December 2003 - cypherpunks-legacy

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ursula"} = "<ursula(a)cyberspace.org> cpunk"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 28 Aug 95 6:00:57 PDT remailer email address history latency uptime ----------------------------------------------------------------------- portal hfinney(a)shell.portal.com *##*#*****+* 9:28 99.99% alumni hal(a)alumni.caltech.edu **********+* 11:12 99.99% hacktic remailer(a)utopia.hacktic.nl **+********* 11:54 99.99% spook remailer(a)spook.alias.net -+------+-- 2:28:52 99.99% hroller hroller(a)c2.org *##*-+*--*** 31:39 99.98% c2 remail(a)c2.org ++++-++--+++ 1:31:06 99.98% mix mixmaster(a)remail.obscura.com --..---.---- 6:57:01 99.98% crown mixmaster(a)kether.alias.net ------.--- 2:55:00 99.99% syrinx syrinx(a)c2.org ----------- 2:13:52 99.98% flame remailer(a)flame.alias.net ++++++++++++ 51:11 99.96% ideath remailer(a)ideath.goldenbear.com --.-.------ 4:57:42 99.95% bsu-cs nowhere(a)bsu-cs.bsu.edu -##+*+****++ 52:12 99.84% vishnu mixmaster(a)vishnu.alias.net ----------- 3:15:22 99.82% rmadillo remailer(a)armadillo.com +++++++++++* 1:34:11 99.67% vox remail(a)vox.xs4all.nl ---.-----. 17:32:05 99.99% ncognito ncognito(a)gate.net #+** 3:44 99.46% replay remailer(a)replay.com **+****_**** 44:17 99.34% penet anon(a)anon.penet.fi - -++-----++ 3:58:07 98.44% ursula ursula(a)cyberspace.org # * 3:37 97.42% rahul homer(a)rahul.net *#*++******* 5:12 99.99% extropia remail(a)extropia.wimsey.com ._.-__..-.. 20:21:39 89.74% ford remailer(a)bi-node.zerberus.de ****# **** 7:36 87.14% robo robo(a)c2.org -*** 55:42 55.73% rebma remailer(a)rebma.mn.org 9:53:43 1.99% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

HOPE Not
by John Young 17 Dec '03

17 Dec '03

Comments on two of the many HOPE sessions: those of L0pht and Bruce Schneier: L0pht summarized their current campaign to test security on behalf of the consumer, having found that corporations refuse to publicize or correct holes L0pht reported in confidence. L0pht cited, among others, the Mac security features and products coming to market, which they think have been too hastily readied for grafting onto other programs and and are vulnerable due to inadequate design, integration and testing. Like too many MS flood-the-market programs. Bruce outlined the principal elements of the security challenge and the role of cryptography among those of people, hardware, facilities, law and policy. He warned of the weakness of relying on crypto in the overall security matrix and cautioned that crypto is not the main answer to the security problem, which is primarily one of human frailty and criminal behavior, and that it will take a combination of solutions involving: Strong and efficient encryption -- key length is not critical Tamper resistant hardware -- software can be protected by math Trust management -- reliable authentication and certification; GAK is too complicated to ever work Jurisdiction -- criminals must not be able to operate from the most obliging state Law -- punishment for criminal acts He emphasized that mathematics and software are not the problem of insecure systems, it is humans and the impossibility of predictable interface with machines. Every system is vulnerable to attack, not at its strongest but at its weakest. Brute force is not an attack worth worrying about, although it gets most of the publicity. What's worrisome is the out of the way fault in the fortress, the one nobody expects, the one the enemy ever seeks by hook, crook, bribe and trick. (HOPE's agenda?) It was a provocative, informative, many-faceted presentation, and could become an article, maybe a book, surely an effective business lure. He closed by citing "Those who think cryptography is the answer to security do not understand the problem and do not understand cryptography." Bruce did not provide paper copy of the slides but said he will send it upon e-mail request to: schneier(a)counterpane.com Coda: Most surprising about HOPE was that everyone, M/F, was dressed in brass-button blazers, oxford whites, rep ties and gray flannels; spit-shined caps, Shasti barbered, smelled of Camay; murmured "well said" to the eloquent speakers, softly sniffed for salient points, chatted at tea, "swell show, don't you think." None of the ripe rank of cavities and pits,dreadlocks and skulls, vulgar tees and shreds, toilet squalor and slime, chest-caving music, vile hoots and whistles of "phreak Ma B, crack Mr. Softie," crazed eyeballs assaulting gameboxes, deformed bods struggling to get in against those escaping Bedlam, none of that at Beyond Hope, not at all, that was outside in the gutters of Manhattan, defiling a tux and gown wedding party upstairs at Puck.

