December 2003 - cypherpunks-legacy

Rules for "Them" and Rules for "Us"
by David Yaffe 17 Dec '03

17 Dec '03

>This stinks. We're not talking about private ownership of nukes. We're >talking about a situation where a citizen can go to prison for having a >knife longer than 3 inches in his pocket, while cops are free to have them >for their own purposes. We can all pray for the day when law enforcement, and government personel wake up one morning, realise what they are and shoot themselves. Then again, they are all such nice people, why would we want them to do that.. David Those who can, do. Those who can't, teach. Those that know nothing about anything, lead..

1 0

Today's Internet discussion on Science Friday
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Hi! I just saw that you'd be discussing the Exon Censorship Bill discussion on today's Science Friday on Talk of The Nation; I found out from a mailing list on the Internet, and had time to tune in, but not enough advance warning to attack-dial and become the one lucky caller who actually got on :-) You picked a well-balanced set of interviewees; I was a bit disappointed by the time balance between discussion and callers. It would also be nice if you extended the on-line discussion to the Internet as well as the commercial services AOL and Compuserve, since that extends the collection of people who can be involved in the discussion. [Summary for list-folk - the speakers were Bruce Taylor of National Law Center for Children and Families (sounds like a Pat Robertson thing), Dan Weitzner of CDT, and Larry Maggoth(sp?) who wrote the Child Safety on the Info Superhighway pamphlet. Larry led off, Taylor dominated the discussions, Weitzner mostly wimped out. Everybody agreed that there's obscenity on the Internet if you want to find it, and that it's great that we have obscenity laws to punish Bad People and Protect Kids; Rimm's bogus numbers weren't discussed, the indecency-vs-obscenity was starting to be discussed but got cut off by time.] #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281

1 0

Re: Cyberporn on NPR today
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

>But I expect it to focus on the technology questions, not the shrill >"Save our children from the plague..." hysteria. Only two callers through, first one should have hung up when he heard all of his arguments made (better) in the first half hour. Second caller asked whether the Pynchon mailing list he's on would have to censor itself if the Exon ammendment passed (seemed a decent point - succinct too). The rest of the time was the same old political debate with a few moments about Surfwatch. Equal time given to the opposition, who spoke about the horrors of unspeakable besiality, rape, etc. -- --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

2 1

Re: big word listing
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>| As a security measure, I am trying to get a massive dictionary of words >| together, and each time a user changes his/her password, it checks the list to >| see if the password is in it. My question is, are there any pre-built lists of >| this nature? I am currently only using a spelling dictionary, and would like >| something a little bigger. > > Look on coast.cs.purdue.edu in the password/Crack areas. There are also Grady Ward's Moby Words and related moby-listings, though things like Crack will probably do a more thorough job of variants like word, drow, w0rd, word0, drow0, word1, 0word, 1word, word1word, etc. which people use to complicate their passwords. Caveat: If you're building it on Unix, _don't_ set up the command to take the proposed password on the command line, e.g. "checkpass foobar2", since that makes it visible to anyone who runs ps. Feed it through stdin, or set it as a variable and fork, or something like that. And remember that binary searches are _far_ faster than reading whole dictionaries, and hashes are even faster if you're willing to preprocess more. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281

1 0

New Form of DOS Attack
by Duncan Frissell 17 Dec '03

17 Dec '03

Apropos of nothing... Suppose that you are in charge of a separatist compound/Blacknet POP/Meth Lab and you are worried that The FBI/BATF/DEA/FEMA/UN jackbooted thugs with their black helicopters are planning a little "dynamic entry." If you want to deny the Feds the opportunity for some energetic service of process, all you have to do is hire Rodney King to move in. Once he is onsite, the Feds will be helpless. Just keep your Greenpeace Special (tm) sat cams focussed on old Rodney and you have absolute immunity from all incursion. Too bad we can't clone him. DCF "Goodby cruel world, I'm off to join the circus. Hey, Mr. Barnum save a place for me."

