December 2003 - cypherpunks-legacy

Re: McCoy is Right! New Mail Format to Start Now.
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 3:12 PM 12/15/94, Timothy C. May wrote: >If we make the leap, I say make the leap to the Web: > >cave drawings --> text --> e-mail --> Web > >(By Web I of course mean the whole ball of wax involving HTML/HTTP/etc.) > >This is not a rejection of new technology, just a wise selection of >which technology to bet on. HTTP and email, serve different transport purposes. I don't think I really need to explain in what ways they are different, because we all know. Suffice it to say that mailing lists work better as a mailing list then it ever could as a web page, even with forms and all that stuff. A mailing list is a different transport-method choice then HTTP is. But there's no reason why you couldn't mail html documents. html isn't a "transport" choice, but a "content" choice. Maybe in the future all of our mail readers will be able to render html, and people will send html mail, with anchors and ordered lists and whatever else. That's something I think is likely to happen, eventually. Email and HTTP are transport mechanisms, whereas html and ascii text (which of course is a subset of html) are content formats. And MIME is a mechanism for describing what types of content formats are contained in the message, whether the message is a usenet article, a piece of email, or a web page. A given "transmission" of course can't be both email and HTTP, but it could be email and use MIME and be html. Or be http and mime and html. I don't think we'll ever stop using email in favor of the web and HTTP, because they serve different purposes. I don't think Tim really does thinks we'll stop using email either, since I've heard him deprecate the web several times. He is just trying to convince us not to use MIME (or html for that matter) in email we send to the list, and thinks maybe this argument will convince us and not result in us calling him a technophobe. :)

3 2

Tim May the Luddite--His Last Message for A While
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Timothy C. May: Whatever, I'm fed up. . . . . As they say, you know what a Cypherpunks firing squad is? A circle. ............................................................. Cheap parting shot: " The record shows I took the blows and did it MYYYYYYYYYYYYYY Waaaaaaaaaaaaay." Blanc (I just had to say that) :>)

2 1

Re: McCoy is Right! New Mail Format to Start Now.
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

Alex Strasheim <alex(a)omaha.com> wrote: >The sociology and politics of evolving standards is an important issue on >the net, and it seems to me that things are a little more complicated than >some posters are admitting. If cypherpunks are going to have an influence >on how things turn out, we're going to have to come to terms with the >issues Tim has been raising. Can someone (Tim maybe?) clearly delimit exactly what the issues Tim has been raising _are_? As far as I can tell, the issue is simply that current tools out there to deal with enhanced mail features (like PGP encryption) just aren't easy enough to use yet. There seem to be two simple ways to deal with this: 1) Try to develop easier to use tools 2) Try to convince people that the current tools aren't as hard to use as they think. I am absolutely convinced that mailers supporting MIME in a rational way, along with the new PGP MIME specifications, are the answer to number 1. I feel confident that anyone who examines the MIME specs will agree that if mailers supported it reasonably, dealing with PGP would be easy. I'm not sure everyone here who is deprecating MIME understands what it really is. MIME has nothing to do with annoying messages on your screen, and a reasonable mailer wouldn't give you those messages. But I think people on the list are doing both of those two things. People who know how to code, and who think that current tools _aren't_ easy enough to use, are putting more emphasis on #1 (whether they're solution involves MIME or not). People who don't have the coding skills or inclination, or who think the current tools are significantly easier to use then most people realize, are putting more emphais on #2. Those are the real issues here I think. The convincing people part is really secondary, in my opinion, because the current tools are nowhere near good enough. The developing easier tools is important, and if anyone wants to discuss how to do this, I'm certainly interested in it. Like I said, I'm convinced MIME is the answer, but a lot more needs to be said then "MIME is the answer" (like what is meant by my phrase "supporting MIME in a rational way"), and I'm also certainly willing to consider the idea that MIME isn't the answer after all. But comments like "well, MIME is completely irrelevant, email will eventually disappear in favor the web," or similar stuff, just leaves me confused, and seems completely irrelevant to me. The issue is making PGP easier to use. If anyone really thinks that the way to do this somehow involves HTTP, then I'd be glad to listen to an explanation of that. But as far as I can tell, whether you are talking about email or ftp or HTTP, the answer is about MIME, and not about those transport protocols.

