December 2003 - cypherpunks-legacy

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> Luckily, Netscape recently hired Taher Elgamal > and he's a smart guy. Unfortunately, he seems to be in a > position where he has to defend the fairly bad work they did already. When I first saw him speak at the Danvers IETF I thought "gee, does this bozo know he shares the same last name as a real bright guy"? I think it was Perry, for example, that pointed out that using one RC4 stream for each comm half was more-or-less obvious and standard practice. At last month's World Wide Web Consortium working group meeting on security, everyone trashed SSL. Everyone trashed the W3C for not just picking SHTTP but instead trying to invent something new that "borrowed from" SHTTP. Tahir was silent on the former, but didn't disagree on the latter. During a break, in the hallway he mentioned how he's gonna have to do some politicking back at the office, and that he's glad someone reasonable like him came, and not other folks he could name. > Netscape is a closed system. You can't write code for it unless you > work for Netscape. I thought they announced their intent to support java. /r$

1 0

RE: Netscape the Big Win
by Pat Farrell 17 Dec '03

17 Dec '03

tcmay(a)sensemedia.net (Timothy C. May) writes: > * I use Netscape to read News. > * I use Netscape to access the Web. > * I still use Eudora to send and receive Mail. (Netscape can currently > send mail, but not receive it. This is likely to change soon.) I'm not about to argue that the web isn't the hotest thing on the net, which is the hotest thing in computing... But I've got a question that I can't resolve. The current trend is to bundle all types of functionality into huge monolithic programs. Add mail to netscape, add encryption, add ... Yet most of the computers people use are multi-windows, and soon most will even be multi-tasking. Why are all-in-one programs so preferable to using the windowing capabilities that are built into every X-window, Mac or Windows system? Why not use the best mail client, another best webcrawler, and yet another news reader? Microsoft has been preaching the use of OLE and component programs as its development vision for 2+ years, Macs have been popular for ten years, why is the trend still towards adding every possible bell and whistle to single programs? With components, it wouldn't be hard to have a universal Encryption/Signature module. It would get arround any propriatary restriction that vendors may or may not try to enforce ("can Netscape be extended or not" becomes moot). Is clicking on another icon really too hard? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

3 2

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> I'm not sure what this is getting at. SSL does use a separate RC4 stream > for each comm half. Is this a suggestion that a single key should be > used for both directions? No. They were saying "look, we use two keys." And Perry went "duh." /r$

1 0

Re: Netscape the Big Win
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From: Hal <hfinney(a)shell.portal.com> | Subject: Re: Netscape the Big Win | | [ much complaining by .pm deleted ] | | Note though that neither SSL or SHTTP requires that the certificates come | from RSA. However the current versions of Netscape's browser do require this. | This has been the source of much complaint and Netscape has promised that | they will have some mechanism in the future to allow the user to | choose his certificate signers. I am not sure how far RSA will let them | off the leash, though. I do know that at the Netscape Spring Training I attended, that was the source of much consternation from the techies (who knew what it meant) and Mr. ElGemal was certainly aware of it. The thing that scared me was that most of the sales and marketing folks took the approach that I think we can expect from them: "What! That's ridiculous! Oh, it's only $230? Oh, okay. That's cheap enough." and then they went on their happy way. The one "advantage" to SSL that they were pushing over SHTTP was that SSL is a socket-level encryption mechanism, as opposed to protocol- level. It doesn't conflict with SHTTP except in terms of adding to the processing time. I guess I don't see why SSL is so awful from a crypto standpoint. Could someone a bit more educated on the nuts and bolts clue me in on its weaknesses? As compared to other schemes, perhaps? Thanks in advance, Steve Champeon Technical Lead, Web Services Imonics Corporation

1 0

P.S. re: IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

I am told by my local net expert that it should have been: http://ntiaunix1.ntia.doc.gov:70/iitf/security/fedrole.txt (but the URL I sent before worked for me). The report is dated June 14 -- but I don't remember seeing any discussion of it on the list. IMHO, it's very good -- gives passing mention of Clipper but doesn't push GAK. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Re: Netscape the Big Win
by Peter Trei 17 Dec '03

17 Dec '03

TC May writes: > Frankly, one of the great boons of my current setup is that I can > completely get away from Unix tools and commands [...] >...my fingers are already forgetting the emacs commands! If I forget thee, O Emacs, let my right hand forget her cunning. If I do not remember thee, let my tongue cleave to the roof of my mouth; if I prefer not Emacs above my chief joy. (with apologies to the psalmist) Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Lotus AmiPro doc
by piff＠world-net.sct.fr 17 Dec '03

17 Dec '03

I was recommended to you by a friend who told me that you may be able to help me decrypt or suck the password out of a LotusAmiPro doc. Your help would be greatly appreciated. Please email back me as soon as you can find the time. Thank you.

