December 2003 - cypherpunks-legacy

pgp in the weirdest places!
by abootch＠sfsuvax1.sfsu.edu 17 Dec '03

17 Dec '03

Hello out there - A friend of mine recently bought a computer and I've spent the past couple days with him setting it up and stuff. Anyways, I've come across some interesting stuff in his fax/modem software. In converting a word processing text into a format the fax recognizes, I got a weird file that seemed to be encrypted in pgp or something - I'm not sure since I haven't seen pgp run on dos. That was no big deal but when I scanned through the converted text I found various messages about pgp. Some of it was obviously from the readme files but there was some other stuff about some other Hughes guy (btw, I'm a newbie, so...) that wasn't Eric. I'm not that familiar with pc so I couldn't really help him so I'm calling on you guys. The software is called "Quick Link II" It claims to be the "Next Generation in Communication Software" and seemingly so. Its from Smith Micro Software Inc. and its being run on yer average 486 sx20. I'll post the converted texts if there's interest but in the meanwhile I am highly confused! --

1 0

Re: trusting software
by doug＠netcom.com 17 Dec '03

17 Dec '03

ogr(a)wyvern.wyvern.com (Jason Plank) said: >Penned by Doug Merritt: >> Furthermore, even close reading won't absolutely *guarantee* the lack of >> backdoors in all cases, even if the reader is an expert on relevant >> subjects. > > Why not? Read *every* line of code and the spaces in between two or >three times. Surely. A certain percentage of people will. A certain percentage of people lack the expertise to do so. That was my primary point. My secondary point is that even those who *do* may not detect the presence of a backdoor. The decade-and-a-half controversy over whether DES has a backdoor, despite the fact that the alogorithm is public, is an example of this. The eventual answer to the question is less important than the period of debate...think about it. Reading source code is never a guarantee; it is only a *statistically* safe measure. Worse yet, the statistical issues tend to be hard to analyze, and in no case does one attain a 100% confidence. This is a limited response to a limited question; I'm aware that there are a million other issues as well. Doug

1 0

`the Dinkelacker matter'
by L. Detweiler 17 Dec '03

17 Dec '03

Many people appear to have me confused with `S.Boxx'. I assure you, we are two unique identities. Anyway, this all appears to have resulted partly from H.Finney's posting a while back asking for help in relieving me of my `mental anguish' and `mental suffering' as a `personal favor' to bring me `piece of mind.' >Larry believes that people have been communicating with him in private >mail under multiple identities in order to confuse and mislead him. >Specifically, he has suggested that Jamie Dinkelacker is a pseudonym >employed by Tim May. I gather that he has received email from both >names. He also suggests that others have employed these practices. I'm not really sure where Mr. Finney got this impression -- perhaps from private mail we traded. I definitely had some doubts about the `Dinkelacker matter', partly in consideration of the (admittedly bizarre) `S.Boxx' postings, as I stated publicly in response to his post. But I (L. Detweiler!) haven't ever publicly accused Mr. Dinkelacker of being anyone other than Mr. Dinkelacker, that I remember! Anyway, an eminent cypherpunk was kind enough to clear up this misunderstanding to me in email. I asked him to post to the list or to sci.crypt, but to my knowledge it has not made it to either place so far. Since this is an important matter and may have caused some other cypherpunks some confusion, here is the *unequivocal* assurance that Dinkelacker exists independent of T.C.May, and that the latter has never posted under the identity of the former! (esp. given the eminent reputation of this kind soul who has reassured me.) I really appreciate this effort to help me in my own doubts, but also let me assure everyone that (contrary to the person's suggestions) I am not `clinging to a paranoid fantasy, adding layers of elaboration, and as more evidence comes forward just adding layers upon layers,' `afraid of the truth', `afraid to face the possibility you are wrong' As far as all this pseudospoofing, it is something I would rather not worry about, and I'm very hopeful that J. Helsingius will start a new list where it is at least discouraged. I would like to see a new taboo against it arise with the strength of those currently against network censorship. In some quarters of the internet, the taboo against pseudospoofing is actually there. Unfortunately, quite the opposite is the case here, and it has indeed caused me some unpleasant and unsettling doubts I would not even wish on my enemies. A new list would certainly solve a lot of problems! >I have to say that it's sad >to see you screwing yourself up like this. I hope you can get straight. I really appreciate this person's concern and compassion, but even if Mr. Dinkelacker was a snake of Medusa or a tentacle of a monster, I certainly would not waste much time in `screwing myself up' over it. As for my `reluctance to call Mr. May or Mr. Dinkelacker yourself' is not due less to blind obstinacy than blase disinterist! (Although I'm not sure how this person knew I hadn't called either -- but that's just my paranoia speaking! <g>) Actually, Mr. May sent me mail stating that the assertion that he had ever posted under J. Dinkelacker, jamie(a)netcom.com, was `too bizarre to be believed', and I believe him. I wasn't quite sure what he meant about his actual pseudospoofing experience, though, and that's not really my business to comment on (I asked him to post an unequivocal statement to the list, beyond his initial satire, given the importance of the matter, which I have apparently missed). (following slightly edited to preserve anonymity) ===cut=here=== Date: Tue, 26 Oct 93 09:49:42 PDT From: [...] To: ld231782(a)longs.lance.colostate.edu Subject: Dinkelacker Lance - For what it's worth, I called Jamie Dinkelacker on the phone yesterday. He seemed to be a real person. I had met Tim May a year or two ago (and BTW, Tim looks just like his picture in Wired), and Dinkelacker 's voice seemed different from Tim's. Tim had a deep voice (he's a big guy) while Dinkelacker's was higher pitched. We talked for about twenty minutes, and I was convinced that he was who he claimed. He is the former VP of Marketing for AMix, the American Information Exchange, a spin-off from Autodesk (the CAD company) which I think went out of business last year (maybe they're still around). You might be able to find some articles about AMiX from last year or the year before and they might mention him. Dinkelacker is active in nanotechnology circles there in the Bay area. That is how he met Tim. He has never been to a CP meeting. He mentioned a couple of people who knew them both: Nick Szabo, who confirmed this to me in email, and also Max More, whom I know personally. Max is a grad student at USC, where my [...] goes to school. He is the founder of thee Extropian movement, and publishes a twice-yearly journal called Extropy. Max is a really nice guy, soft-spoken and friendly. He is originally from Ireland. If you'd like his phone number, let me know. This is about all I can offer you in terms of evidence for Dinkelacker's independent existence. It's up to you now. You can cling to this paranoid fantasy, adding layers of elaboration, saying that I must be a false identity, Nick must be, this Max More must be (but then, who publishes Extropy? You can get back issues going back three years!), and as more evidence comes forward you just add layers upon layers. Or you can say to yourself, do I really have any basis for believing that people are trying to mislead me in this way? Who is my best candidate for being a fake persona? Let's investigate that one in detail. Let's face the truth. If you're afraid of the truth, you're never going to find your way out of fantasy. Your reluctance to call Tim May and Jamie Dinkelacker directly suggests to me that you don't really want to face the possibility that you are wrong. That's your decision to make, but I have to say that it's sad to see you screwing yourself up like this. I hope you can get straight.