2 1

Re: Remailers and Keyservers, active ones?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Derek Atkins writes: > The active remailers get periodically posted. I forget the site > where you can request the current list. http://www.cs.berkeley.edu/~raph/remailer-list.html is the best source I know. For the WWW-deprived: finger remailer-list(a)kiwi.cs.berkeley.edu I'm not aware of a way to obtain the list purely via email; maybe I should establish a way to do that if it's not out there.... - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvFFv2f7YYibNzjpAQFE3AP/blHKIhZTLOOEV+flzL/WFGXMsdTmO2xV GuAZ9P/WCfkMM3x46D+glH7GaLGuGvIMIV09XrvEsvppJ2H4PCMAF1ZhCkLyCDJW VZZTytM4Ws4ffHZzEJ6eyPYqoaKUTgqImj/hRTXIxVRETSlliwWfOJAE6rEAL+Pk RY2vAHoUG2o= =y1dI - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvFG6yoZzwIn1bdtAQHu3QF+JhyYgYqqxBKuGiJA0iDTingK6MZutyHw N89rv2C28/9M0lGc21PJJbW1V5yadOgM =4gy2 -----END PGP SIGNATURE-----

1 0

Re: McCoy is Right! New Mail Format to Start Now.
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> But this isn't 15 years ago, and I daresay there isn't a _single_ > subscriber to the Cypherpunks list using a VIC-20 or anything remotely > similar. Of the 600 or so subscribers, and certainly of the 100-200 > involved posters, I would bet that essentially all of them can display > ASCII text on an 80-column screen. ... when they're at their desk. There has been an explosion, however, of non-80-column-capable devices on which people want to read their email. Alphanumeric pagers, Handheld PDAs, palmtop computers, etc. Give me a radio modem with reasonable service coverage, and I'd want to read at least some kinds of mail on my Newton (about 32-48 characters across the display). In fact, the ability to display graphics is becoming universal in areas where 80 columns have been tossed aside. Very few people use actual terminals any more. I'd be amazed if any more than 5-10% of the readership of this group (and the Internet at large) were using anything but a graphics display, even if it's emulating a VT100. I should stop now, though. I feel the urge to bring up Hollerith cards and keypunches again :). Amanda Walker InterCon Systems Corporation

6 6

Re: The Thread That Wouldn't Die (Was: Re: McCoy is Right!)
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- [Please don't cc: me on messages to the list. Thanks.] Jim McCoy writes: > Actually this "dump flamewar" has produced some good discussion regarding > actual implementation issues. I beg to differ. If you think that was a good discussion, I'd hate to see what you'd classify as a bad discussion. Crypto relevance was minimal, too. > Everything that has happened with MIME will happen again when people try to > add cryptography to the structure of the net. It seems to me that people are *already* trying to add cryptography to the structure of the net, and that would actually be worth discussing. > Maybe there are some lessons to be learned here. _Maybe_, but I don't think anyone's learning them. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvFDrGf7YYibNzjpAQFjXgP/QrsprjIVwZvAmkx8GAySAiEn7/VLtbuL HfvPXaEBvq1iDr5Jax7p95ctWA6Qjo4H13LkUJIHkoMK+Hh5ofO6bG1g2ZBKWz8b oX/S90pPhDDDc4yt6DPQXeaz57yA3IYYhUQzWrh9dH/LtAC5agsyqcJTGTWWrQ1/ pO7d7VQhFnQ= =uE/d - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvFE0yoZzwIn1bdtAQFQKwF/ROSbeuwJYgPTq8WJz3FQLVR9PEA99bBF xxz4ISjLTvZKPPX8OQo2vE6cYgt3mChU =Ahuo -----END PGP SIGNATURE-----

2 1

Re: McCoy is Right! New Mail Format to Start Now.
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Don't freak with the address... I'm moving. Check the sig if you're paranoid. Tim's wise words were: >The issue is not unwillingness to use new technology, it is, rather, >the issue of "stable attractors." That is, what can I/we reasonably >expect others to also have. Clearly if I issued my paper to the list >in FrameMaker format, or Acrobat format, or even TeX format, only a >few people would be able to read it. Fewer still would actually take >the steps needed to actually display the paper. > >Standards, standards, standards! > >I don't think the minor extensions to e-mail (loosely called "MIME," >though MIME serves other functions besides attaching graphics) are >worth the effort, frankly. Most of the MIME messages (the ones that >tell me about "ISO 558972 fonts" and "Press any key to return") don't >seem to warrant the effort....I think in 90%+ of the cases people >simply send messages as MIME by default, not becuase non-ASCII stuff >is included. Well, ignoring the fact that MIME appears to be infiltrating the Web as well... I would differ with your analysis of MIME's lack of usefulness. It does provide a possible way to integrate PGP into the mail/Web landscape (from a crypto standpoint). Multimedia I'm not so sure about; I think the big draw to MIME will come when Person A drags and drops a spreadsheet into a MIME mailer and sends the message to Person B, who then clicks on an icon to pull up the spreadsheet. But I digress... I'd say, however, that MIME isn't a done deal yet, though it's getting there. Until it's there, it's probably a bad idea. It's been my experience that many mailers are just MIME-compliant enough to cause their users lots of headaches. (As I write this, I notice I'm using Eudora, which MIMEs all its stuff. Oh, well; I hope this message isn't too much trouble for y'all...) >If we make the leap, I say make the leap to the Web: > >cave drawings --> text --> e-mail --> Web > >(By Web I of course mean the whole ball of wax involving HTML/HTTP/etc.) > >This is not a rejection of new technology, just a wise selection of >which technology to bet on. I vote for MIME-encoded cave drawings. :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLvCxGjER5KvPRd0NAQH+bgP8C5oOpT0Cgzh0m3yXYZmsvpaZqB5FuZUt ZFQAHkKrIhaJ39IBhcJXv9Xmda/Jhp2wluvMDKlyzDxG/lvHJnr+h4cTJEUq6H57 bWPuQO2MBuBViOE77GFKreFzyLeamidlIlva3cIm/m/eYQXcF8l5qsNRB6O5kGe0 wq97dXfrVQ8= =OyM1 -----END PGP SIGNATURE-----

