December 2003 - cypherpunks-legacy

Re: How the cypherpunks nearly got me fired (long)
by Michael Sattler 17 Dec '03

17 Dec '03

At 22:10 1/31/95, David Mandl wrote: [really horrid story about true life at a corporate dinosaur deleted] >I just thought >you might enjoy this little story, and would want to keep it in mind if >you're ever considering employment at Bear-Stearns. Part of my job-interviewing procedure has become grilling a would-be employer (or whoever is asking for a contractor) about their net connections. I've been very pleasantly surprized that most [techie] places are okay on a perspecive employee being interested in the tech grunge of net access, and considering it part of the working environment, a benefit, like gourmet coffee. On the other hand, HP (that god-awful backwards cesspool of bureacracy) had full net connections to the outside world (when I was there, since turned off) but in a pathetic attempt to show due diligence searched our briefcases and backpacks (but not the contents of the laptops, floppies, or tape cartridges therein). Someone's going to have to explain to their legal counsel that taking paper versions out isn't the most efficient way... :-) -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

4 3

The RSA FAQ on http://www.catalog.com/jamesd/rsafaq.html
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Chris converted the RSA FAQ to html for easy reading. I have placed this faq on http://www.catalog.com/jamesd/rsafaq.html --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.catalog.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the omnipotent state. | jamesd(a)netcom.com

2 1

Re: CD-ROM [brief addition]
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I forgot to mention that the CD-ROM in development will be > export restricted. It isn't going to be sold outside the united states > and canada. :-(

1 0

Where is the Line Between Public and Private Data?
by Joe Turner 17 Dec '03

17 Dec '03

I found an interesting article in Beyond Computing. The atricle, entitled "Where Is the Line Between Public and Private Data?" written by Dr. H. Jefferson Smith, may be of some interest to those on the list. The article basically hashes over the Government's trend in selling data about its citizens to companies. While I knew various state agencies sold driver's license data to credit card companies, I had no idea about the depth of what is going on. The U.S. Postal Service is selling the NCOA (National Change of Address) data to credit card companies. Some junk-mailing lists are also produced. Drivers license data is used by marketing companies, to target specific sections of the public (ie, people who wear glasses, short people, etc.). --Begin Exerpt-- "Here's another example. In 1992, it was reported that voter records in a certain county were for sale on a CD-ROM disk (1.25 million voter records were priced at $99). The disk contained names, addresses, phone numbers (in some cases, unlisted numberse), occupations, political affiliations, birthplaces and birth dates. Another company sold a CD database that contained information from deed filings: the owner's name and address, when the property was purchased, the number of bathrooms and bedrooms in the house, the square footage and property assessments." --End exerpt What suprises me is that if had the first CD-ROM, it would be very easy for me to apply for credit cards in other peoples names... I shudder to think... The article goes on to further explain the government's lusts over private databases and "'The only reason you should fear the use of such records is if you have something to hide' is an often-heard argument." -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597 Finger for PGP KEY.