1 0

Re: Three strikes you're out! for politicians... yeah we wish!
by hal9001＠panix.com 17 Dec '03

17 Dec '03

At 04:00 7/22/95, Craig Hubley wrote: >> >> About two weeks ago, there was some talk in here with regards to holding >> DC lawmakers crominally liable for passign bad laws. This was followed >> up with postins pointing out that you can't do that. > >Here's something you *can* do: > >"Three strikes you're out" for politicians. > >Any time the Supreme Court strikes down a law, any politician who has been >found to have voted in favor of three such laws is immediately stripped of >all offices and rendered ineligible to run for public office ever again, >at any level. (The same might apply to those found to have lied to a court > >A politician who would trade citizen rights for political gain must be denied >the benefits of such a tradeoff. This might prevent the rise of demagogues. >Term limits, etc., would of course help as well. It would also give those >politicians who vote for 'motherhood' issues like 'protecting kids from the >perverts on the Internet' a good reason to think twice about the real issue. >If they REALLY believe they are protecting someone, they will still vote in >favor. If they are going with the flow to avoid criticism, they'll lose in >the end. > >My reasoning is that any politician whose laws are consistently struck down >should be deemed to lack a fundamental understanding of the rights of the >citizens of his/her country or jurisdiction. They are thus a poor guardian >of those rights. > >You heard it here first. > >Craig Hubley I'd love to see the system described in H. Beam Piper's "A Planet for Texans" implemented. Under that system, all Politicians are BY LAW representing the interests of ALL their constituents. Any constituent who feels that he/she is not being adequately represented (or feels that his/her views/interests are being misrepresented) is by law granted total access to the Politician and may register this disapproval of the Politician's Performance in any way up to and including killing the Politician. If the Politician (or his/her survivors/friends <g>) feel that the constituent used excessive force (such as using a car bomb or a long distance weapon like a rifle as opposed to using a personal weapon such as a hand gun at close range) or force out-of-proportion to the action being protested, they can bring charges in the "Court of Political Justice". In such a trial it is the job of the prosecution (ie: The Politician or Representatives) to prove that the constituent did, in fact, overstep the accepted rules for registering disapproval.

2 1

Re: Java (was Netscape: the big win)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> So, what would be a "cypherpunk" thing you could do with Java? I > know I can use it to download little applets to my system to do > animations. What can it do to enhance my privacy? What would be > the Java equivalent of PGP? How about the old-standbys: remailers. Mixmaster is definitely where the technology is at, but it requires a client to use... Of course, with Java, there is the potential that _any_ user from any platform could connect to the Mixmaster Web page, get the client software, and start using the remailer network. Without having to compile, know anything, etc... If a Mixmaster client were available in Java (and I'm pretty sure it can be done) then suddenly everyone who previously could only use the penet server can now also use Mixmaster. With more people using the remailer network, all of them with Java clients, the possibility of for-pay remailers could become reality (no promises that you'll get rich though). There are many crypto-anarchy applications as well: Key cracking. If you can write a key-cracker and keyspace fetcher in Java, then people can join key cracking efforts as easily looking up an URL. It may not be nearly as efficient as the highly optimized C versions used in the current RC4-40 efforts, but there's going to be millions of potential workers this way. If you were charging money to break keys (or you were looking for keys that are very valuable to you), you could set up the worker client to accept e-cash for in return for searching keyspace "Click here to earn money while you aren't using your machine..." Ensuring that workers are actually searching the keyspace and other implementation details is left as an exercise for the reader. e-instrument or information exchanges, with Java interfaces for bidding, buying, selling, etc... DataHavens, which would probably require complex (internally) software to use. I'm sure the online casino people are salivating over the prospects too... Basically any fancy crypto application that requires a custom client to operate... Since its platform independent, efforts will be put to better use as well. andrew

3 2

"Hey Phil! Stop telling people *not* to use PGP!" (plus: "help me with my PGP
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bryce Wilcox <wilcoxb(a)nagina.cs.colorado.edu> writes: > And I say "No no no, using a key which you got through the Net is better > than using no key at all, just be aware that if someone *really* wanted > to spy on you that they could have tampered with it. When you see Cousin > Joe next Christmas you can compare keys with him and make sure you have the > right one." I suppose one could always send Cousin Joe an encrypted message and see if he can read it..... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMBAPON74r4kaz3mVAQGoXQP9HYxFLJ3BEs5YhJ3Yaf3NGbUTIwB3pBw+ QNAzqiuKcNQmQ8/EZ160FK8JeeKAwMcSHA/a+/coG5+82DEiDfbkyLRXJK60c+j3 jVksrm3jxd9nfBk1SrWddHj6SYg8+0Rxz9aNFkfmwcNWJVPNcDkwvzAHZ1wO9rqZ gPaq8xIjfAA= =1I7d -----END PGP SIGNATURE-----