4 4

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Thu, 15 Dec 1994 06:55:23 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: KEYSRVR: tabula rasa? Cc: Philip Zimmermann <prz(a)acm.org>, Michael Graff <explorer(a)iastate.edu> -----BEGIN PGP SIGNED MESSAGE----- [parts from a separate thread w/ Derek] Why is it possible for someone other than ME to add MY key to a keyserver? I realize that at some point (perhaps only the first time you submit a key?), there has to be some trust model employed, but it seems like this anyone-can-submit-anyone-else's-key situation offers a very obvious attack: anyone could propagate bogus keys across the net by just generating bogus keys with someone else's email/name on them, leading to massive impersonation problems. Maybe I'm missing something obvious, but it seems like there should be a more rigorous method available to, and employed by, keyserver operators for verifying someone's identity before accepting a key submitted (supposedly) by them. Shouldn't the key submission msg itself at minimum be required to be contained within a signed msg from someone with enough "nearness" in trust levels from some trusted introducer known to the keyserver op? I thought this sort of situation was precisely the reason for the trust level system in PGP in the first place. This may be a can of worms (or not), but if cpunks require fairly decent methods for verifying the identities of people who want to trade keys with them personally, then it seems keyservers should require at LEAST that level of verification (or better). I'd like to CLEAR/REMOVE ALL keys from ALL keyservers that are: - attributed to me by others (without my knowledge) - added by others (unknown to me) - purporting to have been generated by me) and start with a tabula rasa. Maybe in a few weeks, once all these (what I consider to be) bogus keys are GONE, I can add my actual key to a keyserver. There doesn't seem to be any elegant mechanism available for doing this yet, but I'm ready to be educated on this point. Any comments? dave -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLvANraHBOF9KrwDlAQGVDwQAs4/OuwICvnl+hHpatlcpp8o7MrF21x9f 4SJd0NUJ/koa648bDwr0qxyhs7NSwon2jU4FPI/QBPVAcrsSAMkfXWr2NpF6pOlV TIFIQ9xouT9RP7KT86bU0EiU3RQsO3q8LJRjylWOA2zBEYC+b7Ah5ALfZ/tng293 wE8W2E/rxl0= =64dw -----END PGP SIGNATURE-----

3 2

Internet Service
by success＠network2.net 17 Dec '03

17 Dec '03

If you wish to be removed from future mailings, please reply with the subject "Remove" If we showed you how to receive FREE Unlimited Internet Access to the World Wide Web, 24 hours a day, 7 days a week, with super fast worldwide connectivity and included your own personal e-mail address and the hosting of your web site (up to 10 MB), along with Toll-Free technical support... Woul you be interested? If we told yuou the opportunity to receive FREE Unlimited Internet Access included excellent residual income potential... could you use the extra money? And providing all this came with an Unconditional 30-Day Money Back Guarantee to try our service... Would you take a test voyage? If you are like everyone else, the Answer is Yes! Please visit our web site to find out more... http://www.network2.net/~success