2 1

Re: Frothing remailers - an immodest proposal
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have some concerns about Kevin's frothing remailers. Like so many of the proposals we see to put more responsibility into the remailer net, this opens vulnerability to a single bad remailer. If I trust the first remailer in the net to choose my path for me, as I might be tempted to do with a froth, then if that remailer is corrupt my anonymity is lost. With user-supplied chaining I am secure unless all of the remailers on the chain are corrupt. I also do not like the kind of close-knit, cozy cooperation among the guild of remailer operators which seems to be envisioned in this and similar proposals. Do you like the idea of messages on the remailer operators list saying, I am getting objectionable messages from your remailer, would you mind dropping in a log so we can see who is sending these messages which violate the Politically Correct Speech Act? I do like Kevin's ideas about a dynamic remailer net, but I think another approach would put more smarts into the client program used by the originator. Granted, his information will be somewhat more out of date as the message makes its way through the network. But depending on thie time scale at which the froth, um, froths, this should still allow a lot more dynamism among the set of remailers. Using either IRC or, as Todd suggested, Usenet to maintain an active remailer list might work. We could also have a distributed set of sites which provide the information by finger like the pinging sites we have now. A few notes about Safe-TCL. I posted some ideas on using this as a basis for remailing some time back. Safe-TCL defines three times at which messages could be activated (scripts in them run). One is on message sending, one on message reading (so it can put up dialog boxes and interact with the recipient in other ways), and the third on receipt, which is when it enters the user's mailbox. The actual safe-tcl implementation does not include support for this third mode, but it would be pretty easy to add. If you had that, messages could come to your machine and activate to do various things that you allow them to do. If you allowed them to send mail as one of those things, this would be a start towards a remailer. What you need then is some way for various messages to interact with each other, so that, for examle, a message could wait until there were a certain number of other messages inside the machine before it sent itself out. You would also want a way for a message to suspend itself until some future event, such as having a certain amount of time passing, or waiting until some message with desired properties arrived. There has been intermittent discussion of similar topics on the safe-tcl mailing list. The motivation there is not supplying remailers, of course; rather there is a desire to have something with similar functionality to the much-ballyhooed Telescript, but less bound by proprietary constraints. Telescript scripts can move through the network and interact with other scripts (at least, they will supposedly be able to, but the exact manner is apparently secret for now). Providing the simple act of motion to mail agent scripts without stamping them with a record of everywhere they have been is really all a remailer would do. (I wonder if Telescript agents have to carry around with them a record of every path they've taken?) Sending a message through a safe-tcl based remail network might be more cumbersome than our current techniques. You might have to precede the message body with a safe-tcl program a few lines to a couple of pages in size depending on the complexity of remailing you want. But again with proper clients this can be hidden from the user. I think emphasis should be on smart mailer clients rather than more cooperation among nodes in the remailer network. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLy8O8hnMLJtOy9MBAQHMjwIA40ZIvNtOvMN/mWtY4bSN0MYMravR9bNr zhZ519K+g6w5ZsW71c/kM7BFz15BjB9pIcTMjUQv/C8YJNGrdFEzhg== =1okU -----END PGP SIGNATURE-----

1 0

Re: Frothing remailers - an immodest proposal
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <9501312152.AA10208(a)toad.com>, <kevin(a)elvis.wicat.com> wrote: >It seems to me that the current remailer web suffers a fundamental flaw. >It is simply too static. Agreed, of course. I also don't really want to quote your entire article but want to throw some points into the discussion. In general, I think you've got a good approach but might be a little too tied to instant-gratification use of IP. I touched on some of this a while ago, in the thread "Broadcast and the rendezvous problem," and have thought about it a bit more after getting others' comments: 1. Broadcasting every couple of minutes isn't necessary and is undesirable due to the real limitations of the Internet. A remailer could broadcast its location with a time-out on the location without a constant stream of availability announcements. In your position for example, you'd broadcast a message at 5 pm with a 16 hour valid time. 2. This is actually unnecessary for your situation: All you need to do is advertise your location as a "real" remailer and then have a cron job that kill sendmail at 5pm on your remailer machine (assuming you have a spare machine that doesn't need to run sendmail). The mail network is flexible enough that things will Just Work. Mail won't go through instantly during the day, of course, but that just helps to muddy up the mix. 3. Broadcasting over live IP isn't all that great a model. Ideally, you'll use a mechanism that doesn't require instant communication among hosts. I favor USENET for this: messages have a naturally long life- time and the network is self-adjusting. If a direct route is temporarily unavailable, an indirect one will often manifest itself. I also favor using USENET store-and-forward for the messages themselves for the same reasons: traffic analysis is impossible inside the web and direct routes are not necessary. 4. Using a PGP-style web-of-trust is important. In the ideal situation, one human in an extended web can certify individual remailers and all other remailers close enough on the same web of trust would pick up the message immediately. Just some thoughts, - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLy6+ThNhgovrPB7dAQHoDQP/UDn2GV7Jq8C3nQyN9IhvGMUTGnBjcL+k zCPgTOLjANMrMN791VdeoNs9rR3QKFdFR9y0p39lka0p+9n1I3hDuEKyAX8Cicub h0/eyr54bEzC6Q2L06VlIzDac9K7kILUkIf2ypgeXTrFuMSZITy+z0ugDeq3NA7B W+gkl82hJZk= =69b2 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLy73lyoZzwIn1bdtAQG/8wGA1kS3RyqBsxOZgniuxZqGySeybSJQuVp4 3zsxH545MqhBXmh16Gh4LvBlkre+9JYT =Evbh -----END PGP SIGNATURE-----

2 1

null What's Killing My Remailed Posts?
by nobody＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

