December 2003 - cypherpunks-legacy

Re: McCoy is Right! New Mail Format to Start Now.
by Amanda Walker 17 Dec '03

17 Dec '03

Tim May writes: > "Actual" terminals is not the issue, but "virtual" terminals *is*. > I haven't done a poll lately, or ever in fact, but my hunch is that 70% > of the list is emulating some form of terminal, e.g., a VT-100 or 102, > or maybe something slightly more exotic. Or a shell program, as in > America Online, which has its own standard. I'd actually be interested in a poll, but I know better than to actually ask for one :). > Perry made the same point that Amanda makes, that my Macintosh _should > be_ usable as a graphics system, not just for ASCII text. Well, I > agree, but so what? I have to admit some bias here--our flagship product for the Macintosh contains a very MIME-aware mailer (which I am working on making crypto-aware as well), and which was designed to make MIME seamless. No helper software, no extracting pieces and finding a viewer for them, it just works. > I note that all of Perry's messages, and most > of Amanda's messages, fit this ASCII model. In my case, it's because I intentionally make them fit. Most mailing lists have a general expectation of plain ASCII. When I send mail to other people at InterCon, I (and the recipients) see something that looks like any other Mac document--nice formatting, diagrams and screen shots displayed inline, and so on. And when someone sends me a file via email, even if they're not using a MIME mailer, it shows up as an icon I can drag to a folder in the Finder. This isn't really a commercial for my product, though :). This is how I think MIME was meant to be implemented, and it's analogous to how I think encryption should be implemented. Forget helper applications, macros, and so on. There should be two popup menus on the envelope: "sign with" and "encrypt with". When you select them, you get prompted for your passphrase, and it just works. This is the same direction that other commercial vendors are headed, and it's this kind of simplicity that I think will finally get people to start using the technology (just as with MIME). On this, I suspect the Netscape folks and I are in violent agreement :), as probably are you from some of your comments to this list... > (The MIME stuff I'm not saying shouldn't be used, just that some of > us--perhaps most of us, is my hunch--will not be adopting the > latest bleeding edge technology. Right now, PGP is more of a bleeding edge technology than MIME is, IMHO. > Finally, Amanda mentioned "being away from out desks." Well, many of > us are _always_ away from our desks when we post. From home machines, > not from T3-connected Indigos on our desk. Indeed, that's why I brought it up; at the moment, I'm sitting in my study at home posting over a dialup (14.4K) PPP link. I've also posted from 37,000 feet sitting in a DC-10 (in coach :)), with my mail being queued up until I could jack into a phone when I land. > One thing I would like very much is the ability to include simple > diagrams and drawings in my posts, but this is clearly an _ > unsolved_ problem, from a practical point of view. Hmm. I'd say it's a partially solved problem. Newsgroups like clari.features.dilbert are popular enough that there's at least a significant fraction of people who can handle MIME messages with embedded graphics. > and ask yourself where all these posts-with-diagrams are > if they're so easy to do.) Well, I could start posting some, if you want existence proofs :)... Amanda Walker InterCon Systems Corporation