1 0

B-PGP: news/requests
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Note: I'm meta-prefixing this "B-PGP" to indicate the "Beginner-PGP" thread. At 10:37 am 12/21/94, bshantz(a)spry.com wrote: >It is my own personal opinion that in order for crypto to truly become >mainframe, the software manufacturers of internet connectivity packages must >integrate crypto into the applications. [elided] FYI, any of you who haven't heard should be pleased to know that Steve Dorner is working with Zig Fiedorowicz on integrating ViaCrypt PGP/Mac functions into Eudora (on the Mac, at least, which is a good starting point). This is a major step forward, since Eudora is so POPular :) and this could certainly increase sales of ViaCrypt's s/w as well. In the meantime, I'm looking at the AppleEvent scripts that have been made public and will make comments on them soon. Anyone who's up-to-date on current Mac or Windows version development (Hal Hildebrandt?) is encouraged to contact me, per Phil's request. I just want to make sure everyone gets what they need and that the left hand knows what the right hand is doing, etc. I'll set up an FTP directory "somewhere" for a central repository if anyone feels it's necessary (location to be announced elsewhere). BTW, I'm starting work on a Beginner's PGP-FAQ and would appreciate any question/answer pairs anyone would care to submit. Please keep them simple: they are aimed at an AOL-ish user level. The final document should be extremely non-technical, non-threatening and about three pages long maximum. In it, I will describe the History of the Entire Cryptographic World in 4000 words or less. :) I'm calling the 3-Minute Shakespeare Troupe next week for pointers on how to accomplish this... Speaking of AOL, does anyone know anyone on the current Internet development team there? I used to exchange email with some internet-oriented guys there back in '90-'91 but I wonder if anyone is in current contact - I'd like to discuss the possible integration of PGP into the AOL client software. That would effectively put PGP in a couple of million users hands PDQ. With all the bidness activity there of late, it seems to me there's a need that could be filled quite nicely. >In order to bring crypto to the masses, we have got to convince people that >it is necessary. We also must make it"second nature". It sure is nice to have >a menu option or a toolbar button that will encrypt plaintext automatically. >Key management and some of the "high tech" (I know, for us it's nothing, but >for my dad who just bought a computer and doesn't understand the difference >between click, double click, and drag, crypto is a really high tech thing >just in itself.) Notice Brad didn't even mention his MOM yet. I once tried to explain PGP to my Mom. "That's very nice, dear," was about the breadth of her reaction, but I still put a box on her desk and set her up with a key, even if she won't use it yet (ever? hey, she's a mom, Okay?). Now, if it was a real point-n-click maneuver, it might have a snowballs' chance in hell with her, but until then... >things of crypto should not be directly handled by the user. >(Optional >of course. On a privacy level, the user should have full control. Indeed. I'm hoping the upcoming versions of mainstream PGP (Mac/Win) will allow for a bit more modularity in the apps. I.e. it would be nice if you could "plug in" various functions, so that you could build up the app's features as a user gained more sophistication, but this may be way beyond the v3.0 scope. More on this idea later, as it more directly relates to system software extensions than PGP application stuff. >But give the user a break...if the software is secure..as such...so is the >user's privacy.) > >You will notice that this message is not signed. That's because in order to >sign it, I would need to save my message, hop out to a DOS box, PGP encrypt >it, hop back to my mail program and insert the encrypted mail as a text file. >That's enough to discourage the average user. This is pretty much what Tim >May was talking about when he discussed why he doesn't sign his messages. >It's not that he couldn't... it's just not practical for him. It's not >>really practical for me either, but I do it when I feel it's necessary. > >The only way to make crypto practical is to basicalloy hide the technical >side from the user and make it easy. Let me describe briefly for you all (and everyone is encouraged to type up a similarly brief log of what they do on their machines so we have a UI comparison table) what I deal with when I encrypt a msg on the Mac. Keep in mind that I have worked very hard to streamline the process as much as possible, and that this is before installing the AppleEvent scripts. It's not difficult for me, but for someone without a clue... well, they get two steps in, stare at the screen and eventually bag it. type msg body (in Eudora). select text copy to Mac clipboard (system) switch to PGP with macro Encrypt (or Sign) menu command [PGP reads the clipboard here, a wonderful improvement thanks to ...Zig?] enter passphrase [PGP outputs encrypted text to clipboard, wipes temp file] macro back to Eudora. paste clipboard back into msg body Now, all of this is easily scriptable: I once did it with a long complicated macro, but it was s l o w, so I bagged that idea - it didn't even use system level events. I'm hoping the new AE scripts will handle most of this, but it SHOULD all be done in the application layer by Eudora with direct calls to PGP in the bg (see above annc re Steve Dorner), which is the current direction. Let's hope ViaCrypt's new AE support will allow for this (Zig? hello?). IMPORTANT: Anyone currently working on an PGP versions is hereby requested to mail me regarding the coordination of development efforts. Mail Phil with questions about this. ALSO: There will/should be a group discussion at the upcoming physical meeting on the 14th which both Phil and I will be attending. Please bring your keys/laptops/floppies for signing. Over and out, dave ________________________________________________________________________ Speaking of "term limits," hasn't Rush Limbaugh gotten enough attention? -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLvtabKHBOF9KrwDlAQFYkAQAiKcjZx5iCzn0CLIBY5/TzVOY8sl7Jclo v6MSPdNdU3ONTBLtDlI3HbSnq/SqGyJxkgxex7aLaICwB+RUsE2TMnJ2PBXD1W0T 48eqQZT3IhT35gEfV3RQnYllIS4mhEWxzq8KFMPwdCjlNrF794TqZFgBadWZL+LR 4hXhnrTuB5A= =/bL0 -----END PGP SIGNATURE-----

1 0