1 0

unsub
by Cdt Pvt Dan Doughty 17 Dec '03

17 Dec '03

I've tried to normal unsub. It didn't work. Can someone please take me off? Thanks and sorry this had to go out.

2 1

HE'S BACK!
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, It's nice to see that Detweiler is back on his medications. Let's hope he stays with the program. I have no doubt he is telling the truth when he says he and S.Boxx "are two unique identities." Yes Lance, but are they the same person? I don't think any Cypherpunk will have any objections to his voluntary name certification schemes. On the other hand, most Cypherpunks would probably consider it their *civic duty* to attempt to discover the weaknesses in such protocols. This is called "destructive testing" in industry, and is a time honored technique. Lance, you will be a better writer, and will be taken much more seriously if you, (a) tone down the purple prose, and (b) learn some verbal economy. You write far too much, and say far too little. Repetition is not a substitute for argumentation. S a n d y (who is really just himself) S a n d f o r t >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

(fwd) ViaCrypt PGP ships today
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I realize that this is a few days old, but I've been up to my eye-teeth with other network problems and using this dreary Saturday afternoon to catch up on Net News. Cheers. Forwarded message: > Newsgroups: alt.security > From: hugh(a)gargoyle.uchicago.edu (Hugh Miller) > Subject: ViaCrypt PGP ships today > Message-ID: <hugh.752165605@gargoyle> > Sender: news(a)uchinews.uchicago.edu (News System) > Organization: University of Chicago -- Academic & Public Computing > Date: Mon, 1 Nov 1993 14:53:25 GMT > Lines: 61 > > ViaCrypt, Inc., will begin shipping ViaCrypt PGP today, 1 November > 1993. ViaCrypt PGP is a commercial public-key encryption package which is > based on, and virtually identical with, the freeware program known as PGP, > or `Pretty Good Privacy.' (The source code is in fact identical to that of > the freeware version 2.3a of PGP, with the exception of the RSA encryption > module, which is one ViaCrypt developed in-house after acquiring a license > for the algorithm from PKPartners. In addition, ViaCrypt incorporates a > few bug fixes. The private-key crypto algorithm is IDEA, as in freeware > PGP, for which ViaCrypt has obtained a license from Ascom-Tech AG of Zurich.) > ViaCrypt bought its RSA license from PKP before either PKP or ViaCrypt knew > that ViaCrypt would someday use it to sell PGP. ViaCrypt later acquired > the rights to sell PGP from Phil Zimmermann. I don't know what PKP thinks > of this state of affairs, but ViaCrypt's PKP license clearly allows them > to sell PGP. > > Output is byte-for-byte identical with that of freeware PGP 2.3a, except > that the `Version' header atop the message body reads "Version: 2.4" > instead of "Version: 2.3a". Keys, signature certificates, binary or > ASCII-armored ciphertexts, produced by one program will be identical to, > and transparently handled by, the other. ViaCrypt PGP will (for now) be > available in the US and Canada only, pending any future relaxation of the > ITAR export control laws. Phil Zimmermann says no compromises in the > cryptographic strength of PGP were made for ViaCrypt's version of PGP. > > The ViaCrypt PGP package include program disks (executables only, no > source code), user manual, and individual user license. The current release > will be for MS-DOS only; ViaCrypt plans to ship a UNIX version soon. > Introductory price of a single user package is US$100. (For purchases > of 20 units or more, a substantial discount -- price drops to about US$41 > per user -- is available.) > > To purchase ViaCrypt PGP or to find out more about it, you can contact > them as follows: > > ViaCrypt > 2104 W. Peoria Ave. > Phoenix, AZ 85029 USA > 602-944-0773 (Voice) > 602-943-2601 (FAX) > 70304.41(a)compuserve.com (Netmail) > > I have no connection with ViaCrypt, commercial