1 0

Pre-allocating key segments
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Christian Wettergren <cwe(a)Csli.Stanford.EDU> writes: >If the client is unable to retrieve a block from the server, I suggest >it just picks a random block and starts working on it. I may very >well not be allocated to someone else, and then the client was able >to do something good in the meantime even though it didn't get a >proper key alloc. Not only that, but the client ought to allocate some keyspace before it needs it, as I think one other cpunk suggested. For instance, if it has four segments allocated and it's done three of them, it should fork a process to begin requesting four more segments *while* it is scanning the last segment, rather than waiting until after it is done and leaving the machine idle until it can alloc more keys. David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCUAwUBMEHCiREcrOJethBVAQHqfwP4xfVbdkyR19WA5k4oC0GjW80s3nNrLkXZ mYspBE8e01waJ+6NYkeyvE4lPzW4OwkKTAtZV64GWovpjsyYh4bb7/mkpkdOktAZ J9DkHXouQ5M23FImbIcfkVUqQdR5tmSdHQqOpUNYPVqT3JZR6IC9vzwYoqcnQWyY WIIGs8DTUA== =9Y8g -----END PGP SIGNATURE----- -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

2 1

Turing test novel: "Galatea 2.2"
by lwp＠mail.msen.com 17 Dec '03

17 Dec '03

Reviewed in The New Yorker (August 21&28 issue) is the novel "Galatea 2.2" by Richard Powers, wherein a neural net is nurtured by an English Literature professor "to counterfeit human responses to the Master's Comprehensive Exam, which calls for the interpretation of set texts". The review makes me want to read this book. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Lou Poppler <lwp(a)mail.msen.com> | Doom an evil deed, :: :: http://www.msen.com/~lwp/ | liven a mood. :: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

2 1

Bet e$ on how long it will take for PGPFone to make it overseas!
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To loosen up the often so serious discussions on the list, I propose a little game. PGPFone's release is about a week away. PRZ is trying his hardest to keep it from being exported. Still, I have the feeling that some irresponsible cyphercriminal will break US law and export PGPFone anyway. Let us bet cyberbucks on how long it will take for this crime to happen. Here is my initial offer: I bet e$50 that PGPFone will have been exported 24 hours after its final release has been announced to this list. Who is willing to take the bet? Perhaps someone is willing to bet at less time? Have fun, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMC6k0CoZzwIn1bdtAQExpwF+JN52E31iW2XIepF1eINcDLJIrxsyY+4Y Dkc8HTBQdKZch6RAah+MT8/Q2ALSIwgO =TpOg -----END PGP SIGNATURE-----

6 5

LAND-MINE LEGISLATION
by nobody＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

