December 2003 - cypherpunks-legacy

Re: BofA+Netscape
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> Would you mind elaborating? Sure. Netscape has managed to alienate many IETF working groups, including HTML, HTTP Security, IP security, and so on by implementing and distributing half-cooked "extensions" to HTML & HTTP without a lot of forethought. As a result, they've greatly multiplied existing interoperability problems, and created a very confused environment in precisely those areas that most need standardization and consensus (security and HTML itself). That help? --Amanda

1 0

Four11 Free Listing Thank You - KEEP THIS MESSAGE!
by mailbot＠sled.com 17 Dec '03

17 Dec '03

========================================================================== _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| FREE LISTING THANK YOU _____ / /__/ /__/ / \ _|_ _|_ KEEP THIS MESSAGE! ========================================================================== THANKS Thanks for adding your listing to the Four11 Online User directory. We hope you find this directory a helpful resource and we encourage you to send any comments about the service to comments(a)Four11.com. If the directory puts you in contact with a lost friend or colleague, please let us know. Please send your friends a copy of our free listing form or direct them to our home page at URL http://www.Four11.com/. YOUR PASSWORD Below is your password. PLEASE KEEP A RECORD OF YOUR PASSWORD IN A SAFE PLACE. You will need it for searching the directory, changing your listing, and accessing other free services. You can change your password by sending an e-mail to change(a)Four11.com. Remember to include you current password as the body of the message. Your password is "thibsi". YOUR LISTING Your listing will appear in the directory, usually within 24 hours, but you can access the directory immediately. For complete information on the services now available to you, send an e-mail to info(a)Four11.com. TO SEARCH To search the Online User Directory, connect to our Web page at URL http://www.Four11.com/ or request an e-mail search form by sending an e-mail to finduser(a)Four11.com. TO OBTAIN SOMEONE'S PGP KEY To obtain someone's PGP Public Key, connect to our Web page at URL http://www.Four11.com/ or send an e-mail to key(a)Four11.com and include the person's e-mail address as the body of the message. ========================================================================== * Online User Directory * PGP Key Server * _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| info(a)Four11.com _____ / /__/ /__/ / \ _|_ _|_ http://www.Four11.com/ SLED Corporation * humans(a)sled.com * (415)323-2508 * Fax: (415)326-0730 ========================================================================== (c) 1994 SLED Corporation, All Rights Reserved chief nerd has spoken

