December 2003 - cypherpunks-legacy

Wall Street Journal Article
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

This may have been mentioned, if so please ignore. There was an interesting article in Thursday's Wall Street Journal calling for the end of anonymous communications on the Internet. It is on page B1 under the "Personal Technology" column and was written by Walter Mossberg (mossberg(a)wsj.com) who invites comment. Just a couple of quotes: "When forums operate under the cloak of anonymity, it's no differenct from printing a newpaper in which the bylines are admittedly fake, and the letters to the editor are untraceable." and "It <anonymous communications> makes it easier to spread wild conspiracy theories, smear people, conduct financial scams or victimize others sexually." He goes on to discuss the other two BIG problems on the Internet, those being "Incivility" (flaming for breach of netiquette) and "Censorship" (cancelling of spams). Dale H.

1 0

CIAC Bulletin F-09
by John Young 17 Dec '03

17 Dec '03

[Note: Document reformated for mailing by jya(a)pipeline.com. If in doubt contact CIAC for original: ciac.llnl.gov:/pub/ciac/bulletin/f-fy95/f-09.ciac.(doc).] ________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ _________________________________________________________ INFORMATION BULLETIN Unix /bin/mail Vulnerabilities January 27, 1995 1030 PST Number F-09 _________________________________________________________ PROBLEM: The Unix /bin/mail utility contains security vulnerabilities. PLATFORMS: DEC OSF/1 1.2, 1.3, and 2.0 DEC Ultrix 4.3, 4.3A, and 4.4 SCO Unix System V/386 Release 3.2 OS Version 4.2 SCO Open Desktop Lite Release 3.0 SCO Open Desktop Release 3.0 SCO Open Server Enterprise System Release 3.0 SCO Open Server Network System Release 3.0 Solbourne OS4.1x SunOS 4.x DAMAGE: Local users may gain privileged (root) access. SOLUTION: Apply appropriate vendor patch as described below. _________________________________________________________ VULNERABILITY ASSESSMENT The vulnerabilities in the /bin/mail program have been openly discussed in several Internet forums, and automated scripts exploiting the vulnerabilities have been widely distributed. These tools have been used in many recent attacks. CIAC recommends sites install these patches as soon as possible. _________________________________________________________ Critical Information about Unix /bin/mail Vulnerabilities The /bin/mail utility on several Unix versions based on BSD 4.3 Unix contain a security vulnerability. The vulnerability is the result of race conditions that exist during the delivery of messages to local users. These race conditions will allow intruders to create or modify files on the system, resulting in privileged access to the system. Below is a summary of systems known to be either vulnerable or not vulnerable. If your vendor's name is not listed, please contact the vendor or CIAC for more information. Vendor or Source Status ---------------- ------------ Apple Computer, Inc. Not vulnerable Berkeley SW Design, Inc. (BSDI) Not vulnerable Cray Research, Inc. Not vulnerable Data General Corp. Not vulnerable Digital Equipment Corp. Vulnerable FreeBSD Not vulnerable Harris Not vulnerable IBM Not vulnerable NetBSD Not vulnerable NeXT, Inc. Not vulnerable Pyramid Not vulnerable The Santa Cruz Operation (SCO) Vulnerable Solbourne (Grumman) Vulnerable Sun Microsystems, Inc. SunOS 4.x vulnerable Solaris 2.x not vulnerable Patch Information ----------------- DEC The /bin/mail patch is a part of a comprehensive Security Enhanced Kit that addresses other security problems as well. This kit was released on May 17, 1994 and was described in DEC Security Advisory #0505 and CIAC Notes 94-03. OSF/1 users should upgrade to a minimum of version 2.0 and install Security Enhanced Kit CSCPAT_4061 v1.0. Ultrix users should upgrade to at least version 4.4 and install Security Enhanced Kit CSCPAT_4060 v1.0. Both kits are available from your Digital support channel or electronically by request via DSNlink. SCO Vulnerabilities in SCO's /bin/mail utility are removed by applying SCO's Support Level Supplement (SLS) uod392a. It is available via anonymous FTP from ftp.sco.com in the /SLS directory: Description Filename MD5 Checksum ----------- ------------ -------------------------------- Disk image uod392a.Z 2c26669d89f61174f751774115f367a5 Cover letter uod392a.ltr.Z 52db39424d5d23576e065af2b80aee49 Solbourne Grumman System Support Corporation now performs all Solbourne software and hardware support. Please contact them for further information: E-mail: support(a)nts.gssc.com Phone: 1-800-447-2861 FTP: ftp.nts.gssc.com Sun Sun has made patches available to remove vulnerabilities in /bin/mail. These patches address all vulnerabilities CIAC has seen exploited to date, and CIAC recommends they be installed. However, the patches will be updated again in the near future to remove additional vulnerabilities that have recently come to light. CIAC will announce the availability of the new patches when they are released. The patches