December 2003 - cypherpunks-legacy

IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

The Information Infrastructure Task Force (IITF) National Information Infrastructure Security Issues Forum draft report can be found at: http://ntiaunix1.ntia.doc.gov:70/0/iitf/security/fedrole.txt

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> Luckily, Netscape recently hired Taher Elgamal > and he's a smart guy. Unfortunately, he seems to be in a > position where he has to defend the fairly bad work they did already. When I first saw him speak at the Danvers IETF I thought "gee, does this bozo know he shares the same last name as a real bright guy"? I think it was Perry, for example, that pointed out that using one RC4 stream for each comm half was more-or-less obvious and standard practice. At last month's World Wide Web Consortium working group meeting on security, everyone trashed SSL. Everyone trashed the W3C for not just picking SHTTP but instead trying to invent something new that "borrowed from" SHTTP. Tahir was silent on the former, but didn't disagree on the latter. During a break, in the hallway he mentioned how he's gonna have to do some politicking back at the office, and that he's glad someone reasonable like him came, and not other folks he could name. > Netscape is a closed system. You can't write code for it unless you > work for Netscape. I thought they announced their intent to support java. /r$

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> I'm not sure what this is getting at. SSL does use a separate RC4 stream > for each comm half. Is this a suggestion that a single key should be > used for both directions? No. They were saying "look, we use two keys." And Perry went "duh." /r$

1 0

RE: Netscape the Big Win
by Pat Farrell 17 Dec '03

17 Dec '03

tcmay(a)sensemedia.net (Timothy C. May) writes: > * I use Netscape to read News. > * I use Netscape to access the Web. > * I still use Eudora to send and receive Mail. (Netscape can currently > send mail, but not receive it. This is likely to change soon.) I'm not about to argue that the web isn't the hotest thing on the net, which is the hotest thing in computing... But I've got a question that I can't resolve. The current trend is to bundle all types of functionality into huge monolithic programs. Add mail to netscape, add encryption, add ... Yet most of the computers people use are multi-windows, and soon most will even be multi-tasking. Why are all-in-one programs so preferable to using the windowing capabilities that are built into every X-window, Mac or Windows system? Why not use the best mail client, another best webcrawler, and yet another news reader? Microsoft has been preaching the use of OLE and component programs as its development vision for 2+ years, Macs have been popular for ten years, why is the trend still towards adding every possible bell and whistle to single programs? With components, it wouldn't be hard to have a universal Encryption/Signature module. It would get arround any propriatary restriction that vendors may or may not try to enforce ("can Netscape be extended or not" becomes moot). Is clicking on another icon really too hard? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

3 2

Re: Netscape the Big Win
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From: Hal <hfinney(a)shell.portal.com> | Subject: Re: Netscape the Big Win | | [ much complaining by .pm deleted ] | | Note though that neither SSL or SHTTP requires that the certificates come | from RSA. However the current versions of Netscape's browser do require this. | This has been the source of much complaint and Netscape has promised that | they will have some mechanism in the future to allow the user to | choose his certificate signers. I am not sure how far RSA will let them | off the leash, though. I do know that at the Netscape Spring Training I attended, that was the source of much consternation from the techies (who knew what it meant) and Mr. ElGemal was certainly aware of it. The thing that scared me was that most of the sales and marketing folks took the approach that I think we can expect from them: "What! That's ridiculous! Oh, it's only $230? Oh, okay. That's cheap enough." and then they went on their happy way. The one "advantage" to SSL that they were pushing over SHTTP was that SSL is a socket-level encryption mechanism, as opposed to protocol- level. It doesn't conflict with SHTTP except in terms of adding to the processing time. I guess I don't see why SSL is so awful from a crypto standpoint. Could someone a bit more educated on the nuts and bolts clue me in on its weaknesses? As compared to other schemes, perhaps? Thanks in advance, Steve Champeon Technical Lead, Web Services Imonics Corporation

1 0

P.S. re: IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

I am told by my local net expert that it should have been: http://ntiaunix1.ntia.doc.gov:70/iitf/security/fedrole.txt (but the URL I sent before worked for me). The report is dated June 14 -- but I don't remember seeing any discussion of it on the list. IMHO, it's very good -- gives passing mention of Clipper but doesn't push GAK. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Re: Free The World Web Server project.. :)
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