1 0

The End of the Forged Post Controversey
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It would appear that the "Bob Rae Forgery" had its standard 15 minutes of fame: From: eye(a)interlog.com (eye WEEKLY) Newsgroups: eye.news,ont.general,alt.internet.media-coverage Subject: EYE.NET: Mike Harris -- Roasted Alive Followup-To: eye.general,ont.general,alt.internet.media-coverage Date: 14 Dec 1994 11:00:20 -0500 Organization: eye -- Toronto's Arts Newspaper Lines: 160 Approved: eye(a)interlog.com Message-ID: <3cn4qk$ec0(a)gold.interlog.com> NNTP-Posting-Host: gold.interlog.com Summary: Ontario PC leader pulls net.related bonehead political stunt Xref: io.org eye.news:307 ont.general:20751 alt.internet.media-coverage:2470 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY December 15 1994 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ EYE.NET EYE.NET MIKE HARRIS: ROASTED ALIVE Clueless PC leader mercilessly flamed for net-related political stunt by K.K. CAMPBELL On Dec 8, provincial PC leader Mike Harris stood in the Legislature and introduced a copy of a post to the newsgroup ont.general -- a public forum where anything of general interest to Ontarians is discussed. The post in question was signed "Bob Rae." It talked about the sexual orientation of Marion Boyd, the Karla Homolka case, and a few other things. Harris wasn't claiming Rae actually wrote it, he was suggesting it was proof of a serious "security violation" in government computer systems. Simulataneously, the PCS issued a press release entitled "Our Premier: Roadkill on the Information Highway." We regularly warn Our Faithful Readers about eyeNET's Rule#1: When strangers approach wielding the "highway metaphor," run. Do not speak with them. Do not make eye contact. Last week, eyeNET predicted many new and entertaining adventures could result from Ontario's premier getting online. We expected the shenanigans would come from anonymous net.weenies and assorted loons, not Mike Harris. ARTIFICIAL BOB It began innocently on Sunday Dec 3, at 1:22:41 a.m. (EST), when an anonymous individual posted a message called "Greetings to People of Ontario's Information Highway" to ont.general . It was faked so the "From:" line said "premier(a)govonca.gov.on.ca", Rae's office. Ontarians read it. Ontarians ignored it. The general response was best summed up by Toronto's Val Dodge (val(a)io.org) who wrote: "Am I the only one getting tired of [these spoof posts]? OK, the first couple were funny, but this is getting really tedious." No one thought it was from Rae. No one thought it was from "hackers invading government computers." Netters just looked at the PATH line and could see the post worked its way to Ontario from a California computer. On top of that, in the header it plainly says: "This message is NOT from the person listed in the from line. It is from an automated software remailing service..." Fake posts are part of net.life, but this one wasn't even a "forgery" (a real attempt to pretend to be someone else), it was a "spoof" (an "imitation" no one is expected to believe). A parody. Hardly a "security violation," unless Harris thinks all political impersonators represent "security violations." What if terminally dense Americans thought impersonator Dana Carvey really _was_ George Bush? Oh my GAWD! Call the cops! Rae's staff had noticed the fake post. Like the rest of the net.community, they just ignored it. After all, even the stupidest elements of the net community hadn't been fooled... why worry? They didn't account for Mike Harris. Five days later Harris issued his now famous "Roadkill" press release which includes the line "Internet Bob: the hacker is hacked." PC press secretary, Peter Varney, told eye the Conservatives weren't trying to score political points. They sincerely thought this harmless post was a "threat to Ontario's security" -- though Varney couldn't explain why Harris attempted to grandstand. And it's exactly that attempt to make political points from the matter that most angers Ontario netters. Sensationalization and playing on the ignorance of the press (which was as rampant as ever). The PCs swear they never saw the very explicit disclaimer in the fake Rae post because the newsreader of the person who "slipped" them this oh-so-dangerous document edited out most header information. It's plausible -- many newsreaders chop stuff from headers (headers contain info to help direct and organize posts for ease of reading). But ignorance hardly excuses Harris. In our conversation, Varney, trying to save face, actually suggested the simple ability to make a spoof post (and fool Mike Harris, I guess) is still a "security threat." So what are they asking Rae to do about it? Call in the OPP and stormtroop around cyberspace? THE NET STRIKES BACK The net.community's responses in ont.general have been a virtually unanimous condemnation of Harris. Several threads (i.e., discussions) developed, the longest one entitled "MIKE HARRIS IS SLIME." It originated with Brampton's Evan Leibovitch (evan(a)telly.on.ca) who wrote he didn't blame the "impersonator" because "children will be children", but "the people who fed this item to Harris are absolute assholes... My respect for Harris and the Ontario PCs has just taken a nosedive, and I hope the scum who were behind this realize that they have scored *NO* political points for pulling this stunt." In another thread, Toronto's Jamie Mason (g1jmason(a)cdf.toronto.edu) wrote: "Anyone who has been on the net for more than about FIVE MINUTES would realize that the message was a forgery. Anyone who has been on the net for more that about TEN minutes wouldn't even take notice of the message." T. Kim Nguyen (kim(a)algorithmics.com) likened the Harris bluff to "the way he paraded the woman quitting her job to go on welfare last year. His antics of the last few weeks trying to make the NDP look bad have simply succeeded in showing how much of a ridiculous opportunist he is." GENUINE BOB Late Friday afternoon (Dec 9, 5:24 pm), the Premier of Ontario (premier(a)govonca.gov.on.ca) issued his first real post to ont.general. It was called "Thanks" and read, in its entirety: "Many thanks to those of you who flamed the PC pranksters. I knew when I went online that I would have to deal with fake posts and related chaff. That's the price of being on the Net. I'm not about to delete my account. I still want to hear from people with *real* concerns and *real* suggestions." Signed: "Bob*The Genuine Article*Rae" eye called the premier's office. They confirm it's real. The premier's office made it clear it won't launch any investigation as to where the parody post came from -- and for that it should be applauded. I've talked with many people who don't understand the net and when something they don't like happens they invariably respond: "I'm going to shut the Internet down!" The Rae team is doing it's best to fit into the net.community, not remake it. Varney, on the other hand, says the PCs will actively pursue anyone who "impersonates" Mike Harris online. FRESH ROADKILL! Oh no! Look! Just spotted in ont.general! A breach in PC security!! Alert! Alert! Call the newsmedia! On Dec 10, "Mike Harris" supposedly posted a missive called "Mike Harris Fights Back - Kiss My Ass Rae!" to the net. It reads, in part: "You listen here Rae, my sources informed me that your article was on the level. You sleazy NDP wimps are more than capable of resorting to cheap shots like this, so I thought I'd pin one on your grain-fed ass... DAMN I'm mad!!!" Signed: "Mike Harris, Progressive Consevative (sic) Party of Ontario." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Retransmit freely in cyberspace Author holds standard copyright Issues of eye in archive gopher://interlog.com Coupla Mailing lists available http://www.interlog.com/eye eye(a)interlog.com "Break the Gutenberg Lock..." 416-971-8421 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLvD223BFBj7pSNyhAQElcwf/Yv79UuYHOa8YJHDpZGHp8GlmD7WpoddK HaUr/EHvGJdB18UaSX99lZtLVDErFdrgk1xVvXQbIYAeLFpd1SmxMDUAqKUjqcMJ 4zZbqR7hKS66D++MRCWE/JCrxyEcyQPGXDNEXRel4XQZBv83FKI6qsLTccLfYaQN zozSr7CLjvM7Fv877znvLYQ/wvcvBRO4B1yCbj++/ENP4o7xL/BXSeoWYMJcdcFO X+qTqNj4b3A1YU6Phc5ciTHy/UeOUAtyWDAXXDmswXAkwDPWBUT3f0twJcIzjiRP RzkYASYIa21DYxhiR89vWL7NfcfnLYj7YHuG3Rc83wZLaxMhNLPCKw== =RZZ8 -----END PGP SIGNATURE-----