may be obtained from your local Sun Answer Center or through anonymous FTP from sunsolve1.sun.com in the /pub/patches directory: SunOS Filename MD5 Checksum ------- --------------- -------------------------------- 4.1.x 100224-13.tar.Z 90a507017a1a40c4622b3f1f00ce5d2d 4.1.3U1 101436-08.tar.Z 0e64560edc61eb4b3da81a932e8b11e1 Alternative Solution -------------------- For those sites unable to obtain a vendor patch From owner-cypherpunks Fri Jan 27 13:19:28 1995 Return-Path: <owner-cypherpunks> Received: by toad.com id AA15273; Fri, 27 Jan 95 13:19:28 PST Received: from gateway.informix.com by toad.com id AA15259; Fri, 27 Jan 95 13:19:22 PST Received: from informix.com (infmx.informix.com) by gateway.informix.com (4.1/SMI-4.1) id AA10439; Fri, 27 Jan 95 13:19:16 PST Received: from carbon.informix.com by informix.com (4.1/SMI-4.1) id AA02110; Fri, 27 Jan 95 13:19:08 PST Received: by carbon.informix.com (5.0/SMI-SVR4) id AA00461; Fri, 27 Jan 1995 13:19:01 +0800 Date: Fri, 27 Jan 1995 13:19:01 +0800 From: jamesd(a)com.informix.com Message-Id: <9501272119.AA00461(a)carbon.informix.com> Subject: Oops, Correction: one big error in "Even more unix holy war." Apparently-To: perry(a)imsi.com Apparently-To: sdw(a)lig.net Apparently-To: wmo(a)digibd.com Apparently-To: cypherpunks(a)toad.com Content-Length: 2646 Sender: owner-cypherpunks(a)toad.com Precedence: bulk I wrote: > The great strength is of course symbolic debugging -- you can > single step your compiled code, and see it displayed symbolicly, > with the symbols and statements of your source code, > and with the contents memory displayed in terms of your > source code variables. On this I was of course totally wrong: Unix has symbolic debugging equal to DOS/Windows. I was under the false impression that it only had C code interpretation. This is an error -- what I said was true for C++, but then in Windows we too are forced to primarily use interpretation to debug C++. C++ symbolic debuggers are not up to acceptable capabilities in either system. Sorry. But my statement concerning internationalization and resource files was correct. Unix has no equivalent of App Studio, etc. I have made a little tour of people in my company who work on both unix and Windows. I (fortunately) work primarily on Windows, as you may have guessed. The company I presently work for is making a tool they call Window Painter. This is in some respects similar to App Studio. It works with their unix database language. But it is no App Studio, as the unix folk who are working on it freely admit, those few of them that have used App Studio. Most of my correspondents had replies along the lines of "Huh -- internationalization -- what source code tools could possibly help you with internationalization." Others listed irregular bands of random unix tools which are essentially irrelevant to the problem of internationalization. Most international unix programs have string files that the compiled program refers to a string by a number, and a font size by a number, and the position of the button on screen by a number -- site customizable information, Xdefaults, *.cfg This is functionally equivalent to the Windows Resource file, in that in principle one can keep translatable elements separate from source code. But is certainly not equivalent in ease of use. One can do the job, but in essense one does it by hand. Resource files, and dialog box editing tools such as App Studio, provide a clean separation between visual user interface elements that typically require translation, and functiona code that does not. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.catalog.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the omnipotent state. | jamesd(a)netcom.com

1 0

Re: Wall Street Journal Article
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 11:39 AM 1/27/95, Dale Harrison (AEGIS wrote: >There was an interesting article in Thursday's Wall Street >Journal calling for the end of anonymous communications on the Internet. >It is on page B1 under the "Personal Technology" column and was written >by Walter Mossberg (mossberg(a)wsj.com) who invites comment. This Mossberg guy, to quote Mrs. Slocumb, really gets up my nose. With apologies to the last flamewar's participants and MicroSquish partisans, this bozoid monstrosity has historically demonstrated his cluelessness and is living proof that no one got fired by buying IBM *and* Microsoft. Every few weeks this clown shows up on the Paper of Record for the Plutocracy of the Planet and positively warps space with his inaccuracies. He probably learned to code in COBOL. He probably calls a microcomputer a "terminal". He probably calls a server a "host". He probably even has grey hair... ;-). The brain bleeds. The mouth froths. Somebody needs to feed this guy's email address to Detweiler with the "tip" that he's a tenticle of someone around here who's actually cluefull ... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Oops, Correction: one big error in "Even more unix holy war."
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

