. Local contacts for your questions...: Jim McCoy <mccoy(a)bongo.cc.utexas.edu> Doug Barnes <barnes(a)io.com>

1 0

The right to remain silent
by lex＠mindvox.phantom.com 17 Dec '03

17 Dec '03

Quoting a previous message: >Date: 03 Oct 93 14:42:57 EDT >From: Sandy <72114.1712(a)CompuServe.COM> >To: <cypherpunks(a)toad.com> >Subject: POISON PILL WIMPS > >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT Reply to: ssandfort(a)attmail.com > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >Punksters, > >I've just about had it with posts like Matthew Gream's: > > . . . attempting to play 'smart-ass' to your > investigators is only going to result in more problems > for you. Its a non-ideal world, and they definitely have > the ability to cause you substantial problems. > > . . . I feel it is essential to show them everything > that they think is there, and convince them (as they > will not be as competent in cryptographic analysis as > yourself [at least you hope]) that there is nothing > hidden. > >Didn't any of you appeasers and apologists read and *understand* >HACKER CRACKDOWN? Once you are the focus of an investigation, >they are already causing you substantial problems. Cooperation >only gives your tormentors more ammunition. You are not going >to convince them of anything. You cannot talk your way out of >anything. What you can--and will--do is dig yourself in deeper. >After that, you will probably try to get off the hook by rolling >over--like a bitch in heat--on your friends and associates. > >The ONLY thing that works is (a) stonewall, stonewall, stonewall >until you get competent legal representation, then (b) do what >your lawyer's says. Period. > >Consider this your wimp wakeup call. > > S a n d y >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A wise mindvox user said recently on the round-table forum: "If you have nothing to hide and did nothing wrong then you have absolutely nothing to lose by keeping quiet" Having seen many a hacker (and non-hacker) get into trouble over the years, I'd have to say that Sandy's assesment is correct in the majority of cases. as for "rolling over--like a bitch in heat-- on your friends and associates" this too I have seen all too often and many times to little benefit to the rat who is talking. Dragging other people down with you serves little purpose IMHO and is a particularly dispicable and all too common trend among hackers of recent years. oh and sandy, I did read the Hacker Crackdown :-) Let me quote a second recent post: >Date: Sun, 03 Oct 1993 15:51:55 -0400 (EDT) >From: Mike Ingle <MIKEINGLE(a)delphi.com> >Subject: Excessive Crap & Flamage >To: cypherpunks(a)toad.com > >This list is becoming completely unreadable! First the POISON PILL and now >PGP IN FIDO just seem to go on and on. And how many before that? >(Troglodyte mind-rapists, etc) I've got about a meg of utter crap in my >email file, most of it unread or skimmed. If people want to fight, why not >do it in private mail, back up your positions, and then post your >conclusions if you manage to come up with any. Please don't CC all your >flames to the list. And please don't echo a three-page post to add one >line of comments to it. > >What happened to all the idealism? Total privacy, cryptophones, digital >cash, zero-knowledge cooperation, bringing down governments and setting the >world free? That's what the list is for, not mindless flaming. > >Aargggh! MikeIngle(a)delphi.com > although no one is asking me, I'll admit that perhaps this message itself is guilty of the above. And I am on the verge of unsubscribing after a couple of months being on the list because the daily time requirement to keep on top of the messages is exceeding an hour. Perhaps splintering the list into the following 2 main areas is an option: 1) A fairly lean-bandwidth list containing technical facts, news articles, bibliographic info, short source code, etc. 2) A more fluffy-content list containing general comments, opinions, flames, etc. Subscription to list 2 would probably necessitate subscription to list 1. But for those who want the meat without the potatoes, subscription to list 1 is all that would be required. I recall this coming up about a month and a half ago, more calls for keeping the messages "pertinent" to the cypherpunk agenda. The problem has only grown worse. Lex

2 1

How do I subscribe to the cypherpunks list, or join the group?
by christophe m johnson 17 Dec '03