1 0

rng & program docs. programs
by Gary Jeffers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dear Cypherpunks, 1. I need a good DOS software random number generator for a crypto project of mine. Can anyone give me the ftp site & other d/l info. of something good? 2. Also needed, is some software documentation tools. - shareware or free. Here's the problem: I program in PC Assembler & C & although I program structured & use modules, I find that when I have a lot of subs that if I pick out anyone of them, that I have a hard time relating it to the rest of the code. That is to say: if I start out with say 3 major modules & have them call subs that call subs that call subs, then when I examine anyone sub, it is hard to understand its relation to the rest of the code. Anyone recommend a program with an ftp site or have any helpful info on this? Yours Truly, Gary Jeffers Following is my military grade public key armored. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy7wt2IAAAEEALQ+0QCeQIMNCBGQtZxPtLE1z9ltqDVCy5h6tpic6RsmgcFS kp92CV3Vptmr7/jqb+SMJ8HUYV7XAz1I1sDEjYrJ3vP9UZh0gTlUDW/lEosZ8mjH ott/uurW9hw8/nPnQNRzcJIHpdkcHtjJwvTB4v5BBr94oKy7JthOFCSMI5OVAAUR tC5HYXJ5IExlZSBKZWZmZXJzIDxjY2dhcnlAbWl6em91MS5taXNzb3VyaS5lZHU+ =+0yw - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLvC599hOFCSMI5OVAQF+wwP+IIIuNJD9grm+YhhhkcOeKEi0+aFI253a rW1JaBblgCOEHBuQmyfbeRqRIPHz5PUZat2u0WcSmzgX6CH4B2rEggUTZ/vBss7e o7fCNKGLebFQ690iV+B70WG/7+cp9jqYAwbfJSLuDubD8oLFvOr9/4EPTo/oEFLz FwM40K8w3M4= =nkPn -----END PGP SIGNATURE-----

1 0

Re: Zimmermann Defense Fund Appeal
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

On Wed, 14 Dec 1994, Hugh Miller wrote: > [...] > Phil deserves the best justice money can buy him. So this is the current state of your legal system. Oh dear.