or otherwise. Indeed, I > disagree in principle with the concept of algorithm patents. I think, > though, that the net, and particularly users and admirers of the freeware > PGP deserve to hear about this. Because ViaCrypt paid PKP for a > license, users of ViaCrypt can now utilize PGP with absolutely no fear of > lawsuit for patent infringement. Since ViaCrypt will ship only in > USA/Canada, ITAR violations are not at issue. This will enable the > PGP approach, with its decentralized distributed-trust key management, > to achieve crucial penetration into the corporate marketplace. > This will speed its acceptance as the de facto email crypto standard, > as opposed to other centralized or key-escrow schemes, like PEM or Clipper. > And ViaCrypt PGP will enable U.S. users to communicate completely legally > with non-U.S. users of PGP 2.3a. > > -- > > Hugh Miller | Asst. Prof. of Philosophy | Loyola University Chicago > FAX: 312-508-2292 | Voice: 312-508-2727 | hmiller(a)lucpul.it.luc.edu > PGP 2.3A Key fingerprint: FF 67 57 CC 0C 91 12 7D 89 21 C7 12 F7 CF C5 7E > > _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

name for hardware list...
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hey, y'all... The response to the proposal for the punk hardware list was overwhelming (or at least far beyond expectations). I will get it set up hopefully on Monday, or Tuesday at the latest of next week. I just have to get my sysadmin to get moving and set of the list on the ListProcessor. There is a minor problem, which I want to spend very little time worrying about, concerning the name of the list. All I've come up with is the boring "punk hardware" or "punkware", or the cryptic "punk-net." The punk-net name derives from the discussion of an underground, wireless net (which got me interested in forming the list) but I think that discussion about that net will probably be a minor part of the list. Perhaps we should get away from the "punk*" naming scheme-- I don't know. Let me know what you think it should be called... I'll determine the name by a psuedo-democratic process (I'll use the name that's proposed the most, unless I think there's a better one.). So, let me know what you think it should be called, but let me know soon-- when it's on-line I'll post info on how to subscribe. rave on, - -john. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNvls6NqtARNqVmxAQG+0wIAnFlvkuRAVgkZyL7osC3S0lTqk44eMldI /fpawVKB/gsa1s3EMbXbL73XYH5u4chuNav84ZLobpqLJjfECO38FA== =JrAe -----END PGP SIGNATURE-----

1 0

some newbie DC-net questions
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thank you Jim. I have been wondering about these questions myself. Especially #4. Anybody? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNwc9R1kTJuroDD9AQEfTQIAoHVnZUc0GR10KJxmymw5Bj/3no2SXjY+ WH6AdS6SEU/KGgD+AkR+VbJFHtD0VyFCCTwUERqiG0x1u2LAlKxZdQ== =Zb+C -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

some newbie DC-net questions
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I'm a newcommer to DC-nets, so the following questions may sound funny to somebody that actually knows DC-nets... 1) What is happening on a DC-net when nobody is sending a message? Is it simply issuing a stream of zeros? Are "coins" being continuously flipped, even when no messages are being sent? 2) What does it look like (from a traffic flow perspective) when the DC-net transitions from no messages being sent to a message being sent? The stream of zeros becomes and bunch of ones-and-zeros? 3) What happens when two members of a "table" attempt to transmit at the same time? How is this case handled? 4) Are there any DC-net papers available for downloading via FTP? Thanks, Jim_Miller(a)suite.com

2 1

Blacknet in WIRED
by plaz＠netcom.com 17 Dec '03

17 Dec '03

Did everyone catch the Blacknet reference in WIRED 1.5? P.32 in the central item. Check it out! _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "We are the shock troops of reality." - Voice of the Friends (Wild Palms)

1 0