17 Dec '03

1 0

CuD forward
by fergp＠sytex.com 17 Dec '03

17 Dec '03

excerpted from: >Date: Sun, 3 Oct 1993 16:49:01 CDT >From: Cu-Digest <uunet!CMUVM.CSV.CMICH.EDU!tk0jut2%mvs.cso.niu.edu> >Subject: Cu Digest, #5.77 - --- Date: Fri, 1 Oct 93 06:55:38 -0700 From: grady(a)NETCOM.COM(Grady Ward) Subject: File 1--Grady Ward DOES NOT Encourage Illegality Jerry Leichter's <leichter(a)LRW.COM> comments about me in CuD, Volume 5, Issue 76 are flatly wrong. I do not and never have encouraged people to copy or use PGP illegally whatever their jurisdiction. In this country they ought not to "make, use, or sell" RSA without a license from PK Partners of Sunnyvale, CA. Similarly, the IDEA cipher ought not to be used commercially without a specific commercial license from Ascom-Tech AG of Switzerland. If they are non North American nationals then they need to obtain a copy of PGP from one of several foreign sites such as: black.ox.ac.uk (129.67.1.165) ghost.dsi.unimi.it (149.132.2.1) nic.funet.fi (128.214.6.100) Depending, of course, on their local laws. I have been assured by two attorneys that source is NOT an infringing "device" and can be copied or studied as long as its distribution is not simply a ploy to evade patent law. The whole constitutional idea of a patent centers on the wide dissemination of the underlying ideas that can be reduced to practice by a "person of ordinary skill" in the field. Disseminating the ideas underlying a patent is explicitly a patriotic act in the United States. In any event individuals become moral creatures by actively making their own personal choices and not having the ideas that could lead to an informed choice restricted by the State. I support the widespread use of strong crypto in the world for two reasons: It assists physically separate individuals to freely exchange ideas in greater safety from State interference. And it preferentially helps less powerful people since the more powerful dominating group can simply use the raw force of its state apparatus to advance its program. It is an equalizer in the quest for coalition and social justice. Strong crypto creates communities, not conspiracies. ------------------------------ Date: Thu, 30 Sep 93 17:49:12 -0600 From: "L. Detweiler" <ld231782(a)LONGS.LANCE.COLOSTATE.EDU> Subject: File 2--Response to Jerry Leichter in re Moby Crypto Editor: I strongly object to comments by Jerry Leichter <leichter(a)LRW.COM> on the PGP subpoenas in CuD, Volume 5 : Issue 76. Mr. Leichter appears to be making contradictory points: even though the ITAR may be casting FUD and chilling people's actions based on `poorly drafted regulations whose coverage no one can determine, by threats and insinuations from government spokesmen that some action is illegal', he on the other hand admonishes G. Ward for his actions to date in challenging the law. "Ward is deliberately flaunting it. Stupid, dangerous idea. Being a revolutionary, putting yourself in direct opposition to the power of the state, isn't fun and games. People get hurt that way." Mr. Leichter does not appear to realize that the most egregious laws created tend only to be overturned by the most dramatic challenges. Our own American Revolution is a dramatic instance of this fact. I have praised G. Ward in email previously as a compelling cyberspatial hero for his actions in publicizing over Usenet the NSA and State Department molestations he has been subject to over the past weeks. Very dramatic constitutional issues are at stake. Another major reality lapse in Mr. Leichter's somewhat desultory argument (that appears to have the fundamental message of minimizing the significance of the Zimmermann-Ward affair) is the following. Citizens in a society do not live by the laws -- they live by the *effect* of those laws on their everyday life. Some laws are widely ignored, such as speed limits. Some are revered with the utmost respect, such as the rulings of the Supreme Court and the directives of the President. Even if no case had ever been brought to court on the ITAR, the fundamental issue is that the law has an extraordinary dampening force on certain aspects of current cyberspatial development and enterprise -- in particular, cryptographic technology intrinsic to a wide variety of transforming technologies such as digital cash and signatures -- all critical to future progress. An analogy might be this: even though our judicial system has evolved an elaborate protocol