5 4

Re: FV & PGP (was Re: First Virtual email security)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks for the clarification - I missed that part. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvDgUCoZzwIn1bdtAQEyiQF/edj0wFAtJz50I9VQpRFpz7pMFKL6ffIo /QiLNqjus8bKRStqz5hr2obb8w7OoBlw =JFF+ -----END PGP SIGNATURE-----

1 0

Many-Hop Remailer Ping Messages
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Some agent periodically sends out several hundred line remailer ping messages (unencrypted) with many hops planned; a sample is included below. It would be nice if the parties responsible would remove my address (and, for example, Eric Frias' address and the leri address) since I'm not operating a remailer at this address any longer. Adding in the newer remailers might be a wise move if this is supposed to produce results representative of the entire remailer bramble. In the immortal words of Kibo, "PLEASE UPDATE YOUR COSMIC PARAMETERS." Thanks. - - -L. Futplex McCarthy Forwarded message: > To: lmccarth(a)ducie.cs.umass.edu > > :: > Anon-To: remailer(a)ideath.goldenbear.com > > :: > Anon-To: remail(a)leri.edu > > :: > Anon-To: efrias(a)csugrad.cs.vt.edu [many lines omitted...] - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvDfr2f7YYibNzjpAQEIygP/cQrEeELKjsqFjzEj7vD7R0/NfZQ52H8G WhHF+11aQfYN+XJYKv/Ah8/ifyxHNhwjaidk3GS3IEkVganOUv7Ay3ax4HsZiR/J vkSKL0tW7YB2ZM4faL+Z4y71P6190VzERu4Wsuku89KLxEhGvSLGSZQOQamK3LgG 938B9PolQmg= =gyVz - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvDg/ioZzwIn1bdtAQG6mgF+IxsKDp5IhQnSGEivFBuXBhX7lS44Unvs DKzub0n5Zsu/D1cSAAKGoE8zYUXQq4mi =U3vB -----END PGP SIGNATURE-----

1 0

Algebra
by A5713643665＠attpls.net 17 Dec '03

17 Dec '03

Dear Eric and Cypherpunks, So, how is division defined in Fp? Tom

4 3

Less Flaming, More Civility
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Folks, the level of flaming and gratuitous insulting (insultations?) is getting in the way of our message. We have on our list folks from Netscape, First Virtual, and (maybe) Digicash. Amongst others. And we certainly know that some of our messages are being forwarded to others. It behooves us to bear this in mind. If we can't calmly and clearly make our points about why privacy is important (and I mean in the sense of personal responsibility, not just the buzzword), about why end-to-end encryption is generally better than transport-level security, and about why "certifying authorities" is (to many of us) a flawed approach, then we are failing. More concisely, the Cypherpunks list is one of several "watering holes" that have appeared. Rather than trashing schemes which are not "'punkly correct" (PC, to coin a term), or which seem to have been put together in haste (perhaps for good reason)), we should instead use this golden opportunity to influence things. Call me an elitist, but I think the Cypherpunks list has an important role to play in influencing: -- Web development (Netscape, InterCon, others) -- digital cash (DigiCash, First Virtual, others) -- key escrow policies and plans (TIS, Microsoft, etc.) -- the future of PGP, tools, etc. -- etc. These things will have more of an effect on the future than convincing Aunt Erma to encrypt her mail. It may be that the comments made here about the security model of Netscape and First Virtual are on the mark, that these models need a lot more work. But I don't know see how insults or derision, or imputing bad motives to these folks, will help. (I think I was careful this past motive to avoid slinging mud at Bill Gates, for example, during the debate about reports that Microsoft could be including some form of key escrow in future OS releases. Not to say I've never flamed...) One lesson that's become clear is to expect that derisive comments made here will often find their way back to those derided. I always write with the expectation that folks as disparate as David Chaum and Dorothy Denning will perhaps be reading my words! (Hi, David! Hi, Dotty!) They may read them because someone forwards the messages to them, or because in 1996 the Cypherpunks list is sold on CD-ROM, or because one of them has access to the main NSA search engines (:-}). Whatever, my point is that insults are rarely helpful, and are unpersuasive. Insults also set a tone for later debate that is hard to get beyond. Not all debate recently has been insulting, of course. In fact, most hasn't been. But the insulting tone persists in some of the thread titles, and in the generally adversarial nature. (If I were Marc A. or Kipp, I'd not feel very welcome here....a situation which is counterproductive to our presumed goals.) Hal Finney nicely summarized why folks want some privacy on Web pages, and why transport-level security is generally less desirable than end-to-end security (including the special case of anonymous origination). This is the usual "who do you trust?" motif, which comes up in mail delivery _and_ in key certification. (Sidebar: In my view, Web browsers like Netscape and Mosaic, etc., should not get overly involved in these issues. These are issues for Web page owners to worry about and set policy on. The browsers may want the right hooks in them to allow authentication policies to be implemented, but the browser-makers should probably stay out of the gory details of which crypto algorithms are used, what access policies are set, etc. This makes it easier to drop-in stronger systems at a later time. I may be misunderstanding plans, I admit.) So, this is my little rant on "Can't we all just get along?" expressed in a different way. The Cypherpunks list has become one of several de facto "watering holes" where diverse participants interact. Let's not blow it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

