December 2003 - cypherpunks-legacy

Re: Netscape competence
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Adam Shostack writes: > Until you hire the experts mentioned below, I'll continue to > assume that your talent mix does not include said experts. Whoops, sorry, Marc A. had the attribution correct after all. Amanda W. made some similar comments, but apparently I'm conflating the two. Please ignore my prior message. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuuKRWf7YYibNzjpAQEU/AQA5T/HnMDdRp2xMkDO7//G0ycCZnkEUwpv bz0MG8mUDE6XD2iTMCt/+VUDk6sx5BpNrofZOx0A57/XYsAxc0WsXk0Rb0Kh6o7x sPFTL6BJq97sFYbObO2uXvN5bbEQ1CL40rfZghds+exWhNix2fiNfy3SSaihd+qR kZl7CiLt7wY= =V6JA - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuLhCoZzwIn1bdtAQFi3QF+KaUcUOTrly37pZkowVc313X3qq+4Jy/j O9X/cSYleflVJl1rplCHm8cKB1KE0ICF =a9ik -----END PGP SIGNATURE-----

1 0

Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

In the Jan 95 issue of Dr Dobbs Journal, you will find the following: An editorial on the public release of RC4 (without code). An article by me on GOST (with code). An article by Ron Rivest on RC5 (without code). Remember, you can export cryptographic source code in paper form. Bruce

5 4

Re: What Happened to Xenon ?
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

It seems he lost his Internet access(I think he moved to work at some university which does not have an Internet node). The Macintosh Cryptography Interface Project list which he started to make some porgress in getting a mac like inter -face for PGP still exists. I can give you the necessary info if you'd like. -RH- --------------------------------------------------------------------------------- Reuben Halper I'm not growing up, I'm just burnin' out." Montclair High - Green Day - Montclair, NJ E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key available upon request ---------------------------------------------------------------------------------

1 0

Re: Hal Finney & Bob Rae and Ontario's Parliament
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Richard Martin writes: > The article below is what I posted to ont.general myself this evening. [...] > PGP, a fully legal encryption program which the Ontario > government could use FOR FREE, Is this true ? According to the PGP 2.6.1 User's Guide: "The freeware version of PGP is only for personal, non-commercial use -- all other users in the USA and Canada must obtain a fully licensed version of PGP from ViaCrypt. [...] If you have a need to use PGP in a commercial or Government setting, and ViaCrypt has a version of PGP for your hardware platform, you should get ViaCrypt PGP." - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuv85mf7YYibNzjpAQErsgQA4h1OvxrfiPemA6CqN1gkVpdmoTIxOnEg pOZ2Oa4rCCqNTMqmhEXw98H46c+sQDFv+WXSQEj9Q94X3nTtKBpBIRMQ7L0Etu4U hd9OyadA0Z45I+igeq2UpOeQw+UP97dFtCabZZhrRgcGFZQMUi8eVLqRESxKtU2V 88tOztqzcZY= =FYp4 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuv+DioZzwIn1bdtAQFDhgF/VA6FDH1i05pB20ofLQA+sihJTukUI/6m Mb1taTvGIqDmgPW1YP9nQbWGgjQ3OvAj =HMza -----END PGP SIGNATURE-----

2 1

Re: BofA+Netscape
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> Amanda complained that Netscape pisses all over the > standardization committees. > > Well guys, the victor has room to move. It must come as a big > shock to Apple, Microsoft, and IBM, but reality is that Netscape > can set WWW standards and they cannot. I disagree. The WWW is no longer a research project, and if it is to survive it will have to do so by consensus, either formal or informal. That's what standards committees, and groups like the IETF, exist to facilitate. The alternative is fragmentation, which we're already starting to see (in part because of Netscape's unilateral changes to HTML). Let me re-iterate something here: I'm biased. I'm a commercial vendor. I'm perfectly happy to live by the sword and die by the sword if that's how the market ends up--I just think it would be better for the Internet as a whole if the actual on-the-wire protocols and formats become standards, so that people don't have to worry about what clients or servers they are talking to. UI, performance, service, and such are fair game. Infastructure has to be consensus-based or it fails. But hey, if Netscape can innovate by fiat, so can anyone else. Right now, I'm betting that Netscape will decide it's worth cooperating with the standards process. If they don't, they'll just fragment their own market. I can live with that, but I think it would be a shame. Amanda Walker InterCon Systems Corporation

4 10

Re: Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 7:17 PM 12/11/94, Timothy C. May wrote: >In my view, the whole export issue is a joke anyway. Anyone with >access to Bruce's code could quite easily remail it, with or without >first hiding the exact form by compressing, encrypting, or stegging >it. > >That this hasn't happened--so far as we (or I) know--says more about >other things than about the laws supposedly barring such export. Well, it might actually say quite a bit about such laws, namely that they scare people into _not_ remailing Bruce's code. As is the point of such laws, obviously. So they appear to be working, right? People don't want to do something that is illegal, even if it would be easy to do so. But I had actually kind of assumed that this sort of thing _had_ happened. If anyone in some other country wanted to get a hold of Bruce's code, it would not be dificult to do so. And I figure someone probably has wanted to do such a thing, and probably has done it. If anyone out in non-U.S. land wants Bruce's code, and has been unable to get a hold of it, I bet a posting to alt.privacy.anon-server, or to the cypherpunks list, would result in people volunteering (via anon remailers, of course) to break the export laws. The non-U.S. citizens asking for the code wouldn't be breaking any laws, so they don't even need to use an encrypted address block, they can just ask publically. A U.S. citizen using PGP and going through a chain of 8 or 10 remailers (including non-U.S. ones) is not likely to be caught. Of course I'd never do such a thing, especially after talking about it publically on cypherpunks.

