December 2003 - cypherpunks-legacy

Re: alt.anonymous.messages propagation
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Todd Masco writes: > Timothy C. May writes: > # Isn't this what "alt.anonymous.messages" is all about? > Alas, it is not available at MIT. I'll have to scrounge for a server that > carries it (volunteerings of feeds welcome!); Hmmm, does MIT get alt.anonymous at least ? I understand alt.anonymous was created to serve a purpose similar to that of alt.privacy.anon-server, but at the moment it's a de facto equivalent of alt.anonymous.messages. alt.anonymous is somewhat better propagated than a.a.m, from what I've heard. You should request one or both groups from the MIT news admins. If users there want to read the group, they'll likely be quite happy to carry it. I'm a fairly well-known regular in alt.config, and I believe I can probably recruit some prominent news admins to send booster newgroup messages for alt.anonymous.messages. Apart from that, it's a matter of people asking their local news admins to pick up the group if they aren't already carrying it. > Though netcom is our > IP provider, I'd rather not get news from them. Heh, I don't blame you. Although I heard they recently ditched alt.this.site.newgroups.everything (or something like that), they still carry virtually everything that gets newgrouped by anyone, accidentally or not. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuvzUGf7YYibNzjpAQHr7AP/WCfDofFHaj8JgOEIWM490zc5hPCQxSSV 2d1KZ61wVGsJEDGLdEMI1OT1cuZAgTzbs4HXd+Hi0z5gu/ZsynSpkxCQTfPr7RZV 4+wPSSVOiEK4rrwf95dfJsC7U+EZk8fUCd8gNX0dXVJKYe9n258oWlUNk8VkgNgM L6f+bXRX/VY= =B8La - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuv0uioZzwIn1bdtAQEbggF/ax15KwhS915RJ4eTZHpAPBS2W62tT8eK IniODiSMg+yqtueEQ7yTs8cny7RLOUYq =YTYr -----END PGP SIGNATURE-----

1 0

Re: Misunderstanding of Remail Headers
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Hal writes: > One thing I do notice on reading the discussion in can.politics is the > fact that despite the disclaimers in the message headers, some people > took this as a forgery attempt on my part. I wonder if it might be > necessary to insert disclaimers into the body of the message as > anon.penet.fi does, at least for messages to known mail-to-news > gateways. > > There was also a misperception that my remailer was an official effort > endorsed by Portal (again, despite the disclaimers). Note that it was > they who were contacted, not me (yet). This might suggest that it will > not be possible to cleanly separate the remailer operators and service > providers when problems like this arise. Both may end up being hassled > (time will tell whether I am). This is all too familiar to me. Although I still haven't heard the official line on the shutdown of Underdog following the Scythe spam, at least some people locally (including, crucially, my advisor) received the impression that I had forged (and authored !) the offending news articles in spite of the disclaimer headers. Furthermore, the spam might not have been a fatal blow if not for the fact that some people ignored the "complaints to <lmccarth(a)ducie.cs.umass.edu>" header and wrote directly to root or postmaster here. Everyone who actually wrote to me came away satisfied that I was taking appropriate action, as far as I could tell. I'll take this opportunity to reiterate that I'm no longer operating a remailer at this address. I wrote to Matt Ghio about a week ago asking him to remove my address from remailer-pings(a)chaos.bsu.edu, but I suppose he's busy with school these days. That list remains frozen with information dating from Nov.22. Karl Barrus mentioned something about chaos.bsu.edu having moved to chaos.taylored.com; perhaps this is part of the reason for the snag ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuv2yGf7YYibNzjpAQF/GQP/VNo06+qqYvQBhU0xAO+TpHx44OJX6dKI HWhW+zIA6Xp/UYKsql8Mfg7dhxesJ4JSdqkkjY8znqUrwp/CnOTo3qql0W/EOxYt l3f7kcHJWvr/gPO/rvtMgWbR2GRjkhaCa62ny/tgV+IGCKxDqCi25A4Y2x23KFDB JgiLP4c2hSc= =34zm - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuv4ACoZzwIn1bdtAQEkZwF/dL0lroedGXvGlNJFJ5W6Z0dm83yefrzq 9aRFW9Xh+2/cjvb5+OMY0Ol1uEnU5UaM =ygWU -----END PGP SIGNATURE-----