1 1

Free Java courses in CA
by cman＠communities.com 17 Dec '03

17 Dec '03

[[ This is another reason why I think Java is worth looking into -- on one hand, there will always be free tools available, in addition to commercial tools; on the other hand, it is being strongly supported by SUN ]] The SUN Sacramento Training Center announces the following FREE courses. The Java Programming Series: #1 An Overview of the Java Language The Java Programming Series: #2 Accessing Data Files The Java Programming Series: #3 Simple GUI Applications The Java Programming Series: #4 Program-to-Program Communication The Java Programming Series: #5 Applets Design and Implementation The Java Programming Series: #6 Accessing an Oracle RDBMS Each course is: - 2 hours in length (they always start at 9:00 AM on Fridays) - fast paced - an introduction to the course topic - FREE It is assumed that each student: - knows C and/or C++ language syntax - has a basic understanding of object oriented programming - has a personality that enjoys taking a jump-start course and then learning the rest of the technology via projects, newsgroups, and email-alias discussions. You should NOT attend this class if: You are a techno-weenie. You are already an experienced JAVA programmer. Instructor: Matthew Calame -------------------------------------------------------------------- A DRESS CODE is REQUIRED of all students. Dress Code: Traditional Silicon Valley casual attire (blue jeans and company tee-shirt) -------------------------------------------------------------------- Current Schedule: 08/04/95 The Java Programming Series: #1 An Overview of the Java Language 08/18/95 The Java Programming Series: #2 Accessing Data Files 09/22/95 The Java Programming Series: #3 Simple GUI Applications 10/06/95 The Java Programming Series: #4 Program-to-Program Communication 10/20/95 The Java Programming Series: #5 Applets Design and Implementation 11/03/95 The Java Programming Series: #6 Accessing an Oracle RDBMS Note: If your group needs training at a different location or at different times, please contact matthew.calame(a)west.sun.com. -------------------------------------------------------------------- Courses will be held at: Sun Microsystems 8880 Cal Center Drive Suite 200 Sacramento, CA 95826 -------------------------------------------------------------------- To Enroll: (1) Send an email to: java-training(a)sacto.west.sun.com The email should contain your: Name: Company Name: Mailing Address: Telephone Number: Fax Number: Email Address: **OR** (2) Send a fax to: 916-362-3287 Attn: Matthew Calame The fax should contain your: Name: Company Name: Mailing Address: Telephone Number: Fax Number: Email Address: -------------------------------------------------------------------- Regards, Matt ---------------------------------------------------------------- Matthew B. Calame Systems Engineer Sun Microsystems Computer Corporation Phone: 916-856-5507 or 916-856-5500 Email: matthew.calame(a)West.Sun.COM Fax: 916-362-3287 Sun Mailstop: USAC02 Address: Sun Microsystems 8880 Cal Center Drive Suite 200 Sacramento, CA 95826 ---------------------------------------------------------------- - Note to Sun employees: this is an EXTERNAL mailing list! Info: send 'help' to java-interest-request(a)java.sun.com

1 0

Re: big word listing
by Chris Gorsuch 17 Dec '03

17 Dec '03

The crack library points to some dictionaries which have not only real and "imagined" (literary) words, but also words from other languages as well. All in all a good resource. -see adams message for pointers However, the reason I write is if you decide to add users previously used passwords to the dictionary, make sure your "appendages" to the dictionary are secured. Users are notorious for forgetting to change or reusing on other machines the passwords from various servers. The advantage is that your users will never be able to reuse their old passwords. The disadvantage is that your admins can attempt to hack other machines using these passwords. A "cryptographic" solution would be to simply store a hash of the password rather than the password itself in the "appended" dictionary. A CRYPTOGRAPHIC solution would be to use one time passwords :). Chris Gorsuch chrisg(a)ti.com *I am not responsible for the content of the above message :)

1 0