LAND-MINE LEGISLATION by Claire Wolfe Let me run by you a brief list of items that are "the law" in America today. As you read, consider what all these have in common. 1. A national database of employed people. 2. 100 pages of new "health care crimes," for which the penalty is (among other things) seizure of assets from both doctors and patients. 3. Confiscation of assets from any American who establishes foreign citizenship. 4. The largest gun confiscation in U. S. history--which is also an unconstitutional ex post facto law and the first law ever to remove people's constitutional rights for committing a misdemeanor. 5. A law banning guns in ill-defined school zones; random roadblocks may be used for enforcement; gun-bearing residents could become federal criminals just by stepping outside their doors or getting into vehicles. 6. Increased funding for the Bureau of Alcohol, Tobacco and Firearms, an agency infamous for its brutality, dishonesty and ineptitude. 7. A law enabling the executive branch to declare various groups "terrorist"--without stating any reason and without the possibility of appeal. Once a group has been so declared, its mailing and membership lists must be turned over to the government. 8. A law authorizing secret trials with secret evidence for certain classes of people. 9. A law requiring that all states begin issuing drivers' licenses carrying Social Security numbers and "security features" (such as magnetically coded fingerprints and personal records) by October 1, 2000. By October 1, 2006, "Neither the Social Security Administration or the Passport Office or any other federal agency or any state or local government agency may accept for any evidentiary purpose a state driver's license or identification document in a form other than [one issued with a verified Social Security number and security features']." 10. And my personal favorite--a national database, now being constructed, that will contain every exchange and observation that takes place in your doctor's office. This includes records of your prescriptions, your hemorrhoids and your mental illness. It also includes--by law--any statements you make ("Doc, I'm worried my kid may be on drugs," "Doc, I've been so stressed out lately I feel about ready to go postal.") and any observations your doctor makes about your mental or physical condition, whether accurate or not, whether made with your knowledge or not. For the time being, there will be zero (count em, zero) privacy safeguards on this data. But don't worry, your government will protect you with some undefined "privacy standards" in a few years. All of the above items are the law of the land. Federal law. What else do they have in common? Well, when I ask this question to audiences, I usually get the answer, "They're all unconstitutional." True. My favorite answer came from an eloquent college student who blurted, "They all SUUUCK!" Also true. But the saddest and most telling answer is: They were all the product of the 104th Congress. Every one of the horrors above was imposed upon you by the Congress of the Republican Revolution--the Congress that pledged to "get government off your back." All of the above became law by being buried in larger bills. In many cases, they are hidden sneak attacks upon individual liberties that were neither debated on the floor of Congress nor reported in the media. For instance, three of the most horrific items (the health care database, asset confiscation for foreign residency and the 100 pages of health care crimes) were hidden in the Kennedy-Kassebaum Health Insurance Portability and Accountability Act of 1996 (H.R. 3103). You didn't hear about them at the time because the media was too busy celebrating this "moderate, compromise" bill that "simply" ensured that no American would ever lose insurance coverage due to a job change or a preexisting condition. Your legislator may not have heard about them, either. Because he or she didn't care enough to do so. The fact is, most legislators don't even read the laws they inflict upon the public. They read the title of the bill (which may be something like "The Save the Sweet Widdle Babies from Gun Violence by Drooling Drug Fiends Act of 1984"). They read summaries, which are often prepared by the very agencies or groups pushing the bill. And they vote according to various deals or pressures. It also sometimes happens that the most horrible provisions are sneaked into bills during conference committee negotiations, after both House and Senate have voted on their separate versions of the bills. The conference committee process is supposed simply to reconcile differences between two versions of a bill. But power brokers use it for purposes of their own, adding what they wish. Then members of the House and Senate vote on the final, unified version of the bill, often in a great rush, and often without even having the amended text available for review. I have even heard (though I cannot verify) that stealth provisions are written into some bills after all the voting has taken place. Someone with a hidden agenda simply edits them in to suit his or her own purposes. So these time bombs become "law" without ever having been voted on by anybody. And who's to know? If congresspeople don't even read legislation before they vote on it, why would they bother reading it afterward? Are power brokers capable of such chicanery? Do we even need to ask? Is the computer system in which bills are stored vulnerable to tampering by people within or outside of Congress? We certainly should ask. Whether your legislators were ignorant of the infamy they were perpetrating, or whether they knew, one thing is absolutely certain: the Constitution, your legislator's oath to it, and your inalienable rights (which precede the Constitution) never entered