1 0

RSAREF for Perl Beta Testers Wanted
by Mike Ingle 17 Dec '03

17 Dec '03

RSAREF for Perl is complete and ready for beta testing. Does anyone want to volunteer? Using it requires Unix, Perl, and RSAREF 2.0. You do not need to recompile the Perl interpreter. It gives you conventional and public-key encryption, signing, hashing, and Diffie-Hellman as one-liners in Perl. Mike

1 0

RE: Real-time surveillance of the police
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Sandy Sandfort <sandfort(a)crl.com> writes: > Michael also argued that it might be more easily sold to private > security firms for legal liability reasons. This argument is > even more persuasive for police officers. Cities routinely pay > astronomical settlements, or fight expensive law suits, arising > out of alleged incidents of police misconduct. Frivolous > lawsuits would be quickly thrown out of court. Rogue cops would > be identified and thrown off the force. Works for me. Works for me, too, and one would think that it would work for cities, but experience shows that individual cops can rack up millions of dollars in legal settlement costs and still remain on the force. I heard some figure - this is quite vague, but hey, it's midnight - that a small handfull of cops in San Francisco had cost the City tens of millions, with individual cops repeatedly causing lawsuits, without getting fired. Why? Police unions. Settling out of court without assigning blame. City politics. Mayors that are former police chiefs. A clueless populace. Promises to do better next time. Now, I heartily agree with you that the police should be more closely monitored, and certainly cities have ample reason to avail themselves of this, but most cities do not even avail themselves of citizen police review commissions, because of the resistance the police have to it. In Santa Cruz, a proposal to allow an independent citizen panel to review police internal affairs investigations faced threats of lawsuits from the police union, and took _years_ to adopt. The commission we got has considerably less authority than was originally proposed. This is in a city reknowned throughout the nation for its leftist politics. If the People's Republic of Santa Cruz couldn't get a review board with real authority implemented, I doubt you'll convince the LAPD to put radio beacons on their thumping arms. Much as I think they should. Sandy continues: > Even with all these arguments in favor of wiring, I have a > sneaking suspicion the cops will not want it. Why? Though few > police would admit it publicly, my conjecture ... Well, my knowledge is that at least one cop wouldn't go for it - the cop we caught jacking off to a magazine of ill repute, parked in his patrol car on Yerba Buena Island in San Francisco Bay. Those rhythmic wrist-movements would show an unmistakable frequency signature back at home base. He sure drove off quick. Didn't even say hello. I say, > Yes, that's right - keep surveillance cameras going on _yourself_. If > you're not doing anything illegal, you've got nothing to fear from taping > everything you do. tcmay(a)netcom.com (Timothy C. May) replies: > This scenario is a likely way that "position escrow" will evolve, from > a voluntary escrowing (incl. timestamping, etc.). "Those with nothing > to hide" will agree to escrow their movements...this will exculpate > them in suspected crimes, etc. A slippery slope. I reflected on this a bit, and decided that if one were to implement "personal surveillance", a decent solution would be to encrypt the tapes. Use DAT tape instead of a VCR, and save MPEG's or QuickTime movies that have been encrypted with IDEA. The idea here is protection _from_ the police, to demonstrate that an officer misbehaved in the vicinity of my car, rather than to provide a record for use by the government. Needless to say, I wouldn't advertise that I actually had such a thing until I pulled the tapes out in a deposition, or sent them, decrypted, to the TV news. Again, I'm not saying such surveillance should be imposed, supplied or encouraged by the authorities, but that one might find some benefit in installing it oneself. Cheerio, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Re: Real-time surveillance of the police
by Rich Salz 17 Dec '03

17 Dec '03

>After the Rodney King incident, I had the notion, (which I did not act on >to actually promote, I'm sorry to say), that organizations representing >people that feel persecuted by the law could issue disposable cameras to >all there members. A couple of years ago, when he was getting one of the first Rebok international humanr rights awards, Peter Gabriel talked about how one of the organizations he is affiliated with was planning on doing exactly this kind of thing. If you think about it, it's not unlike the driving thrust of Amnesty International.