[Please Reply-To: an105(a)vox.xs4all.nl as I am not receiving the group or list on which this message _hopefully_ appears. Thanks!] Though I have been vigorously using the various remailers for a long time, I am stumped by my sudden inability to get a post to a newsgroup by any remailed means. Example: For a long time I have used the following boilerplate form with usura(a)replay.com with flawless results: :: Encrypted: PGP :: Anon-To: my.anon.address(a)somewhere.org Cutmarks: * | Message Successfully Remailed, # 999 * :: Anon-To: mail2news(a)demon.co.uk Cutmarks: ___ Latent-Time: +6:00r ## Newsgroups: alt.some.group,misc.another.group Subject: Furballs in Wolverines My wolverine has nasty furballs... [...] My wolverine thanks you all for suggestions... ___ The current status of this is that I get the remailed receipt, but the message never shows in the group. Is mail2news(a)demon.co.uk down? I tried using the Usura Anon-Post-To: feature, but it fails as well. I've tried using _other_ remailers with the simple form... Anon-To: alt.some.group(a)comlab.ox.ac.uk Anon-To: alt.some.group.usenet(a)decwrl.dec.com Anon-To: alt.some.group(a)bull.com I've also tried Request-Remailing-To: with the same address form. Nada. I have been unable to make any of the usual remailers get through to the groups by any means for about three weeks, though evidence shows that the remailers are certainly getting the messages, as I can send anon netmail messages - - - the _posts_ just never show. I periodically suspect that someone somewhere is running a program to sweep all posts with "remail," "nobody" or "anon" anywhere in the header. Any thoughts on this...assuming it shows here? ___ Blue Wave/QWK v2.12

2 1

CD-ROM [brief addition]
by sameer 17 Dec '03

17 Dec '03

I forgot to mention that the CD-ROM in development will be export restricted. It isn't going to be sold outside the united states and canada. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: ESP Unix encrypted session protocol software
by Matt Blaze 17 Dec '03

17 Dec '03

>Matt, why did you choose to implement your own protocol instead of >adding a DH authentication/encryption type to telnet? > > Marc I've got one of those, too (it won't be ready for release too soon, though - telnet is big and ugly). An encrypting telnet and telnetd almost always provide a more appropriate way to do session encryption. However, there are some situations where ESM is really the only option. One is when you can't or don't want to install a daemon (e.g., for very occasional use). More importantly, by running within the session, ESM can provide end-to-end encryption across an untrusted application-layer firewall (like the one I go through to get between home and work). Since part of my motivation for working on these tools comes from wanting to use them myself, I'm building the stuff I need the most first. -matt

2 1

Scientology Petition v2.1
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Church of Scientology PETITION Version 2.1 I have undertaken on my own determinism to rewrite the petition according to criticisms that I have received. This version below is short and sweet. Since I have no authority whatsoever from those who wrote the original petition to do this, this is certainly not official. However if enough like it, perhaps we can talk the original petition writers into considering it. I will be posting this to news.admin.misc,alt.current-events.net-abuse,alt.privacy.anon-servers alt.censorship, alt.cyberpunks, and comp.org.eff.talk If you think it is worthwhile, please post it to other groups as well. Homer We the undersigned deplore 1.) The Church of Scientology's recent apparent (unproven) efforts to rmgroup alt.religion.scientology. 2.) The Church of Scientology's recent apparent (unproven) efforts to cancel non copyrighted postings. 3.) The Church of Scientology's overt and apparently covert plans to spam both alt.religion.scientology and the rest of usenet with 'success stories' and testimonials, in order to drown out the 'graffitti' and negative testimony and commentary. 4.) The Church of Scientology's legal efforts to shut off anonymous remailers to alt.religion.scientology and alt.clearing.technology, and their legal threats against the remailer operators for postings, copyrighted or not, coming through them. 5.) The Church of Scientology's legal efforts to clamp down on ANY copyrighted postings or quotations at all, even when clearly Fair Use. 6.) Any open or covert declaration by Church of Scientology Officials against anyone on the internet declaring them to be a Suppressive Person, and any open or covert declaration of anyone on the internet as Fair Game whether or not it is to be called that. We the undersigned eschew any efforts on the part of anyone to render alt.religion.scientology a moderated group. We the undersigned implore the Church of Scientology 1.) To work closely with the Electronic Freedom Frontier to solve what it perceives to be its problems with the internet, and to endeavor to join the internet community as a respected citizen in the forums of two way communication with anyone at any time on any subject. 2.) To help formulate guidelines for, and accept fair use excerption of the works of L. Ron Hubbard for the purpose of non commercial criticism and educational commentary. Homer Wilson Smith United Free Zone Alliance

1 0