1 0

Four11 Membership Form
by mailbot＠sled.com 17 Dec '03

17 Dec '03

========================================================================== _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| MEMBERSHIP FORM _____ / /__/ /__/ / \ _|_ _|_ ========================================================================== In response to your recent request for free access to the Four11 Online User Directory, you have been sent two messages via e-mail. The first message includes your password and this message is the second. If you do not receive your password within 24 hours, please contact us at support(a)Four11.com. We hope you find the Online User Directory a helpful resource. If you find this service useful and wish to support it as well as take advantage of additional features, please consider becoming a member. A Four11 membership provides the following benefits: + Expanded Listing With Alternative Names And Display Message + Additional Group Connections + Search Agents + PGP Public Key Certification And Storage On Key Server + Hot Link To A Personal Web Page If you wish to become a member ($20.00 USD), follow the instructions on this form. If you wish to learn more about these benefits, send an e-mail to info(a)Four11.com. ========================================================================== PGP USERS If you are a PGP user and wish to store your public key on our key server, request a special membership form by sending an e-mail to upgrade-pgp(a)Four11.com. All others should use this form. ========================================================================== THREE STEPS TO A MEMBERSHIP 1. Pay a sign-up fee ($20.00 USD) which also covers the first year of service. (Our current yearly renewal is $10.00.) 2. Receive a notification from us via e-mail. 3. Enjoy your member benefits. ========================================================================== PICK A PAYMENT OPTION BELOW: TO SIGN-UP BY PHONE (VISA and MASTERCARD ONLY) Call (415) 323-2508 BEFORE CALLING, please read the Acceptable Use Policy below. TO SIGN-UP BY FAX OR MAIL (VISA, MASTERCARD, OR CHECK) 1. Print a copy of this form and follow the remaining instructions. 2. Read the Acceptable Use Policy at the end of this form. 3. Please check the name and e-mail address below. If not correct, CLEARLY print the correct information in the space to the right. Please do not cross out the original information. Name: Anne E Mous Primary E-Mail Address: cypherpunks(a)toad.com 4. Print Your Day Time Phone Number Clearly: ____________________________ (In case there is a problem with your order.) 5a. If you are paying by credit card: Total Charges: $20.00 USD ( ___MC, ___ VISA ) Credit Card No. (PRINT CLEARLY): ______________________________________________________________________ Expiration Date:_______________________ Signature:____________________________________________________________ Fax this entire form to (415) 326-0730 or mail it to: SLED Corporation PO Box 309 Redwood City, CA 94064 5b. If you are paying by check: Mail this entire form with a check for $20.00 USD ($27.00 CAN) to: SLED Corporation PO Box 309 Redwood City, CA 94064 When we have processed your payment, we will send a notification to your primary e-mail address. Thanks for your business! ACCEPTABLE USE POLICY Four 11 Directory Services are offered by SLED subject to rules governing the use of these systems and related services. By subscribing to and using Four11 Directory Services, you agree to pay all applicable fees and to abide by this Acceptable Use Policy and applicable rules. 1. You agree to use your own name and other personal information. 2. You agree to not use the system for any purpose that is illegal. 3. You agree to not use the directory to contact persons in a way that they find objectionable. 4. You agree to not copy information from the database for commercial purposes and/or financial gain. 5. SLED reserves the right to terminate a users access to the system. 6. SLED makes no warranties. Additional information can be obtained by requesting our FAQ (send an e-mail to faq(a)Four11.com or connect to URL http://www.Four11.com/) If you have any legal questions or concerns, please read the FAQ. ========================================================================== * Online User Directory * PGP Key Server * _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| info(a)Four11.com _____ / /__/ /__/ / \ _|_ _|_ http://www.Four11.com/ SLED Corporation * humans(a)sled.com * (415)323-2508 * Fax: (415)326-0730 ========================================================================== (c) 1994 SLED Corporation, All Rights Reserved chief nerd has spoken