1 0

Plan 9 OS (NewsClip)
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

AT&T Launches Plan 9 Operating System Murray Hill, NJ, July 19 -- AT&T has announced a new distributed operating system, called Plan 9. The new system was developed by some of the same people who created the Unix operating system, and the terms on which AT&T is making it available are reminiscent of Unix, but the company stressed that Plan 9 is not Unix. Named for the cult science fiction movie Plan 9 From Outer Space, the Plan 9 operating system is designed to work well on networked computers. It has components for "terminals," or desktop systems, for file servers, and for central processing unit (CPU) servers. Plan 9 is designed to deal with multiprocessing systems as CPU servers. It supports four major hardware architectures: Intel Corp.'s x86 line (including the Pentium chip), MIPS Computer Systems Inc. processors, Sun Microsystems Inc. SPARC chips, and Motorola Inc.'s 68020 and 68040 processors. During simultaneous press conferences in Murray Hill and San Francisco, connected by a teleconference link, Rob Pike, one of the Plan 9 developers, said the new system is meant to combine some of the advantages of Unix with some of those of low-cost hardware. "We basically started by noticing some things that we liked and didn't like about Unix and liked and didn't like about workstations," Pike said. Pike stressed that while Plan 9 borrows some ideas from Unix, it is quite different and is not compatible with Unix. He went on to say that AT&T does not expect Plan 9 to compete with major commercial operating systems such as Unix and Microsoft Corp.'s Windows NT. "This is not the next Unix," Pike said. It appears in fact that the most promising commercial market for Plan 9 might be in embedded systems. During the press conference, AT&T researchers and officials repeatedly mentioned the possibility that Plan 9 might be built into consumer devices and other intelligent electronic devices, an area where no standard operating system predominates today. AT&T plans to make Plan 9 available for commercial licensing to other vendors for an initial fee of $200,000, plus per-copy fees that will amount to 20 percent of the resale price of commercial software or two percent of the selling price of hardware with Plan 9 built in, said Paul Fillinich, marketing manager for AT&T's Software Solutions operation. Single copies of Plan 9 will also be available for research and educational use, but Fillinich stressed that the company will not provide technical support. "We will replace the media should it fail," he said. For commercial licensees there may be some sort of support in the future. "We are contemplating this," Fillinich said. "However, we haven't decided what the offering will be." Publisher Harcourt Brace & Co. will distribute Plan 9 for AT&T. The full package, including a CD-ROM, four diskettes, and two manuals, will cost $350. The manuals are available on their own for $125. Apparently wishing to avoid a repeat of the way Unix splintered into many different versions, AT&T is specifying that while source code for Plan 9 will be made available to research and educational users, any changes they make will become AT&T's property so that they can be incorporated in the base code. "We want only one Plan 9," Fillinich said. "We think the industry wants only one Plan 9." The minimum hardware needed to run Plan 9 is an Intel 386 processor with eight megabytes (MB) of memory and 40MB of available hard disk space, said Phil Winterbottom, another of the Plan 9 developers. An optimal arrangement would include a dedicated file server and multiple desktop terminals, he added. Further information about Plan 9 is available on AT&T's Plan 9 home page on the World Wide Web, at http://plan9.att.com/plan9/index.html. --