14 33

Re: McCoy is Right! New Mail Format to Start Now.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

The thread is back... Tim wrote: >I deeply resent--but will try not to take it personally, so no >animosity to Perry or Jim or others is intended--the insinuation >through sarcasm or through direct statements that I am hopelessly >wedded to a past of ASR-33 terminals and good old-fashioned >typewriters. Like a lot of folks here, I use stuff that's far beyond >simple ASCII. I think I've adequately covered this point. After reading many of your posts on the MIME issue, I have come to the conclusion that you _are_ wedded to a past long gone. I have not give up the hope that we will one day convice you stop accessing the net via the worst possible interface, a terminal server. The way you are using the net is through 1950's technology with 1950's results. You say that you use stuff that is far beyond ASCII and I believe you. However, one wouldn't know from hearing what tools you are using to access the net. You are competent, a computer person, but still you don't seem to understand that reading mail via a terminal server and elm is like having an oxen pull your car. >Eric Hughes wrote a nice piece several weeks back about adoption of >new technology, new tools all being a matter of _return on >investment_. >For example, I could spend some number of hours switching from my >current mail progam (elm) to some other editor which perhaps >better-supported the MIME messages seen here. But if all I got for >several hours of using, learning, and becoming comfortable with, say, >"pine," was the ability to see an _italicized_ word, or a word in >Cyrillic, then I would consider this a poor ROI. You got Eudora. Setting up tia ($25) on your account and downloading Newswatcher, etc. takes less than an hour. In fact, I will gladly do it for you. After the clients are set up on your own machine, there is no reason to go back to using the shell. I have used the shell *two* times in the last three months. -- To change my password. You wouldn't have to change your workhabits. You could still read news, answer email, and surf the web all at the same time. In fact, you could do it better and easier than you do it now. >And nobody has yet said there's anything worth doing this for in any >of the MIME messages I've yet seen. Sure, Amanda W. exercised the >process by including a GIF....a process which several people saw >errors with, and no doubt many others skipped completely. > >Does this make me backward? No. It's all ROI. I have AppleScript droplets on my desktop for all the people I work with. Drag the spreadsheet icon on it. Hit "Queue". They double click on it on their desktop. Happens every day. >Like it or not, we are now in a mostly-ASCII Net environment. This >shows up when people fail to convert special characters (apostrophes, >left and right quotes, em dashes, bullets, etc.) into the "straight >ASCII" characters (such as ', ", --, *) that most of the rest of us >can display easily. People right complain about posts and messages >filled with "^H" and other oddball symbols. This list is email and, yes, it is in ASCII. There is little reason to change that. But that doesn't mean that most of the net is in ASCII. I spend less than half the time that I am on the net in a pure ASCII environment. And it is getting less every month. >(And it certainly doesn't mean that people like me don't have the >capability of displaying extended character sets....I clearly can, >given the right tools, effort, etc. Many can't, and many won't. The >"Display Postscript" standard was an attempt to bootstrap the world to >a new standard for document display, and it failed. Maybe the "Andrew >Message System" is another such fix. Maybe it's even better designed. >All well and good. But it ain't available to most of us. Nor would I >even install it if all I got was em dashes and the like displayed >correctly. ROI, again.) I hate to break it to you, but it is no longer "most of us" who don't use these tools. And of the ones that don't use them, only very, very, few don't have them available. >Please don't characterize my views as Luddite wishes for a simpler >world. I don't think that you are wishing for a "simpler world". I believe that you haven't realized that the "simpler world" has long vanished in the dust of history and that you are one of the last hold outs living in an era past. Please don't be the last to leave. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

2 1

Remailers and Keyservers, active ones?
by Black Unicorn 17 Dec '03

17 Dec '03

Is there a list of the currently active remailers and key servers? -uni- (Dark) 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1