1 0

Children's Books Mentioning Privacy
by DarScott＠aol.com 17 Dec '03

17 Dec '03

On Tuesday I will be giving a talk on Children's Books with Freedom Themes, but I have not found anything on e-mail privacy or privacy in general. Any suggestions? Fiction or Nonfiction. Dar Scott

2 1

Re: Netscape competence
by amanda＠intercon.com 17 Dec '03

17 Dec '03

Excuse me, but Adam Shostack didn't write that paragraph you quoted. Amanda Walker <amanda(a)intercon.com> did, as I recall. Nope, Adam wrote it. I just followed up to him with additional vitriol :). Amanda Walker InterCon Systems Corporation

1 0

Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

Several people have asked me to clarify my recent comments about Netscape. I am more than happy to oblige. First of all, let me begin by saying that I am a biased observer, and that all of this is my personal opinion. My annoyance with Netscape is also closer to the surface this week than it normally is, due to a variety of factors (including having just returned from the San Jose IETF meeting). My initial comment, and the ones that follow in this message, are thus more frank than is my usual style on, say, public Usenet newsgroups. That being said, here are some of the data that has gone into my impressions of Netscape so far. (1) Netscape plays very fast and loose with HTML. Rather than participating in the existing standardization efforts, they have indiscriminately added "extensions" to it that are not supported by any other client software, and which in some cases go directly against HTML's markup-oriented structure. This only adds more confusion to an already muddy area, delays the prospects for a standard HTML specification, and divides the WWW into "WWW Classic" and "Netscape-compatible". Personally, as a strong proponent of universal interoperability, I find this reprehensible. There is no need to bypass existing efforts just to add cosmetic value to your own software. (2) The Netscape Secure Sockets proposal has an extremely poor security model. It is not an end-to-end security model, but rather relies on transport level security, which is in my view dangerously inadequate for reasons which should be obvious to most of the folks on this list. It is also tied directly to the RSA certification hierarchy. Now, for those of us who have X.509 certificates rooted in the RSA Commercial Certification authority, that's fine, but it also means that any other WWW client that wishes to interoperate with Netscape's "secure servers" must license TIPEM from RSA Data Security, and consequently pay RSA's rather high royalties, unless the software is free (in which case RSAREF can be used). This serves as a direct barrier to competition from other commercial vendors. This is not all bad--I happen to like RSADSI's products and technology--but promoting a transport-level security system instead of an end-to-end one is to my mind simply irresponsible. There has been no peer review of Netscape's security model--it was simply implemented by fiat, without regard for the IETF standards process. I find that this leaves a very bad taste in my mouth. I also heard similar sentiments from a wide variety of other attendees at the IETF, including members of the IP Security working group, people who attended the Secure HTTP BOF, and others. This leads me to believe that it's not just a matter of me leaping to wild conclusions. (3) Netscape is viewed as a "loose cannon" by most of the other commercial players in the WWW arena, mainly because they have introduced a fair amount of FUD into the HTML standardization effort, while simultaneously promoting themselves as being standards-based. Members of Apple's "Cyberdog" project and Microsoft's web projects, who *are* trying to contribute to the standards process, had particularly excoriating things to say in this regard. Now, as I said, I am biased and my comments about Netscape are strictly my person opinions. I will be perfectly willing to revise these opinions as I receive more data. For example, if Netscape takes a more active part in the standards process, works with RSA to secure wider availability of the underlying technology required by their proposals, and generally demonstrates a willingness to play nicely with other children, that would be great, and I'll just as strongly defend them as I am panning them now. However, in my view, they have not shown a good initial track record. Only time will tell. Amanda Walker InterCon Systems Corporation

