December 2003 - cypherpunks-legacy

S/MIME and the Future of Netscape
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

With regard to SSL and Netscape not being open to outside developers, several leading e-mail outfits, including Qualcomm, Netscape, Frontier, etc., are working on an interoperable secure e-mail standard called "Secure/MIME," or "S/MIME." And even if Netscape will not allow outside developers--like J. Random Cypherpunk--access to the code internals and incorporaton of his work into Netscape's final compiled code, not surprisingly, there are still numerous options for hooking in. Hal Finney described some ideas, and I'm sure more exist. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 3

Re: Netscape the Big Win
by Hal 17 Dec '03

17 Dec '03

From: Adam Shostack <adam(a)bwh.harvard.edu> > Actually, it also supports Kerberos (not relevant to most of > us), and PGP messaging. Although a KCA would be needed before anything > useful came of the PGP support, at least its there. It appears that support for PGP messaging has been removed from the July 1995 SHTTP draft. So it's X.500 all the way. <URL:http://info.internet.isi.edu/in-drafts/files/draft-ietf-wts-shttp-00.txt> From: Steven Champeon - Imonics Development <schampeo(a)imonics.com> > The one "advantage" to SSL that they were pushing over SHTTP was that > SSL is a socket-level encryption mechanism, as opposed to protocol- > level. It doesn't conflict with SHTTP except in terms of adding to > the processing time. > > I guess I don't see why SSL is so awful from a crypto standpoint. > Could someone a bit more educated on the nuts and bolts clue me > in on its weaknesses? As compared to other schemes, perhaps? Frankly I don't think SSL is particularly weak cryptographically. It has gone through several revisions as various problems were pointed out. The one thing I would note is that there is considerable known plaintext being exchanged in the handshake. This helps with key guessing and will be the foundation for the SSL challenge that Adam Back is organising. IMO at least some of this material could have been sent encrypted with the public key so that an eavesdropper couldn't know it. OTOH this might have run afoul of the NSA's rules on export for at least the 40 bit version since you'd have more than 40 bits of secrecy in effect. SSL includes a 16 byte checksum with each packet. IMO this is overkill and wasteful for small packets. One thing about SSL is that it provides both secrecy and immunity to certain kinds of active attacks. These big checksums include a sequence number and key information to prevent replay attacks. For some purposes you might be satisfied with secrecy and not want to pay this overhead. I think a lot of the criticism of SSL was based on the thought that it would be obsoleted by the new IP secure protocols. That may be true eventually but SSL is here today, in use. Order something from Netscape and it is secured with SSL. Buy the domestic version if you want real security. For IP, many of us we will have to wait until the new IP protocols get built into our OS's and other infrastructure. People have also objected to the use of the X.500 certificate approach. But that seems to be de rigeur for any serious Internet standard these days. IMO the real solution is to come up with a PGP-like X.500 certificate maker so people can easily set themselves up as Certificate Authorities and go about their business while the anal hierarchy fans argue about liability. Actually I think there is a PD certificate maker around, possibily from Eric Young down under. Hal

1 0

Re: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "tcmay" == Timothy C May <tcmay(a)sensemedia.net> writes: tcmay> Integration of crypto into Netscape is thus the Big Win. tcmay> I felt this was the case as far back as last fall, but my tcmay> recent experiences tell me this is more important than tcmay> ever. Integration of PGP and other crypto routines into Tin, tcmay> Pine, Elm, Joe, Emacs, etc., is just not as important. Careful here. Deliberately or not, you are marginalizing the hard work of dozens of people, including me. You are suggesting our work should have been done for Netscape instead, a program that a) is not free software (FSF sense); b) has no mail reader; and c) has no extension language. Oh, and d) is horrendous as a news reader. The packages that you implicitly denigrate provide far and away the best interfaces to PGP available today. They are written with the tools available, whether it's a Windows shell, a hacked version of Elm, or an Emacs Lisp package. Maybe Netscape will include a mail reader someday. Maybe Netscape will include Java as an extension language someday. But until that day, the only people who can put crypto into Netscape are the folks at Netscape Communications. tcmay> IBM just paid nearly $3 billion for Lotus, largely for the tcmay> "common platform" of Lotus Notes. I believe Netscape is an tcmay> even more important common platform, and will displace Notes. Netscape is not a platform. It is a browser. It is only useful for viewing content that others have created, with a user interface that any idiot can use. Consequently, yes, it is very popular with the masses and will become more so. tcmay> The relevance for Cypherpunks interested in writing code is tcmay> that, in my carefully considered opinion, writing for Netscape tcmay> and other Web browsers is the Big Win. Even over Windows tcmay> (except Windows browsers, of course). Can you name a platform for which it is possible to write a PGP front end, but for which none has been written? If it is ever feasible to do what you suggest, someone will do it; your musings will have no effect on that. If you want to make a difference, try writing some code yourself... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6Rg3r7ES8bepftAQG4egQA2QFjXo5wgVOCtz2qGkgBbw80F4U80C1p d1noVQN95tFYc1vjgk0ftp8n5stURtuD6MEoHNoKDOQgCIzbPlEC9rIETAzW1kfd GTG8DzRqkcY1YqrTEnLoNiUswIfkVaquf9JrWNSuPKzLZ+IsUto1SxxNjk0fR7pf ou4k3Fo+3yQ= =BpNr -----END PGP SIGNATURE-----