2 1

Further comments on Netscape et al.
by Amanda Walker 17 Dec '03

17 Dec '03

-----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIIB4DCCAXUCBQJBAAI3MA0GCSqGSIb3DQEBAgUAMGMxCzAJBgNVBAYTAlVTMSAw HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjEyMDAGA1UECxMpVW5hZmZp bGlhdGVkIFVzZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNOTQwNTE2MDAw MDAwWhcNOTYwNTE2MjM1OTU5WjB6MQswCQYDVQQGEwJVUzEOMAwGA1UEERMFMjIw NzAxETAPBgNVBAgTCFZpcmdpbmlhMRAwDgYDVQQHEwdIZXJuZG9uMR4wHAYDVQQJ FBUyMDEgRWxkZW4gU3RyZWV0IKYxNzMxFjAUBgNVBAMTDUFtYW5kYSBXYWxrZXIw XDANBgkqhkiG9w0BAQEFAANLADBIAkEAsYTQHrGTWxpS22owJLNVkmBNxGW6Z8TK 5Qdsg9co9J8uyHOuqEIHIxOIDsVA7X/bsYVXxvitmc5PYKp2RuWj+QIDAQABMA0G CSqGSIb3DQEBAgUAA1YAIR3BS02rsquq3dY6sGWcieXW3HtChMtsReRhDdY/nGPz rIUYuWt087c4T4afrsG9FbouJOkAsR/5SkLI9UpXonDIUskdl4/JlRKpyLaX07RK mUyTSR== MIC-Info: RSA-MD5,RSA, lOMm69acu9EUeHUNrqC3tVCGCxCYQn24LMZIdJLsHHh+yHQUzowi3hysYfSuJEeR 15mklYr0pLdP8HQCyqv4mg== Sigh. I wasn't intending to ignite a firestorm on the list, especially on a topic that is at this point only marginally crypto-related. I bear Netscape and its staff no ill will--they have done some wonderful stuff, and I'd be more than happy to compete with them however the market ends up. I am irritated by some of how they've gone about things, but this is as much cultural as anything else--the market will decide in the end, whatever they or anyone else do. If I have offended anyone on the list or at Netscape, I'm completely willing to continue the discussion in email, comp.infosystems.www, or wherever else, but I'm going to stop sending my replies to cypherpunks at this point unless they actually have to do with cryptography or WWW security per se. Vendors do take potshots at each other from time to time; I'm sorry that I indulged myself and did so on this list instead of in a more appropriate manner. Amanda Walker InterCon Systems Corporation -----END PRIVACY-ENHANCED MESSAGE-----

1 0

Re: Broadcasts and the Rendezvous Problem
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >L. Todd Masco wrote: > >> Seems to me that one of the fundamental building blocks necessary to >> a host of anonymous services is a means of rendezvousing in a manner that >> is not vulnerable to traffic analysis. >> >> The obvious solution to this is through the use of a broadcast medium. >> Has anybody created an alt.* group purely for remailer-associated >> rendezvous? > >Isn't this what "alt.anonymous.messages" is all about? > >(It's been at my Netcom site for many months now...I don't recall who >created it, but it seems to me it was one of us.) Which brings us back to the news -> mail gateway. There has to be a better way. I know that a small fraction of the net goes via satelite. Is there a way to inject truely anonymous datagrams? Any hams out there? -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: BofA+Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

[Welcome to the list, Marc. Great to have you here!] Marc Andreessen wrote >In article <9412111647.AA23311(a)tadpole.tadpole.com>, db(a)Tadpole.COM (Doug >Barnes) wrote: > >> I'll throw in that from the perspective of someone running a server, >> their approach of requesting all graphics simultaneously over >> different sockets in the name of client performance is disastrous. >> This causes most servers to fork N times more per page, where N is >> the avg. # of graphics. > >That's just plain not true. Servers don't fork any more often >with Netscape than they do with other clients -- EVER. > >> but some have speculated that this was done deliberately in order >> sabotage server software other than their own. > >That's also just plain not true, and completely unsubstantiated. Marc, have you ever been in an empty lab with an htpd server - late at night? You can HEAR it when Mozzilla hits the site. Two or three Mozzilla users at the same time will kill your server. Unless, I understand, it uses your server software for which you charge money. Can you be surprised that there are a significant number of people out there who are wondering if your "selfless" deed of giving away your client software for free was really all that selfless? -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Storm Brewing Over Forged Bob Rae Posting?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >In yet another piece of news, Netcom has apparently been >hacked/attacked rather badly. The "netcom.general" discussion group >(local to Netcom) is filled with garbage posts, forged posts, >cancelled articles, etc. Messages about "root" being forged appeared, >then disappeared. Netcom is quiet on this, but has been running >"crack" on all of their machines for the last several days--apparently >to (somehow?) help to find security flaws....I have no idea why >running crack to find weak passwords of users is such a high priority. >Maybe the apparent attack is related, maybe not. Netcom has unauthorized access problems for the longest time. My account has been deleted three times in as many months. Neither sysadmin nor accounting had any explanation or record of the deletion. No, I didn't owe them money. This has not been an isolated incident (see the article about Netcom under the fitting title "Sysadmins without a clue" in the Summer '94 issue of 2600). Netcom states in their announcement in netcom.announce that the passwords compromised were of a type that could be found in a dictionary attack. This would explain why they are running crack. Seems someone else has run crack before them. It also seems that root(a)netcom.com made the mistake of choosing a pw that is subject to a dictionary attack. Well, sysadmins without a clue. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0