for granting search warrants, that system is meaningless if people voluntarily allow police to search their homes. We do *not* live in a world described by government laws, we live in one that interacts with them in sometimes unpredictable ways. Now, let me abandon these vague platitudes immediately for some cutting specifics relevant to this case. What is the effect on the ITAR on *domestic* cryptographic development? The ITAR supposedly only deals with import and export and in fact that is all the authority granted by its enabling law, the Arms Export Control Act, to cover. But the use of the ITAR in practice by government bureaucrats is apparently to stifle free speech and free press rights of domestic U.S. citizens. This situation is transparently clear from Grady Ward's wretched predicament and other noxious affairs that have escaped the focused attention of many. In particular, I would like to draw attention to an outstanding effort by D. Bernstein to demonstrate the sheer oppressive force of the ITAR as interpreted by the relevant U.S. agencies. In the anonymous FTP file ripem.msu.edu:/pub/crypt/docs/shuffle-export-hassles. is an extraordinary compilation of letters sent between D. Bernstein and the Bureau of Politico-Military affairs regarding the ITAR rules. Mr. Bernstein sought permission to *post* a simple message to the Usenet group sci.crypt describing a cryptographic technique. The sheer obstruction he encountered is absolutely appalling. It approaches the grotesque torture of a totalitarian society in suppressing information. He required the intervention of his California state representative merely to get simple mail responses from the asphyxiating bureaucracy! Moreover, the exchange demonstrates very clearly that the government *applies* the ITAR not as a law regarding import and export of material (as the *law* constrains it) but *in practice* as an instrument to stifle otherwise lawful 1st Amendment scientific publication. From a letter of 14 July 1993 to A. A. Henderson: >Please note that the State Department is engaging in >unconstitutional censorship of material which I privately >developed and which I wish to publish. What you are >witnessing is a battle over the First Amendment. I believe >that the [Office of Defense Trade Controls, Bureau of >Politico-Military Affairs] is acting in violation of the >Bill of Rights. [They] failed to answer this question: >"Does ITAR exert prior restraint on otherwise lawful >publication"? In these paragraphs I seek to emphasize that the debate goes far deeper than the mere obnoxious classification of widespread, public-domain cryptgraphic algorithms and techniques as `munitions'. The debate surrounding the ITAR cuts to the core of many democratic issues. The ITAR is updated with alarming frequency and changed with disturbing ease. Its revision seems to occur in complete defiance of a regular and open legislative process. Even top *experts* on the law cannot keep up with all the modifications. As a frightening example of this, take the case of U.S. vs. Martinez, where Elizabeth Martinez and her fiance were convicted of violating the Arms Export Control Act by exporting `cryptographic hardware' -- a satellite TV video descrambling device, `Videocipher II'. Apparently, by some magic bureaucratic whim, it is now *legal* to export such equipment under the ITAR! I doubt Mrs. Martinez is consoled by this news, after being consumed and rebuffed even on appeal. I consider the ITAR one of the most totalitarian documents our government has ever produced. G. Ward and P. Zimmerman are modern cyberspatial heroes for their bold, direct challenges of it. In classifying `disclosure of information to foreign nationals' as *export* we find the same institutional paranoia and cyberspatial ignorance seen in the Cold-War era Soviet Union in e.g. restricting Xerox machines. The irony is that in both cases, the paranoia is entirely justified, even necessary, within the context of preserving the illegitimate status quo. This oppression forms the basic foundation of support for the two most totalitarian systems of the 20th century -- one defunct, the other with the initials N.S.A. ------------------------------ Paul Ferguson | privacy \'pri-va-see\ n, pl, -cies; Mindbank Consulting Group | 1: the quality or state of being apart Fairfax, Virginia USA | from others 2: secrecy fergp(a)sytex.com | ferguson(a)icp.net | Privacy -- Use it or lose it.

1 0