1 0

Re: Globe and Mail Article On Forged Posting
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Mark Terka writes: > Ok, here is the text of the story about the "Forged Bob Rae Posting" from > the Toronto Globe and Mail. An examination of the story only indicates how > far our journalists and politicians have to go in understanding the Internet! Indeed. Let's examine some of the apparent misconceptions.... [quoted text from here to the end is from Rusk & Mittelstaedt of the Globe & Mail] > A furious Mr. Rae criticized Mr. Harris outside the legislature, > accusing him of leading to the "Americanization of Canadian > politics" through the use of "dirty tricks. (ouch :) [...] > Ont.general is a computer bulletin board on which Internet users > discuss life and public issues in the province, said Larry Sherman, > president of Internet Seminars of Woodbridge. > A message can be removed from the board only by whoever posted it, No, anyone with a moderately flexible newsreader and a little bit of knowledge about news control message syntax can cancel someone else's article. Tying this in to the discussion about using a newsgroup as a message pool, notice that news articles are far easier to wipe out than mail messages. This is potentially a major vulnerability of any such system, given current news software. Widespread unauthorized cancellations (other than for spam) are greatly frowned upon, though, so a concerted attack would probably set up a major clash of powers on the net. [...] > The source of the message was an account that provides a service > that allows people anonymous access to the Internet, she said. mail forwarding =/= net access > Mr. Sherman said it is very easy to post a false message on a > bulletin board and to make it appear that it came from a computer > different from the one that sent it. True, but that's a claim about forgery, not remailing; this is a worrisome confusion of terms reminiscent of the hacker/cracker problem. > By going through a California bulletin board, "obviously someone > has gone way out of their way to send that in," Mr. Sherman > added. One hopes that Internet Seminars pres. Sherman isn't responsible for the absurd implication I infer from this: sending mail via a geographically distant site requires going out of one's way. Is there some more sensible interpretation ? It seems obvious that someone posting an article purporting to emanate from the Canadian PM would try to transmit it with some level of indirection. [...] > Last months, the Tories played pranks at an NDP convention > sending in a camera crew that shot pictures ridiculing Mr. Rae, > including a doctored video sequence that seemed to give the Premier > a stutter. The picture were broadcast as dinner-time entertainment > at a Conservative convention the same weekend. Who's learning slimy politics from whom ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwUnmf7YYibNzjpAQHqQAP+LPVNyr0dFCMDlSmF9GiLzK6ODmCgpopC Pke/Qk9esB+vWA5bPpxtbD1Z61rCGJgvZU++g1+vovmbcSzduoQMauEKKoX5+V9m oGEcfyvu1KqnsVL83jN6YHTMANs/DxHCPVf8jWusJOgQJ+LzZN9xPxlcKDBRFiS1 wyBTHvaOlaQ= =Lism - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwV9yoZzwIn1bdtAQHkUAF/QCXYBhzma2Y8rrT+hWnIeZYkjlNzi+8s Nf3pPrzjc34nCOsxcwz9aJ9AjhPvWJEV =wOms -----END PGP SIGNATURE-----