1 0

The Four Horsemen
by Mats Bergstrom 17 Dec '03

17 Dec '03

>From the recent essay "Anarchy" by T.C. May: The use of encryption by "evil" groups, such as child pornographers, terrorists, abortionists, abor- tion protestors, etc., is cited by those who wish to limit civilian access to crypto tools. We call these the "Four Horsemen of the Infocalypse", as they are so often cited as the reason why ordinary citizen-units of the nation-state are not to have access to crypto. A problem with the Four Horsemen is the various definitions currently in use on the Net. Two of them are generally agreed upon: Drug Dealer and Terrorist. Usually either Pedophile or Pornographer is the third. The fourth varies the most: Tax Evader, Spy etc. Abortionist and Abortionist-Killer are new prospects. Who were the Original Four? (No, I'm not asking about White, Red, Black and Pale.) Mats quit

2 1

Real-time surveillance of the police
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the December '94 issue of Wired, ("Watching the Detectives", p. 141), Sandy Sanfort describes Bob Fleming's work to make real-time permanent recordings of the body positions of police officers. One could place a small sensor on each wrist and ankle, and record the positions (and velocities) of the cops body to with a _centimeter_, anywhere in a city. The advantage for cops is that a fallen officer can be quickly located, and a cop's claim to have witnessed an event can be corroborated by demonstrating that he was actually there. The advantage for society is that the cop's behaviour, such as billy-club swinging velocity, can be monitored. It could detectgunfire, too, by measuring the kick that is transmitted down the cop's wrist. This would work to the extent that the equipment is actually mounted on the cop it claims to belong to, so some manner of authentication would be needed. Also discussed is the idea of car or helmet mounted cameras, transmitting images continuously, to be stored by a neutral third-party, in the event of a legal challenge, either from the accused claiming that the cop is lying, or of claims of police brutality. After the Rodney King incident, I had the notion, (which I did not act on to actually promote, I'm sorry to say), that organizations representing people that feel persecuted by the law could issue disposable cameras to all there members. For example, if a street gang felt the cops were thumping their members with unwarranted enthusiasm, the gang could purchase a case of cameras at the local Price Club, and everyone could carry them to photograph the cops. In addition, cameras could be unobtrusively mounted on car hoods, perhaps with three or four such cameras multiplexing their images onto a single videotape (one wants a wide, but not necessarily tall aspect ratio; three such cameras with fisheye lenses could cover the hole perimer of a car). The VCR would be in a fireproof safe welded to the car frame (or use a surplus flight recorder package), so it would take extra effort for a cop to conceal the evidence of wrongdoing after mistreating the driver. It would also be handy for assigning responsibility in traffic accidents. Yes, that's right - keep surveillance cameras going on _yourself_. If you're not doing anything illegal, you've got nothing to fear from taping everything you do. Of course, after the difficulty the City of Santa Cruz had in establishing a Police Review commission, and considering that its powers were eviscerated in light of a lawsuit threat by a police union, I expect that it will be difficult to convince our Nation's Finest to adopt this new technology - though I'm sure they'd be happy to apply it to parolees and those serving on probation. Adoption could be initially achieved, though, by pointing out to private security firms that their liability could be reduced by monitoring their employees - obvious slackers could be immediately fired, troublesome guards could be disciplined, and the firm could demonstrate in court that the guard was nowhere near the scene when the plaintiff claimed to have been beaten by a guard. Private security guards have nowhere near the influence that police unions do, and so would have little power in arguing against it. Later on, cities faced with expensive lawsuits could strike a deal with the liability insurance companies to save money if the city cops use this stuff. After the DT fiasco, and the mention yesterday of the DOJ's new Big Brother Database, I thought you'd like to hear that someone's working on giving Big Bro the stick too. I personally feel that a society that _needed_ to do this to its cops is an abhorrent society. But perhaps we could strike a deal with Big Bro - if you don't tap our phones, we won't pass laws to tap your cops. Best Wishes in this Holiday Season, -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLusCMKJTibhK6XY5AQF+IAP+MCHtgnCbJc96lrOcoNt0HWal4nNF7JVN t6qIM6DDdGp5+IEimHTzgkUlUSZ4ojcIYEbjaae8Q58VRMOQ9zFaZlIWSeTTgZiQ wXIicZJreKeonTI0mwZauAbtmuEy3vWRp19Qf2fYwaMOY3QLy1vhTgG7g2iRpccI T6YspCxcYdw= =YK34 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy7JYr8AAAEEAJ4GpoYcH5abkSq5FZQ9LxoP9oKKQDXHRGZT8QCcnVZ8o87H p9kEaUJIyzGbMHpO7C09qShwcrII2VfCZ77iWlBglmdLEa/dKXRCSWMFF52RcSDh zJF8m0wE2SZ9x4Y6KuXM3RwJVdEKLhsAImxckvfj0UBvb5xtJ6JTibhK6XY5ABEB AAG0LU1pY2hhZWwgRC4gQ3Jhd2ZvcmQgPGNyYXdmb3JkQHNjaXBwLnVjc2MuZWR1 PokAVQMFEC7p5d9yRW2Du2TJYQEB7YMB/2ToOoN7aVNUnGyykxKAVjvMDcMGgSPM IR3+wUqzpAyH43tEwKBHStYj2jSlHimRXWi6lpvSwZ7rKsOtQoeSlnCJAJUDBRAu yWQXolOJuErpdjkBAaRSA/48+f7RqKXbsLJIEx8b0A0XuA/671B6L7PiC3BS5kMh QtIlRxFlgTLUp03D2TlbEyqoaJwwIjE71k3+V2rM712WGiDlQSRjtrU21/QDNzbZ C48r+pUBO7bLHe/16ED8tgsSONH+7DIdQGw6uN1v4aTiOk2HxgDHGa3RjEewbrfW 2w== =bZwx -----END PGP PUBLIC KEY BLOCK----- Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

2 1

What Happened to Xenon ?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Anybody know what became of Xenon ( qwerty(a)netcom.com ) ? I did a finger of his account and got back unknown user ... He seemed like somebody who was in the spot light , funny that he just dropped out of sight . ^X

1 0

Broadcasts and the Rendezvous Problem
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Seems to me that one of the fundamental building blocks necessary to a host of anonymous services is a means of rendezvousing in a manner that is not vulnerable to traffic analysis. The obvious solution to this is through the use of a broadcast medium. Has anybody created an alt.* group purely for remailer-associated rendezvous? If not, it seems like that would be a very worthwhile direction to pursue: with such a mechanism, nodes of a "remailer net" can surface and disappear with minimal disruption to the net. Folks spend a lot of time bemoaning the transience of specific instances of remailer nodes: why not turn this into an advantage by architecting a network of system that is resilient against the destruction and/or compromise of individual nodes? - -- Todd Masco | "'When _I_ use a word,' Humpty-Dumpty said, in a rather cactus(a)hks.net | scornful tone, 'it means just what I choose it to mean - cactus(a)bb.com | neither more nor less.'" - Lewis Carroll - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLut3AioZzwIn1bdtAQHocwGAq/KWiFGi2nJ4Kuve/0jUv1xX5aAJknWc NRfJUts3Y0PfKZZbSETEwYPNfX48O4TB =NIBb -----END PGP SIGNATURE-----

2 1