into anyone's consideration. Ironically, you may recall that one of the early pledges of Newt Gingrich and Company was to stop these stealth attacks. Very early in the 104th Congress, the Republican leadership declared that, henceforth, all bills would deal only with the subject matter named in the title of the bill. When, at the beginning of the first session of the 104th, pro-gun Republicans attempted to attach a repeal of the "assault weapons" ban to another bill, House leaders dismissed their amendment as not being "germane." After that self-righteous and successful attempt to prevent pro-freedom stealth legislation, Congresspeople turned right around and got back to the dirty old business of practicing all the anti-freedom stealth they were capable of. Three other items on my list (ATF funding, gun confiscation and school zone roadblocks) were also buried in a big bill--H.R. 3610, the budget appropriation passed near the end of the second session of the 104th Congress. No legislator can claim to have been unaware of these three because they were brought to public attention by gun-rights groups and hotly debated in both Congress and the media. Yet some 90 percent of all congresspeople voted for them--including many who claim to be ardent protectors of the rights guaranteed by the Second Amendment. Why? Well, in the case of my wrapped-in-the-flag, allegedly pro-gun, Republican congressperson: "Bill Clinton made me do it!" Okay, I paraphrase. What she actually said was more like, "It was part of a budget appropriations package. The public got mad at us for shutting the government down in 1994. If we hadn't voted for this budget bill, they might have elected a Democratic legislature in 1996--and you wouldn't want THAT, would you?" Oh heavens, no! I'd much rather be enslaved by people who spell their name with an R than people who spell their name with a D. Makes all the difference in the world! The Republicans are fond of claiming that Bill Clinton "forced" them to pass certain legislation by threatening to veto anything they sent to the White House that didn't meet his specs. In other cases (as with the Kennedy-Kassebaum bill), they proudly proclaim their misdeeds in the name of bipartisanship--while carefully forgetting to mention the true nature of what they're doing. In still others, they trumpet their triumph over the evil Democrats and claim the mantle of limited government while sticking it to us and to the Constitution. The national database of "workers" was in the welfare reform bill they "forced" Clinton to accept. The requirement for SS numbers and ominous "security" devices on drivers licenses originated in their very own Immigration Control and Financial Responsibility Act of 1996, H.R. 2202. Another common trick, called to my attention by Redmon Barbry, publisher of the electronic magazine Fratricide, is to hide duplicate or near-duplicate provisions in several bills. Then, when the Supreme Court declares Section A of Law Z to be unconstitutional, its kissing cousin, Section B of Law Y, remains to rule us. Sometimes this particular form of trickery is done even more brazenly; when the Supreme Court, in its Lopez decision, declared federal-level school zone gun bans unconstitutional because Congress demonstrated no jurisdiction, Congress brassily changed a few words. They claimed that school zones fell under the heading of "interstate commerce." Then they sneaked the provision into H.R. 3610, where it became "law" once again. When angry voters upbraid congresspeople about some Big Brotherish horror they've inflicted upon the country by stealth, they claim lack of knowledge, lack of time, party pressure, public pressure, or they justify themselves by claiming that the rest of the bill was "good." The simple fact is that, regardless of what reasons legislators may claim, the U. S. Congress has passed more Big Brother legislation in the last two years--more laws to enable tracking, spying and controlling--than any Democratic congress ever passed. And they have done it, in large part, in secret. Redmon Barbry put it best: "We the people have the right to expect our elected representatives to read, comprehend and master the bills they vote on. If this means Congress passes only 50 bills per session instead of 5,000, so be it. As far as I am concerned, whoever subverts this process is committing treason." By whatever means the deed is done, there is no acceptable excuse for voting against the Constitution, voting for tyranny. And I would add to Redmon's comments: Those who do read the bills, then knowingly vote to ravage our liberties, are doubly guilty. But when do the treason trials begin? The truth is that these tiny, buried provisions are often the real intent of the law, and that the hundred, perhaps thousands, of pages that surround them are sometimes nothing more than elaborate window dressing. These tiny time bombs are placed there at the behest of federal police agencies or other power groups whose agenda is not clearly visible to us. And their impact is felt long after the outward intent of the bill has been forgotten. Civil forfeiture--now one of the plagues of the nation--was first introduced in the 1970s as one of those buried, almost unnoticed provisions of a larger law. One wonders why on earth a "health care bill" carried a provision to confiscate the assets of people who become frightened or discouraged enough to leave the country. (In fact, the entire bill was an amendment to the Internal Revenue Code. Go figure.) I think we all realize by now that that database of employed people will still be around enabling government to track our locations (and heaven knows what else about us, as the database is enhanced and expanded) long after the touted benefits of "welfare reform" have failed to materialize. And