1 0

Re: News->Mail & CMU's Andrew Message System
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Todd Masco writes: > I don't see a problem. Broadly put, news is broadcast e-mail. There are > many sites which in fact do not distinguish between the two, the most > notable of which is CMU's Andrew Message System: the admins of such > systems believe the "experiment" to be an all-around success. Is the AMS software (or some similar system) available as freeware or shareware somewhere ? I'm considering the possibilities for anonymized subscription to newsgroups through a mechanism like this. Come to think of it, many newsgroups are gatewayed to related mailing lists for readers on BBSes and such; I need to search a bit for the software used to do this. I'm curious how such systems deal with cancellation messages; presumably they would simply have to drop them. This would partially eliminate the threat of spam-of-cancels attacks I mentioned earlier. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwcj2f7YYibNzjpAQEFgAQA0NujNGNOBBLyhPvCL09CmGn1atDbckX+ 98e5iSm+BMJNeD++m55uLl+8jk5HugNmu4M3/cYDq3fwff6d2lLczBQlHTPRxz3E JGKrB8Ho0scxHbvv70UL2SYHR22JQJk/GQWmx91wwdWb27maTW2QWVRtraQzLBaR EJJzpj29Iyo= =mIVa - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwdyioZzwIn1bdtAQEThAGAuTkPjJ+9wOwl5PnTJUnZ8BK1XDEcoKyY NR9OCOYqzWz3NWk944ypq4ZX1z8w5Eyw =0Fo0 -----END PGP SIGNATURE-----

1 0

Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

In the Jan 95 issue of Dr Dobbs Journal, you will find the following: An editorial on the public release of RC4 (without code). An article by me on GOST (with code). An article by Ron Rivest on RC5 (without code). Remember, you can export cryptographic source code in paper form. Bruce

5 4

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 12 Dec 94 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- xs4all remailer(a)xs4all.nl ***+*-+***** 9:24 99.99% usura usura(a)xs4all.nl ***-*-++**** 10:38 99.99% alumni hal(a)alumni.caltech.edu +*+**+**+*** 7:33 99.99% penet anon(a)anon.penet.fi ++**+******* 29:39 99.99% c2 remail(a)c2.org +++-_--+++-+ 58:05 99.99% flame tomaz(a)flame.sinet.org +*++******+- 14:55 99.98% nately remailer(a)nately.ucsd.edu ++++++++++++ 32:43 99.98% portal hfinney(a)shell.portal.com ************ 4:17 99.97% jpunix remailer(a)jpunix.com +*++***** +- 14:42 99.96% myriad remailer(a)myriad.pc.cc.cmu.edu **+********* 5:32 99.94% vox remail(a)vox.xs4all.nl ---------..- 14:16:12 99.99% rahul homer(a)rahul.net *********** 5:06 99.88% bsu-cs nowhere(a)bsu-cs.bsu.edu *+-***-**++ 22:31 99.82% mix mixmaster(a)nately.ucsd.edu -+-+-++**+++ 32:50 99.80% ideath remailer(a)ideath.goldenbear.com ******-*++ 29:24 99.82% desert remail(a)desert.xs4all.nl -------.--- 10:57:50 99.99% extropia remail(a)extropia.wimsey.com --+++---.-+ 5:00:06 99.68% rebma remailer(a)rebma.mn.org *-..-.-*--- 10:34:53 99.71% soda remailer(a)csua.berkeley.edu .-......_. 11:45:06 96.63% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

Re: Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

> > Ian Farquhar writes: > > Around the mid 1980's a rather interesting device appeared. It was > > essentially an automated scanner for high-density barcodes. > > A recent mini-article in "WiReD" mentions a barcode-like encoding > mechanism being promoted by (I think) Xerox. It's apparently denser > than barcode and it survives copying well. The Xerox technology is essentially a series of tiny slashes and backslashes. The slashes stand for a 1 and the backslashes a 0 - or vice-versa. This gives you a binary data stream that you can work with. From what I understand, without looking at them closely, the area with these slashes looks like a gray screen. When I first read about this technology a couple of months ago, it was given as a way that sufficiently smart color copiers could restore original color to a black and white copy. Of course there are all kinds of other applications.... ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0