1 0

Re: Netscape the Big Win
by Hal 17 Dec '03

17 Dec '03

From: Adam Shostack <adam(a)bwh.harvard.edu> > Actually, it also supports Kerberos (not relevant to most of > us), and PGP messaging. Although a KCA would be needed before anything > useful came of the PGP support, at least its there. It appears that support for PGP messaging has been removed from the July 1995 SHTTP draft. So it's X.500 all the way. <URL:http://info.internet.isi.edu/in-drafts/files/draft-ietf-wts-shttp-00.txt> From: Steven Champeon - Imonics Development <schampeo(a)imonics.com> > The one "advantage" to SSL that they were pushing over SHTTP was that > SSL is a socket-level encryption mechanism, as opposed to protocol- > level. It doesn't conflict with SHTTP except in terms of adding to > the processing time. > > I guess I don't see why SSL is so awful from a crypto standpoint. > Could someone a bit more educated on the nuts and bolts clue me > in on its weaknesses? As compared to other schemes, perhaps? Frankly I don't think SSL is particularly weak cryptographically. It has gone through several revisions as various problems were pointed out. The one thing I would note is that there is considerable known plaintext being exchanged in the handshake. This helps with key guessing and will be the foundation for the SSL challenge that Adam Back is organising. IMO at least some of this material could have been sent encrypted with the public key so that an eavesdropper couldn't know it. OTOH this might have run afoul of the NSA's rules on export for at least the 40 bit version since you'd have more than 40 bits of secrecy in effect. SSL includes a 16 byte checksum with each packet. IMO this is overkill and wasteful for small packets. One thing about SSL is that it provides both secrecy and immunity to certain kinds of active attacks. These big checksums include a sequence number and key information to prevent replay attacks. For some purposes you might be satisfied with secrecy and not want to pay this overhead. I think a lot of the criticism of SSL was based on the thought that it would be obsoleted by the new IP secure protocols. That may be true eventually but SSL is here today, in use. Order something from Netscape and it is secured with SSL. Buy the domestic version if you want real security. For IP, many of us we will have to wait until the new IP protocols get built into our OS's and other infrastructure. People have also objected to the use of the X.500 certificate approach. But that seems to be de rigeur for any serious Internet standard these days. IMO the real solution is to come up with a PGP-like X.500 certificate maker so people can easily set themselves up as Certificate Authorities and go about their business while the anal hierarchy fans argue about liability. Actually I think there is a PD certificate maker around, possibily from Eric Young down under. Hal

1 0

Re: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "tcmay" == Timothy C May <tcmay(a)sensemedia.net> writes: tcmay> Integration of crypto into Netscape is thus the Big Win. tcmay> I felt this was the case as far back as last fall, but my tcmay> recent experiences tell me this is more important than tcmay> ever. Integration of PGP and other crypto routines into Tin, tcmay> Pine, Elm, Joe, Emacs, etc., is just not as important. Careful here. Deliberately or not, you are marginalizing the hard work of dozens of people, including me. You are suggesting our work should have been done for Netscape instead, a program that a) is not free software (FSF sense); b) has no mail reader; and c) has no extension language. Oh, and d) is horrendous as a news reader. The packages that you implicitly denigrate provide far and away the best interfaces to PGP available today. They are written with the tools available, whether it's a Windows shell, a hacked version of Elm, or an Emacs Lisp package. Maybe Netscape will include a mail reader someday. Maybe Netscape will include Java as an extension language someday. But until that day, the only people who can put crypto into Netscape are the folks at Netscape Communications. tcmay> IBM just paid nearly $3 billion for Lotus, largely for the tcmay> "common platform" of Lotus Notes. I believe Netscape is an tcmay> even more important common platform, and will displace Notes. Netscape is not a platform. It is a browser. It is only useful for viewing content that others have created, with a user interface that any idiot can use. Consequently, yes, it is very popular with the masses and will become more so. tcmay> The relevance for Cypherpunks interested in writing code is tcmay> that, in my carefully considered opinion, writing for Netscape tcmay> and other Web browsers is the Big Win. Even over Windows tcmay> (except Windows browsers, of course). Can you name a platform for which it is possible to write a PGP front end, but for which none has been written? If it is ever feasible to do what you suggest, someone will do it; your musings will have no effect on that. If you want to make a difference, try writing some code yourself... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6Rg3r7ES8bepftAQG4egQA2QFjXo5wgVOCtz2qGkgBbw80F4U80C1p d1noVQN95tFYc1vjgk0ftp8n5stURtuD6MEoHNoKDOQgCIzbPlEC9rIETAzW1kfd GTG8DzRqkcY1YqrTEnLoNiUswIfkVaquf9JrWNSuPKzLZ+IsUto1SxxNjk0fR7pf ou4k3Fo+3yQ= =BpNr -----END PGP SIGNATURE-----

1 0