most grimly of all, our drivers' licenses will be our de facto national ID card long after immigrants have ceased to want to come to this Land of Once Free. It matters not one whit whether the people controlling you call themselves R's or D's, liberals or conservatives, socialists or even (I hate to admit) libertarians. It doesn't matter whether they vote for these horrors because they're not paying attention or because they actually like such things. What matters is that the pace of totalitarianism is increasing. And it is coming closer to our daily lives all the time. Once your state passes the enabling legislation (under threat of losing "federal welfare dollars"), it is YOUR name and Social Security number that will be entered in that employee database the moment you go to work for a new employer. It is YOU who will be unable to cash a check, board an airplane, get a passport or be allowed any dealings with any government agency if you refuse to give your SS number to the drivers license bureau. It is YOU who will be endangered by driving "illegally" if you refuse to submit to Big Brother's licensing procedures. It is YOU whose psoriasis, manic depression or prostate troubles will soon be the reading matter of any bureaucrat with a computer. It is YOU who could be declared a member of a "foreign terrorist" organization just because you bought a book or concert tickets from some group the government doesn't like. It is YOU who could lose your home, bank account and reputation because you made a mistake on a health insurance form. Finally, when you become truly desperate for freedom, it is YOU whose assets will be seized if you try to flee this increasingly insane country. As Ayn Rand said in Atlas Shrugged, "There's no way to rule innocent men. The only power government has is the power to crack down on criminals. Well, when there aren't enough criminals, one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws." It's time to drop any pretense. We are no longer law-abiding citizens. We have lost our law-abiding status. There are simply too many laws to abide. And because of increasingly draconian penalties and electronic tracking mechanisms, our "lawbreaking" places us and our families in greater jeopardy every day. The question is: What are we going to do about it? Write a nice, polite letter to your congressperson? Hey, if you think that'll help, I've got a bridge you might be interested in buying. (And it isn't your "bridge to the future," either.) Vote "better people" into office? Oh yeah, that's what we thought we were doing in 1994. Work to fight one bad bill or another? Okay. What will you do about the 10 or 20 or 100 equally horrible bills that will be passed behind your back while you were fighting that little battle? And let's say you defeat a nightmare bill this year. What are you going to do when they sneak it back in, at the very last minute, in some "omnibus legislation" next year? And what about the horrors you don't even learn about until two or three years after they become law? Should you try fighting these laws in the courts? Where do you find the resources? Where do you find a judge who doesn't have a vested interest in bigger, more powerful government? And again, for every one case decided in favor of freedom, what do you do about the 10, 20 or 100 in which the courts decide against the Bill of Rights? Perhaps you'd consider trying to stop the onrush of these horrors with a constitutional amendment--maybe one that bans "omnibus" bills, requires that every law meet a constitutional test or requires all congresspeople to sign statements that they've read and understood every aspect of every bill on which they vote. Good luck! Good luck, first, on getting such an amendment passed. Then good luck getting our Constitution-scorning "leaders" to obey it. It is true that liberty requires eternal vigilance, and part of that vigilance has been, traditionally, keeping a watchful eye on laws and on lawbreaking lawmakers. But given the current pace of law spewing and unconstitutional regulation-writing, you could watch, plead and struggle "within the system" 24 hours a day for your entire life and end up infinitely less free than when you began. Why throw your life away on a futile effort? Face it. If "working within the system" could halt tyranny, the tyrants would outlaw it. Why do you think they encourage you to vote, to write letters, to talk to them in public forums? It's to divert your energies. To keep you tame. "The system" as it presently exists is nothing but a rat maze. You run around thinking you're getting somewhere. Your masters occasionally reward you with a little pellet that encourages you to believe you're accomplishing something. And in the meantime, you are as much their property and their pawn as if you were a slave. In the effort of fighting them on their terms and with their authorized and approved tools, you have given your life's energy to them as surely as if you were toiling in their cotton fields, under the lash of their overseer. The only way we're going to get off this road to Hell is if we jump off. If we, personally, as individuals, refuse to cooperate with evil. How we do that is up to each of us. I can't decide for you, nor you for me. (Unlike congresspeople, who think they can decide for everybody.) But this totalitarian runaway truck is never going to stop unless we stop it, in any way we can. Stopping it might include any number of things: tax resistance; public civil disobedience; wide-scale, silent non-cooperation; highly noisy non-cooperation; boycotts; secession efforts; monkey wrenching; computer hacking; dirty tricks against government agents; public shunning of employees of abusive government agencies; alternative, self-sufficient communities that provide their own medical