PE> > PE> would be discerned by a staffer in moments. Crap like this is called PE> > PE> > They should know, because they send form letters to constituents all PE> > the time, only they don't bother to vary it a bit. PE> PE> Misdirection. This has nothing to do with my point. The staffers will PE> STILL toss your stuff. After putting the appropriate tally mark on the sheet for the day's mail, and sending out the response letter, yep. I don't expect Jan Meyers to personally =ever= see my mail to her office. I only expect her gruntlings to put that mark under "no" for the ______ Bill. PE> > Meanwhile, back at the ranch. PE> PE> In other words, you are choosing to ignore me. Regardless of whether Not at all. I concede that letters do not get read by Anyone Important. I only want them to =count= the darned things, and the variations in verbiage, margins, fonts, etc. should be enough to get them classified as part of an organized letter-writing campaign, instead of a form-letter-signing campaign. That puts the mark in a different column. PE> you are paying attentoion, however, you will still not be able to Not only am I paying attentoion [sic], but I know from experience that the staffers at least have to pay enough themselves to know which form letter to send me in response to my Heartfelt Expressions of Concern. Without fail, I get that letter from Meyers' office, but only about half the time from Dole or Kassebaum. PE> > .. If one of our DC members can set up an PE> > Imail-FAX gateway, we can publicize some nifty Iddresses for folx to PE> PE> Perhaps people who can be bothered to spell out "folks" properly also When I am writing to people whose opinion of my spelling I give a snit about, I will spell it precisely as you indicate. If it annoys you, set up your copy of exxxon to do the transform, or put my name in your twit filter. Talk about misdirection.... But "folx" is exactly the kind of thing that tells the staffer that it is =not= a form letter, because a computer would not be programmed to use variant spellings, would it? PE> are willing to write letters that will be paid attention to. As you PE> seem to prefer to ignore the fact that you will be ignored, why are PE> you willing to spend effort setting up an "Imail[sic]-FAX gateway"? Because that gateway can be used to convert genuinely original, pseudo-original, or blatantly copied Internet mail, ^ ^^^^ May God have mercy on my soul for having coined an =original= abbrv'n. rather than merely rearranging the words and phrases that others frequently use, which would, of course, be Astroturf<tm>. I have never seen the Houston Oilers play football on faxes before.... which has no, or virtually no, marginal cost to most net.people, into actual paper, which, being tangible, has the potential to be counted as Natural Grass, and thus not contribute to knee injuries. * Abuse of power comes as no surprise. --- * Monster(a)FAmend.Com *

3 2

Re: Netscape the Big Win
by Peter Trei 17 Dec '03

17 Dec '03

TC May writes: > Frankly, one of the great boons of my current setup is that I can > completely get away from Unix tools and commands [...] >...my fingers are already forgetting the emacs commands! If I forget thee, O Emacs, let my right hand forget her cunning. If I do not remember thee, let my tongue cleave to the roof of my mouth; if I prefer not Emacs above my chief joy. (with apologies to the psalmist) Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 8:23 PM 7/20/95, Jon Lasser wrote: >And from what I've heard about HotJava (not seen it yet, can't comment >strongly) there needs another jump in PC power before it would be useful >at the home level. Part of why we were stuck with DOS for so long is >that it was what got the job done when the revolution happened. For that >reason, I agree that HTML/Integrated browser solutions are what we're >looking at, and at the same time don't have strong hopes for HotJava, >though I would like to see it succeed. Just to clarify, you mentioned "useful at the home level." I can't speak for Ray, but I certainly didn't mean HotJava (or PowerObjects, or OpenDoc, or Agents tools, etc.) would be used at "the home level." Such tools would likely be used at the programming level. As to HotJava itself, who knows? It's one of several tooks coming along. The key is that folks--millions of them at last count--are voting with their feet that they want the ball of wax that is "The Web" (Netscape or Mosaic, HTML, HTTP, browsers, automated handling of images and sounds, integrated Newsreaders and mailers, etc.). They, the millions of users, demonstrably don't want to mess with Linux, or FreeBSD, or PGPelm, or even simple, straight text PGP (that is, PGP not integrated with mailers, just standalone). They want ease-of-use and a semantically simple model of how things work. (This is why I like Lisp Machines when I programmed them for Intel, and why I was an early adopter of the Macintosh, and why Windows has been doing so well...and why Netscape is doing spectacularly well.) This is not an "OS War" I'm taking sides in, just simple truth about what people are buying, using, clamoring for. It's important to our longer-range goals to recognize these important trends, like them or not. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Lotus AmiPro doc
by piff＠world-net.sct.fr 17 Dec '03

17 Dec '03

I was recommended to you by a friend who told me that you may be able to help me decrypt or suck the password out of a LotusAmiPro doc. Your help would be greatly appreciated. Please email back me as soon as you can find the time. Thank you.

1 0