jamesd(a)com.informix.com writes: > This is an error -- what I said was true for C++, but > then in Windows we too are forced to primarily use > interpretation to debug C++. C++ symbolic debuggers > are not up to acceptable capabilities in either system. I hate to contribute to this silliness, but I can't let blatant errors like this pass. I debug reams of C++ daily on a wide variety of UNIX platforms. With real symbols. With real C++ expression evaluation an overload resolution. (I also get to use compilers that actually come close to supporting the language as defined by the ARM.) | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

1 0

DONT READ -- Continuing James Donald flamewar
by Perry E. Metzger 17 Dec '03

17 Dec '03

DONT READ THIS UNLESS YOU GIVE A DAMN ABOUT JAMES DONALD'S "OPINION" OF UNIX -- HIT DELETE NOW. jamesd(a)com.informix.com says: > But my statement concerning internationalization and > resource files was correct. Nope, sorry. Posix defines these things called "Locales". They provide automatic and seamless support for things like changing currency symbols, date formats, fonts, etc. The X windows system has full support for internationalization in most of its widget sets, too. > I have made a little tour of people in my company who work on both > unix and Windows. Sorry that you don't work with people who know about these things, but ignorance is not equivalent to absence. Frankly, I have yet to see a single statement from you that actually bore some relationship to reality. The most devistating comment you seem to be able to come up with about why Unix is bad is that make -- an application that doesn't even come with DOS -- used to have some places where it required tabs. Perry

3 5

anonymous mailing
by craig＠passport.ca 17 Dec '03

17 Dec '03

Since you invite comment: You seem to think that anoynimity can be separated from privacy itself. Anoynimity was an accidental feature of the telephone system that was only recently eliminated. Now, it seems, that those who seek control over others have realized that it could be eliminated in other media as well (why not routinely fingerprint everyone, and dust all postal mail for fingerprints? More practically, why not earmark every transaction on the Reuters feed? Or credit every article in the Economist?). But even these fundamental disruptions to basic institutions are dwarfed by the threat to individual confidence to speak out and not fear retribution, in a world with so many laws that everyone is breaking one or another... Consider this: Given the speed and efficiency with which data can be gathered over the networks, including levels of traffic between entitites (often the most useful data for purposes of spying on them), it could be a matter of a short time before a complete dossier of our motions and associations is in the hands of every lawful authority, every service provider, and every brother in law of either, and for sale to the highest bidder - note that most complaints against "hackers" that dig up private data concern attacks against large data banks (e.g. bank records). We might question the buildup of these data banks that make us so vulnerable to invasions of privacy, rather than those who invade. I am pondering whether to put a standing offer out in this feared "hacker" community for your tax records. If I received no takers for the challenge, I am confident that it would not be due to lack of ability, but because they respect your rights more than your respect theirs. That is, ours. That is, yours. There is no need to protect my name in this case, but only because it seems clear to me that a majority of those who understand this issue, stand on my side. If we ever become a minority I may feel less confident, and then anoynimity may make the difference between speaking out alone or not at all. Extinguish the "lone anonymous voice" from electronic media, which is the mainstream in which commerce is done and thoughts develop, and you might as well have extinguished the pamphleteer from the American Revolution. In fact, you *will* have extinguished him. I hope you have something to replace him with: Universal tolerance ? Spiritual nirvana? How do you propose to protect the lone citizen with an unpopular view who is not yet numerous enough to command a seat in Congress. Craig Hubley Business that runs on knowledge Craig Hubley & Associates needs software that runs on the net craig(a)passport.ca 416-778-6136 416-778-1965 FAX

2 1

Shut up already - James Donald does not even exist...
by craig＠passport.ca 17 Dec '03