1 0

RE: Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 3:18 PM 7/20/95, Pat Farrell wrote: >The current trend is to bundle all types of functionality into huge >monolithic programs. Add mail to netscape, add encryption, add ... > >Yet most of the computers people use are multi-windows, and soon most >will even be multi-tasking. > >Why are all-in-one programs so preferable to using the windowing >capabilities that are built into every X-window, Mac or Windows system? > >Why not use the best mail client, another best webcrawler, and yet another >news reader? Speaking for myself, consistency of user interface. To that extent, Netscape (or Lotus Notes, in a different context) becomes the "operating environment" for the user, the place where he does his work. The News reader in Netscape 1.1N is as good as the main "separate" news reader, NewsWatcher, for the Macintosh, and has some added benefits. For example, URLs in News postings automatically show up as clickable items, which can be jumped to immediately. (Other News programs _could_ do this, and maybe some of them do, but not on the Macintosh, at this moment.) >Microsoft has been preaching the use of OLE and component programs as its >development vision for 2+ years, Macs have been popular for ten years, >why is the trend still towards adding every possible bell and whistle >to single programs? I don't know why "componentware" has not taken off. But it hasn't. OpenDoc and OLE 2 are coming, but slowly. Big programs tend to grow because they can increase market share by adding capabilities, by pulling in more customers. We might prefer a world of smaller apps, with componentware pieces, but it rarely happens. And I'm not going to use half a dozen small programs, each doing slightly different things and having different commands, when one will do nicely. (I could list other pluses and minuses, a la my outline FAQ, but here's just one more important item: cross-compatibility. Namely, with N smaller programs in use, of varying versions, incompatibilities and even crashes can result all too often ("We have discovered that MailMuncher 2.12 does not work with NewsNabber 1.1."). At lest with something like Netscape, a certain amound of cross-operability is likely, for various reasons.) In any case, while I respect the views Pat is expressing, about componentware and "small is better" approaches, the market is voting with its feet for apps like Netscape, which are becoming the main programs folks will use for communication, News reading, and Web surfing. >With components, it wouldn't be hard to have a universal >Encryption/Signature module. It would get arround any propriatary >restriction that vendors may or may not try to enforce ("can Netscape be >extended or not" becomes moot). So go ahead and do it! I've been waiting for many years for such things. To state an obvious non-crypto use of such "modules," why do all major word processing and page layout apps have their own "dictionaries"? Why do I have to train the dictionaries of Word, Nisus, FrameMaker, MORE, etc.? That there have not been "dictionary modules," for many and sundry reasons, is telling. (Before anyone mentions it, one can on the Mac use things like "Thunder" instead of the local dictionaries...this is not the same as a module usable by all programs, but instead is a user choice to bypass the local dictionaries. We could quibble for hours about whether this is in fact a universal module or not. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

