December 2003 - cypherpunks-legacy

<none specified>
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn writes: > The modular PGP project has been out there for almost a year. Any > progress on this front? Does anyone care? I percieve a 'chilling effect' going on with PGP compatible application development. Nobody wants to extract the core PGP code into a library because the code is dense and who wants to do that every update? Likewise with using PGPTools. Who wants to re write their application when the official PGP library materializes? So people are waiting... Could we get some updates on what is happening with the official pgp development? If it's not coming soon, or not at all, it would be nice to know so we can get going on improving PGPTools or writing our own. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu9MqioZzwIn1bdtAQGUpgGAoyg9xD7355aypqebsUwrQdS8rfPH4Oiz NxrVnNp5L247pZRftliqdwO8Sh0OzgTZ =B8B5 -----END PGP SIGNATURE-----

2 1

Re: News->Mail & CMU's Andrew Message System
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Big Lama wrote; >A, B, C and D and E and AMS and AFS and DCE and DFS and IPC and RPC >and MDA and STP and LSD and THC... >...and amphetamine. > >Big Lama (remembering an old hit, from the Flower Power period) "The Alphabet Song" by "David Peel and the Lower East Side." -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: PGP 2.7
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

--> I keep seeing pgp 2.7 in public key & sig blocks. --> Where do we get it? 2.7 is a ViaCrypt product which you have to pay royalties for, and last I heard they didn't include sources with their distribution. Anybody know if they've started sending the sources with the executables?? Here's their addresses and tel #'s: Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41

1 0

Re: Clarification of my remarks about Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412140047.QAA17489(a)jobe.shell.portal.com>, you write: > -----BEGIN PGP SIGNED MESSAGE----- > > "Amanda Walker" <amanda(a)intercon.com> writes, quoting someone from > Netscape: > > >> I didn't bother imbedding the RSA Unaffiliated User CA because I > >> didn't think server operators would use it to get certificates. > > >Well, it's what Apple is using for PowerTalk signers (which are a key pair and > >X.509 certificates, by default from the Unaffiliated User PCA). It makes > >sense for personal (as opposed to organizational) servers, such as someone > >running MacHTTP for their home page... > > >On the other hand, if RSA has set up a server PCA, that should be suffcient > >for now. I wonder what the certification policy is, though--how do you prove > >that you control a given server? For an Unaffiliated User CA certificate, you > >just have to show a notarized application and two forms of ID, one with a > >photo (driver's license, passport, etc.). I can't off hand think of an > >equivalently strong way to ID control of a server... > > This relates to the other part of my question, which didn't get answered: > what is the relationship between the name found in the X.509 certificate > and the server? Does X.509 include an internet address like mcom.com, > and the Netscape client checks that this matches the address of the > server it is connecting to? I am not very familiar with the certificate > format but I had the impression that it used a very different naming > scheme. > > Or does the client accept any valid certificate without regard to the > connection if any between the name in the certificate and the server to > which it is connected? This whole area was left undefined in the SSL > spec but will be important for interoperability. > > Hal > > -----BEGIN PGP SIGNATURE----- > Version: 2.6 > > iQBVAwUBLu5AkhnMLJtOy9MBAQEFQgH/dmiiEjycULNdDCNiU8SkoB57bHv9W5Lc > d+K7cBqq0ZknCwXtqZtbPTR7d8F1z0WFbMlP6QF3zywVz2GrDIg5kg== > =qQ9u > -----END PGP SIGNATURE----- >From the spec, the appendix on certificates: Certificates are validated using a few straightforward steps. First, the signature on the certificate is checked and if invalid, the certificate is invalid (either a transmission error or an attempted forgery occurred). Next, the CertificateInfo::issuer field is verified to be an issuer that the application trusts (using an unspecified mechanism). The CertificateInfo::validity field is checked against the current date and verified. Here is what we do in Netscape (for now). We have imbedded a set of certificates in the client. The certificates are for issuers of certificates that "we" trust. Any server which is certified by one of these issuers will be automatically trusted by the Netscape Navigator... Admittedly this is primitive, but it's a start. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0

Re: BofA+Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412132218.QAA06065(a)pentagon.io.com>, you write: > jamesd(a)netcom.com (James A. Donald) writes: > [regarding Netscape and IETF work...] > > > > Perry, they are not in trouble. They are the number one supplier > > of the internet killer app. > > They are the supplier of the current app-du-jour. What things look lie in > five months is another issue completely. > > > The plug for crypto that they have placed in Netscape 0.96 is > > the number one force bringing crypto awareness to the masses. > > Increasing use of PGP is the number one force bringing crypto awareness to > the masses, Netscape is just bringing bad crypto to the masses. > > > He said that Netscape would look at IPSP when it was beyond > > the "near" phase. [...] The correct response is "Gee that is great. > > Here are some working demo systems, and some slabs of documentation." > > No, the correct response is to stop idotic measures before the build up > enough inertia behind them to make it difficult to prevent mistakes from > being made. It is interesting that the creators of Netscape quite > frequently harp on "it is us against the goliath of Microsoft, so we > deserve the support of the net" and then they go out and do exactly the > sort of thing that makes Microsoft so unpopular; they take advantage of > thier market position to force bad technology on others. If the technology is so "bad", would someone please be so kind as to inform us what is so "bad" about it? We have a solution for a piece of the security puzzle: transport security. We admit its limitations. People keep saying its "bad". Please put some meat behind the commentary: Is it insecure? If so, how? Is there some cipher techonology that it absolutely must support? If so, which one? why? etc. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0