17 Dec '03

James Donald does not exist. We can stop the flame war now. Trying to be a good net.citizen, I sent "him" e-mail to correct one of "his" line- noise-quality opinions quietly (so he might shut up) - has no one else tried this? It bounced, failing to resolve host which does not usually happen here if the site is real. So I submit the following as evidence that "he" does not exist: - com.informix.com does not seem real. - no living human being could hold such opinions and simultaneously operate his vital organs (i.e. the level of intelligence implied by his "opinions" is even lower than that necessary to support breathing and digestion) - posting pseudonymously to cypherpunks and engaging them in spurious flame argument might seem like fun to someone hostile to the anoynimity agenda and a way of generating a case that "see, anonymous/pseudonymous use of the internet angers even cypherpunks" James, if you *do* exist, I suggest you shut up now before someone you may want to work for reads your idiot posts. As for me, I am enforcing my own opinion that you do not exist by entering your "address" in my filter file. Goodbye. Those of you who care about flame wars can read the following bounced msg: > Date: Fri, 27 Jan 95 18:50 EST > From: <MAILER-DAEMON(a)passport.ca> > To: craig > Subject: mail failed, returning to sender > Reference: <m0rY0Qb-0002HEC(a)forged.passport.ca> > Content-Type: text > Content-Length: 1980 > > |------------------------- Failed addresses follow: ---------------------| > jamesd(a)com.informix.com ... unknown host > |------------------------- Message text follows: ------------------------| > Received: by forged.passport.ca (Smail3.1.29.1 #5) > id m0rY0Qb-0002HEC; Fri, 27 Jan 95 18:50 EST > Message-Id: <m0rY0Qb-0002HEC(a)forged.passport.ca> > From: craig (Craig Hubley) > Subject: Re: Oops, Correction: one big error in "Even more unix holy war." > To: jamesd(a)com.informix.com > Date: Fri, 27 Jan 1995 18:50:09 -0500 (EST) > In-Reply-To: <9501272119.AA00461(a)carbon.informix.com> from "jamesd(a)com.informix.com" at Jan 27, 95 01:19:01 pm > X-Mailer: ELM [version 2.4 PL23] > MIME-Version: 1.0 > Content-Type: text/plain; charset=US-ASCII > Content-Transfer-Encoding: 7bit > Content-Length: 1203 > > > Unix has no equivalent of App Studio, etc. I have made > > Nonsense. What about UIM/X, InterViews screen painter, > and the many cross-platform toolkits (C++Views, Visix > Galaxy, Neuron Data Client/Server Elements, Zinc, Zapp, > and now Taligent... for that matter what about NextStep? > And the increasing number of Smalltalk tools ?) > > > a little tour of people in my company who work on both > > unix and Windows. I (fortunately) work primarily on > > Windows, as you may have guessed. > > I *did* guess, but never mind how. :-) > > > Most of my correspondents had replies along the lines > > of "Huh -- internationalization -- what source code > > tools could possibly help you with internationalization." > > Zinc runs off a special purpose OODB. Translating a GUI > from one language to another is a matter of setting a flag > at runtime... everything switches from English into Spanish > or whatever. > > > James A. Donald > > Sorry James, your opinions on this matter are line noise. Posts > with this subject and your name on them will be ignored. Please > consult the various FAQs on Unix programming and crossplatform > toolkits before wasting bandwidth with this pure nonsense again. > > So much for your free education. > > Craig > >

2 1

Re: CIAC Bulletin F-09
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sigh. After all these years, people are still using mail systems which run /bin/mail setuid-root instead of setgid-mail..... Once in a while it's nice to be using System V. Bill

1 0

OSS status
by dfloyd＠io.com 17 Dec '03

17 Dec '03

Just when I almost get a prototype for the offsite secure storage (OSS) program working, I have to hit the self-destruct lever... The site I was having my test for the OSS suddenly became hostile. To keep things from getting worse, I deleted all stuff from there. It will be a week or two getting the bug fixes in (I backed it up a week ago...), and some time until I find a site that I consider 'non-hostile' to work on. Currently the commands follow the pattern of Remailer-net with the two colons meaning a pasted header, and two or three commands (Store, Retrieve, Delete) for the files. Work is slow due to the fabled Job Hunt (tm). I appreciate your patience. Douglas R. Floyd PGP key fingerable from keyservers. Note new key as of 1/1/95.

1 0

It's a Crusade ...
by Jonathon Fletcher 17 Dec '03

17 Dec '03

I've really been enjoying the traffic recently - this religious 'skirmish' has generated nearly as much traffic as the Logo Wars. I do have my own strong opinions about this particular subject, but I'm fighting back the compulsion to fly, berserker like, into the fray. However, it might be time to let it all lie for a while. This is, after all, a list for cryptography. Users of all kinds/makes/manufacturers of computers need good crypto software - so in that respect all contenders in this are equal. Ding Ding. Time out guys. -Jon -- Jonathon Fletcher, jonathon(a)izanagi.sbi.com

1 0