RE: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "pfarrell" == Pat Farrell <pfarrell(a)netcom.com> writes: pfarrell> Why are all-in-one programs so preferable to using the pfarrell> windowing capabilities that are built into every X-window, pfarrell> Mac or Windows system? pfarrell> Why not use the best mail client, another best webcrawler, pfarrell> and yet another news reader? The problem is that existing operating environments do not, in general, provide good facilities for the kind of tight integration you really want. Besides, there is nothing wrong with a monolithic application, as long as it provides a sufficiently rich extension language. Take Emacs, for example. Emacs is a monolithic application, but I use different Lisp packages to read news, handle mail, and develop software. (I occasionally even just edit text.) Moreover, I have co-authored a Lisp package to hook PGP functions into *every* Emacs mail and news package, without ever talking to the authors of those packages. In general, any package can be written to seamlessly integrate with any other. In addition, all of these packages work without modification on every variant of Unix, on VMS, on Windows NT, and sometimes even on DOS. I can write in beautiful (and safe) Lisp, and let the Emacs maintainers worry about the idiosynchracies of each operating system. The problem with Netscape currently is that all of their packages are *built in* by Netscape Communications. That is why they have no mail handler, and why their news reader sucks, and why it is impossible for any of us to fix these things or add a PGP front end. Java looks somewhat promising; with it, perhaps Netscape can become a platform-independent system for writing packages to manipulate and display hypertext. It would be like an Emacs for hypertext, but with a crufty extension syntax and no source code. And a user base 1000 times as large... pfarrell> Microsoft has been preaching the use of OLE and component pfarrell> programs as its development vision for 2+ years, Macs have pfarrell> been popular for ten years, why is the trend still towards pfarrell> adding every possible bell and whistle to single programs? These approaches suffer for two reasons. First, it's a pain to incorporate the same basic display code into every package. Second, it's a pain to rewrite the same basic display code for every window system. (Especially when "every window system" means Microsoft, Macintosh, and X.) Other subsystems than display have similar problems (networking comes to mind), but I think display is the major pain in the groin. What Netscape could do is provide the engine for hypertext display, with a sufficiently rich and simple extension language that it would be easy to write new modules. Someone would probably write a decent news reader. Someone else would write a mail handling package. Someone else would write a PGP interface. And so on. Netscape would need to provide other functions across platforms, like TCP sockets, but that isn't impossible: Emacs has done all of this (save graphical display) for over a decade. Gosh, we might find ourselves using 1980 technology by the year 2000. I don't know enough about Netscape's plans for using Java to know whether any of this is likely to happen. I'm not even sure I want to see it happen. But it would be interesting. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6aLHr7ES8bepftAQEIVgP9G8p4lV1+Uc+6cpLZW4hMF+k7CYYp2Jp6 xh0qZXW0Sd7STPn+sP/fGPvErauGTlDiyIoW5bTJ9srITtFN8U1Yr7QollQZPqUa 5Rhbu7LjFTmixpdo0wiDTuUiRObnoE4Pj+/27EiamEqG160TjGiHDyCodh/eyFWS 8+R/yT5RCPw= =pja4 -----END PGP SIGNATURE-----

2 1

Re: cypherpunk "Zen" victories
by Mike Calligaro 17 Dec '03

17 Dec '03

<Though I'm not on the list, I read Cypherpunks through the extreme filter of a friend who forwards all the good stuff to me.> Vladimir's post was very good. I only take issue with the last bit. <<So the next time that you rant about how some bill or another means the Death of the Net, or the police investigating a remailer means the downfall of cryptoanarchy, or a lousy article with a zillion distortions comes out, think again. The greatest cypherpunk victories are emerging through what would appear at first to be the "blackest" moments.>> So long as you remember that when these things come out we still need to scream and yell about them. The Rimm Job is not a victory simply because Rimm was crazy. It's a victory because many people took the time to criticize it and many others took the time to inform the masses of that criticism. These attacks may go in our favor, so long as we direct them in the right direction. There's something Zen in that as well. Don't punch your charging opponent. Instead misdirect hir energy a bit and let hir run into that wall behind you...