Re: PGP 2.7
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- DNA writes: > I keep seeing pgp 2.7 in public key & sig blocks. > Where do we get it? - - From ViaCrypt (cf. Mike Johnson's Where to Get PGP FAQ, which he coincidentally sent to the list yesterday) - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvAPp2f7YYibNzjpAQFRcQP+KPprizNN0cENgCm6zQDCuuEMwQ9kLXVy H5SD/ZxNIcwKhUhHfJqczN2twUZ03/sK9CRh3Z1NYsnCi9ZqnlUuQvsIYVj6eiyM 5Z86PkxgZeMpZl5CHkvLKKyC2z+n6+Wb/MNSf4f55VRf3Ls25zYKtSz+7RhU+zN8 pp/y77gDLX4= =n9BP - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvAQ1SoZzwIn1bdtAQH9XgGAnZ6uztBdFvhc90EPdkE8nd0JpsRx+g5Y Fk7Xxgw/bpFIhh/LRSfhQqQKxzWt0zfo =TG7Y -----END PGP SIGNATURE-----

1 0

Re: BofA+Netscape
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Wasn't edlin based on the Unix ed? > >Nope. It's very similar to the CP/M `ed'. (I hesitate to say >"identical" since I haven't touched a CP/M system since 1984..), but >the first time I used edlin a couple years ago to edit an autoexec.bat >file, I had CP/M flashbacks... My mistake, I _did_ mean to say CP/M. ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu9qpE1Diok8GKihAQHH/AP/WlodSYb1Zsv2Uj7X/P5NYR0/61EvUaVv s4cnmNPA1irg6QkvQJTS8JaUCAz1DI6pBQP6URlCBPqhjMsJFO8cBP/cyRQYteb+ ppjMi3KKEQmO1psHT+2XVMYHOpQOC1Q+s8BDmtUhrC5FnNf9pXTa622Hz6uPc3+d hUmumhDjuCk= =zHoM -----END PGP SIGNATURE-----

1 0

Re: rad
by alano＠teleport.com 17 Dec '03

17 Dec '03

>I wish the NSA executives would come out of the closet... Don't you know they are supposed to not ask and not tell? ];> (Sorry... Someone had to say it.) | "Encryption ROT13s your mind." | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.|

1 0

Re: Less Flaming, More Civility
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: [...] >Not all debate recently has been insulting, of course. In fact, most >hasn't been. But the insulting tone persists in some of the thread >titles, and in the generally adversarial nature. (If I were Marc A. >or Kipp, I'd not feel very welcome here....a situation which is >counterproductive to our presumed goals.) [...] II was quite surprised that they stayed that calm. MCOM's comming out on the list was rather painfull. Glad to have them here, though. I always looked at the list as place to learn. Past mistakes nonwithstanding, they do seem to be willing to learn. >So, this is my little rant on "Can't we all just get along?" expressed >in a different way. > There is nothing gained by flaming someone. Even if one thinks that they deserve it. Let's not alienate people that come to us to be educated. This would be self defeating. >The Cypherpunks list has become one of several de facto "watering >holes" where diverse participants interact. Let's not blow it. C'punks, when this list started we were a bunch of idealistic privacy freaks. Look who's on the list now: the developers of cutting edge Internet software. They came here because they heard our message. What did Amanda say? Something like "I come here because that's where the ideas are". We have the chance to influence the shape of the Net for years to come. The MCOM folks didn't go to the IETF meeting? Send them an invite for the next one. They never heard of ISIP? Send them a demo and docs. Let's show a "If you have any questions don't hesitate to ask us." attitude. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Less Flaming, More Civility
by bshantz＠spry.com 17 Dec '03

17 Dec '03

<---- Begin Included Message ----> Return-Path: <owner-cypherpunks(a)toad.com> To: tcmay(a)netcom.com (Timothy C. May) >Timothy C. May says: >> >> This was one of those "MIME" things I got, that tell me to "Hit any >> key to go on," "Now press ^H-Alt-Hyper-Abort to return to the main >> menu." Perry Metzger wrote: >It wasn't real mime -- the content type was listed as >TEXT/PLAIN; charset=US-ASCII >with a base64 content transfer encoding, but the contents were not >seven bit ascii. I have no idea what the thing was. I thought it was just gibberish since none of my parsers (MIME or otherwise) recognized it as anything valuable. So, I deleted it. That filter worked fine. :-) -- Brad

1 0