care and utilities. There are thousands of avenues to take, and this is something most of still need to give more thought to before we can build an effective resistance. We will each choose the courses that are right for our own circumstances, personalities and beliefs. Whatever we do, though, we must remember that we are all, already, outlaws. Not one of us can be certain of getting through a single day without violating some law or regulation we've never even heard of. We are all guilty in the eyes of today's "law." If someone in power chooses to target us, we can all, already, be prosecuted for something. And I'm sure you know that your claims of "good intentions" won't protect you, as the similar claims of politicians protect them. Politicians are above the law. YOU are under it. Crushed under it. When you look at it that way, we have little left to lose by breakings laws creatively and purposefully. Yes, some of us will suffer horrible consequences for our lawbreaking. It is very risky to actively resist unbridled power. It is especially risky to go public with resistance (unless hundreds of thousands publicly join us), and it becomes riskier the closer we get to tyranny. For that reason, among many others, I would never recommend any particular course of action to anyone--and I hope you'll think twice before taking "advice" from anybody about things that could jeopardize your life or well-being. But if we don't resist in the best ways we know how--and if a good number of us don't resist loudly and publicly--all of us will suffer the much worse consequences of living under total oppression. And whatever courses of action we choose, we must remember that this legislative "revolution" against We the People will not be stopped by politeness. It will not be stopped by requests. It will not be stopped by "working within a system" governed by those who regard us as nothing but cattle. It will not be stopped by pleading for justice from those who will resort to any degree of trickery or violence to rule us. It will not be stopped unless we are willing to risk our lives, our fortunes and our sacred honors to stop it. I think of the words of Winston Churchill: "If you will not fight for the right when you can easily win without bloodshed, if you will not fight when your victory will be sure and not so costly, you may come to the moment when you will have to fight with all the odds against you and only a precarious chance for survival. There may be a worse case. You may have to fight when there is no chance of victory, because it is better to perish than to live as slaves." *********************** NOTES on the laws listed above: 1. (Employee database) Welfare Reform Bill, H.R. 3734; became public law 104-193 on 8/22/96; see section 453A. 2. (Health care crimes) Health Insurance Portability and Accountability Act of 1996, H.R. 3103; became public law 104-191 on 8/21/96. 3. (Asset confiscation for citizenship change) Same law as #2; see sections 511-513. 4, 5, and 6. (anti-gun laws) Omnibus Appropriations Act, H.R. 3610; became public law 104-208 on 9/30/96. 7 and 8. (Terrorism & secret trials) Antiterrorism and Effective Death Penalty Act of 1996, S. 735; became public law 104-132 on 4/24/96; see all of Title III, specifically sections 302 and 219; also see all of Title IV, specifically sections 401, 501, 502 and 503. 9. (De facto national ID card) Began life in the Immigration Control and Financial Responsibility Act of 1996, sections 111, 118, 119, 127 and 133; was eventually folded into the Omnibus Appropriations Act, H.R. 3610 (which was itself formerly called the Defense Appropriations Act--but we wouldn't want to confuse anyone, here, would we?); became public law 104-208 on 9/30/96; see sections 656 and 657 among others. 10. (Health care database) Health Insurance Portability and Accountability Act of 1996, H.R. 3103; became public law 104-191 on 8/21/96; see sections 262, 263 and 264, among others. The various provisions that make up the full horror of this database are scattered throughout the bill and may take hours to track down.; this one is stealth legislation at its utmost sneakiest. And one final, final note: Although I spent aggravating hours verifying the specifics of these bills (a task I swear I will never waste my life on again!), the original list of bills at the top of this article was NOT the result of extensive research. It was simply what came off the top of my head when I thought of Big Brotherish bills from the 104th Congress. For all I know, Congress has passed 10 times more of that sort of thing. In fact, the worst "law" in the list--#9, the de facto national ID card--just came to my attention as I was writing this essay, thanks to the enormous efforts of Jackie Juntti and Ed Lyon and others, who researched the law. Think of it: Thanks to congressional stealth tactics, we had the long-dreaded national ID card legislation for five months, without a whisper of discussion, before freedom activists began to find out about it. Makes you wonder what else might be lurking out there, doesn't it? And on that cheery note--- THE END Copyrighted by Claire Wolfe. Permission to reprint freely granted, provided the article is reprinted in full and that any reprint is accompanied by this copyright statement. -- ===================================================================== LIBERTY NORTHWEST CONFERENCE AND DISCUSSION GROUP "The only Libertarian-oriented political discussion group on the Fidonet Z1 Backbone"... Fidonet 1:346/16 -*- SYSOPS AREAFIX: LIB_NW Visit Liberty Northwest on the Web http://www.saldivar.com/lib_nw/ Email Subscriptions via the Internet: subscribe(a)libnw.circuit.com ..Liberty is NEVER an option... only a condition to be lost! ======================================================================