1 0

Re: Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 5:25 PM 7/20/95, Patrick J. LoPresti wrote: >>>>>> "tcmay" == Timothy C May <tcmay(a)sensemedia.net> writes: > > tcmay> Integration of crypto into Netscape is thus the Big Win. > > tcmay> I felt this was the case as far back as last fall, but my > tcmay> recent experiences tell me this is more important than > tcmay> ever. Integration of PGP and other crypto routines into Tin, > tcmay> Pine, Elm, Joe, Emacs, etc., is just not as important. > >Careful here. Deliberately or not, you are marginalizing the hard >work of dozens of people, including me. You are suggesting our work >should have been done for Netscape instead, a program that a) is not >free software (FSF sense); b) has no mail reader; and c) has no >extension language. Oh, and d) is horrendous as a news reader. No offense, but "marginalizing" is what I love to do more than anything! Seriously, the world is what the world is. I really don't care about "FSF" one way or the other, and will join the rest of the world (apparently) in using Netscape. And yes, I am "marginalizing" the work that anyone does on "fringe" projects like Linux, which will likely always remain in the ghetto of Unix hackers who want a cheap Unix running on their cheap 486 boxes...it just ain't gonna take over inside corporations or amongst the many folks like me. Frankly, one of the great boons of my current setup is that I can completely get away from Unix tools and commands, away from my Unix shell account at Netcom, away from the arcane commands that vary from program to program, away from tin and elm and emacs...my fingers are already forgetting the emacs commands! (Those of you like Unix, fine. I agree it is useful for many things, so I'm not trying to debate Unix vs. the world. Just giving my perspective, and apparently the perspective of the many who are adopting the Web browsers as their "operating environments," insulated from the underlying cruft.) (If the GNU folks were to do an "open, extensible, Netscape workalike. this could be a win. Some may claim that Mosaic is/was that. We can debate this in separate thread.) I acknowledge that it has no mail reader, which is why I'm still using Eudora. But as soon as it does.... And the newsreader is a matter of taste...it does all I want it to do, and I'm a fairly heavy reader of News and contributor to Usenet groups. I survived with "tin" for several years, so anything is possible. >The packages that you implicitly denigrate provide far and away the >best interfaces to PGP available today. They are written with the >tools available, whether it's a Windows shell, a hacked version of >Elm, or an Emacs Lisp package. I don't think the packages I "denigrate" are the key to the future widespread use of crypto. Look at the actual usage patterns. >Netscape is not a platform. It is a browser. It is only useful for >viewing content that others have created, with a user interface that >any idiot can use. Consequently, yes, it is very popular with the >masses and will become more so. This makes my point. We may dismiss the masses as not being true Unix gurus or as being ignorant of Emacs, but this is how crypto will become truly ubiquitous. Not when people have to learn to compile code and create clients, but when they can send encrypted messages easily and transparently. That Qualcomm (Eudora), Netscape, Frontier, Microsoft, Lotus, and others are working on an interoperable "Secure/MIME" should be encouraging. >end, but for which none has been written? If it is ever feasible to >do what you suggest, someone will do it; your musings will have no >effect on that. If you want to make a difference, try writing some >code yourself... Please, your insulting tone ("your musings," "try writing some code..") is uncalled for. You have your views, I have mine. >From the large number of messages in this thread, apparently my points struck a chord. Like it or not, huge numbers of users are using Netscape and similar browsers. This is the basic reality. This is where the bulk of crypto users are going to be, not compiling ftp-gotten PGP into their Emacs configurations. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: cypherpunk "Zen" victories
by Rich Salz 17 Dec '03

17 Dec '03

The Boston Globe has a weekly "magazine review" column. In yesterday's column they wrote about the Rimm piece, Time's followup, how the Internet got the story right, and fast, and how HotWired has a really good page on it. The column then reviewed the current Wired and said the magazine is now behind the times. In particular, contrasting it to the second(?) issue, "when they covered the Cypherpunks (sic) and their privacy agenda."

1 0

Re: Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 4:31 PM 7/20/95, Ray Cromwell wrote: > I wouldn't be surprised if in 5-10 years, your operating system basically >looks like a cross between Netscape, OpenDoc, and HotJava. The "browser" >would be ubiquituous, and local/LAN/WAN data would be treated transparently. > This is precisely my view, although I try to call it an "operating environment," so as to get away from quibbling about what is and what is not a real OS. There were reasons why some folks like to do as much work as they could in an integrated environment like Emacs, regardless of the underlying OS flavor. Many folk still do, and they read News, send mail, etc., all from within Emacs. Same idea with Netscape...albeit with a different focus. And my guess, based on lots of indications, is that about a thousand times as many people will soon be doing this with Netscape as with Emacs, or elm, or pine, etc. Ray's comments about OpenDoc, HotJava, and other object-oriented tools fit this picture, I think. I am sorry that some folks heavily committed to the Linux route, or to Emacs, or to GNU/FSF, or to other approaches feel that their work is technically superior and deserves to be as popular as Netscape and simiar approaches, but reality is reality. (And I could be wrong on the way things will unfold. All I'm saying is that technology is a moving target, that plans have to change, and that ease of use will likely win out over technical sophistication. Folks who think the stronger technology will inevitably win should pick up a copy of a 15-year-old book called "The Soul of a New Machine," by Tracy Kidder.) .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 4

Re: Java (was Netscape: the big win)
by cman＠communities.com 17 Dec '03

17 Dec '03

>Does anyone here have any figures on how much memory Java takes up >when running its typical tasks? > These are real ball-park figures based on looking at "free memory" from vmstat from several instances of launching, running, then exiting from the listed programs: Java compiler (written in Java), compiling big program: 2.5 MB HotJava browser (written in Java), after running some applets: 4.0 MB "Hello world" Java program (no GUI): 800K

1 0