2 1

Re: random coincidences
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Scott Brickner writes: > If NetScape uses such a PRNG to select 40bit keys for SSL, then > the work to be done in brute-force search going on right now might > be *significantly* reduced by knowing the planes on which the > numbers lie. If the constants are particularly poor, there might > be as little as ten or twelve bits of real key. So who here knows 80x86 assembler, is handy with a debugger, and has a few hours of spare time to figure out the PRNG? andrew

1 0

Re: SSL trouble
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Piete Brooks writes: > Let's not get implementations confused with algorithms ... We were > using ALPHA code when we started .... Pardon me here, as I don't mean to belittle your considerable efforts, but I think it was a mistake to make such loud announcements (posted to sci.crypt for instance) when the software was alpha! The software should have been tested and stable before the general public was invited to participate and "see how fast we can break SSL" As expected, lots of people tried to participate and the software just couldn't handle it. How many patched versions of the client software were distributed after the effort had started? If you want to do it as fast as possible, you can't be constantly updating your client software. > With BETA clients, a hierarchy and select/poll loops, I reckon a > server would stand a chance. I think protocol issues are a Red Herring. If your server had been able to handle more than one client at a time it would have stood a chance. Why didn't it fork? Sure, forking isn't the most efficient way to handle multiple clients, but HTTP servers (as well as SMTP and FTP) manage to handle hundreds of thousands of requests each day that way. One client at a time with a 30-second timeout was just plain dumb... I would recommend thorough testing of the software on many platforms and with realistic loads before the next public effort (there are plenty of willing testers on the cypherpunks list). I tried to join in the effort and after discovering that the client software was firing off multiple brutessl processes, I decided to wait until the client stabilized. I attempted to reject the keyspace I allocated through the WWW interface, but that didn't even work!! andrew

1 0

Re: Masons and Fnords
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >--Tim May, 34th Degree Mason, former resident of Alexandria, home of the >Masonic Temple. Now this is modest understatement with regard to this MT, the Godzilla of Masonic Temples, worth a side trip from the Capital of the Freeh World. You won't believe your eyes at this pyramid scheme putting the originals at Giza to shame. That over-reaching Alexandria Masonic Temple is matched only by the Mormon in Utah and the Buddhist in W.VA and St. Peters and Angor Wat and ... Billy Gates' Xanadu. Oh my, we archies yearn for return of the big piles staircasing to any jesus that moves your mountains of loot from your temple to ours.

1 0

Re: SSL trouble
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I did a distributed scheme for something else that had two levels, a master and a group of slaves. Only the slaves talked to the master. For this effort I think a variation of the idea would be better. Have all of the brutes contact the master, who will, in the first transaction assign them to the next slave in a round-robin fashion. Then all of the transactions from that point would take place between the brute and the slave:) (Sounds kind of like Conan or the Princess Bride.) The slaves would each be delegated large chunks of the keyspace, but not keyspace/numslaves. Maybe 1/16th or something like that, and could ask for more when their space was depleted. Periodically, perhaps when requesting more key space, and/or when a timer pops, the slaves could report results. What I mean is that every so often they'd report even if they didn't need more keyspace yet, iff they had any new stats to report. The nice thing here is that the work of the master and of the slaves is almost the same. The slaves don't have to do the initial assignment of slave, and the master doesn't have to report results, but everything else is the same. With careful design you could use the same daemon for both with a command line argument to tell it if it was the master (-m) or the slave (-s). Of course I'm sure you see that this allows you to add as many levels as you want to the hierarchy. A slave doesn't care whether a slave or a brute talks to it. The only thing that changes with the levels is the max size of an allocated chunk. For each daemon it would be nice to have the minimum, maximum and default chunk size configurable. The master might have all three the same, since it would be expected to talk only to slaves. That doesn't mean you couldn't get more than, (for example), 16th of the keyspace to work on. It just means that you'd have to make more than one request. You could make the slave software available as well, and a site with many machines could have only the slave contact the master to get assigned a slave to talk to, and could configure all of their brutes to talk to their own slave. Software like this is easy to write, (and fun), and we should go for it:) Of course I do everything like this in C++, but I suppose perl would be the most portable. It's a shame it's so aethestically displeasing to the eye. perl's never a pleasant read. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

3 3