December 2003 - cypherpunks-legacy

Re: CIAC Bulletin F-09
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sigh. After all these years, people are still using mail systems which run /bin/mail setuid-root instead of setgid-mail..... Once in a while it's nice to be using System V. Bill

1 0

OSS status
by dfloyd＠io.com 17 Dec '03

17 Dec '03

Just when I almost get a prototype for the offsite secure storage (OSS) program working, I have to hit the self-destruct lever... The site I was having my test for the OSS suddenly became hostile. To keep things from getting worse, I deleted all stuff from there. It will be a week or two getting the bug fixes in (I backed it up a week ago...), and some time until I find a site that I consider 'non-hostile' to work on. Currently the commands follow the pattern of Remailer-net with the two colons meaning a pasted header, and two or three commands (Store, Retrieve, Delete) for the files. Work is slow due to the fabled Job Hunt (tm). I appreciate your patience. Douglas R. Floyd PGP key fingerable from keyservers. Note new key as of 1/1/95.

1 0

It's a Crusade ...
by Jonathon Fletcher 17 Dec '03

17 Dec '03

I've really been enjoying the traffic recently - this religious 'skirmish' has generated nearly as much traffic as the Logo Wars. I do have my own strong opinions about this particular subject, but I'm fighting back the compulsion to fly, berserker like, into the fray. However, it might be time to let it all lie for a while. This is, after all, a list for cryptography. Users of all kinds/makes/manufacturers of computers need good crypto software - so in that respect all contenders in this are equal. Ding Ding. Time out guys. -Jon -- Jonathon Fletcher, jonathon(a)izanagi.sbi.com

1 0

Philadelphia CyberCrime
by storm＠marlin.ssnet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Heard on the news today that they arrested a plumber and are holding him in lieu of $50,000 bail. He used a PC to crack into the phone system and set up 'Ultra' call forwarding which forwarded calls to other plumbers businesses to his. He then took the calls and told the callers that his company was covering for the one they actually called. Personal opinion: while I think the guy did steal business from the other firms, they authorities are trying to find the customers he 'defrauded'. If they were happy with the work, I don't think they were actually defrauded. The other companies did lose income and I think he should be prosecuted for that, but $50,000 bail seems a little excessive given the crime. End Personal opinion. - -- America - a country so rich and so strong we can reward the lazy and punish the productive and still survive (so far) Don Melvin storm(a)ssnet.com finger for PGP key. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLynFCGvyi8p8VUiJAQFbfwQAq1OimjQvAyOdspvRSIBOApdEryeEXlSf 9YJ0wZAvuSHWxjkJpgapQKwAQxb4kkpJi6BvXqrnMjCWpkc9t5eMwr6Cc7XZUJea wmYaS19KcSfmgp0x4vJW0QwISR2GDgwyKH0oSz1+uWMTdHka5B70KVsQomnVgUww 8VK0bIrq/Fo= =I4iQ -----END PGP SIGNATURE-----

1 0

Re: Even more unix holy war. Was "Clinton freezes U.S. assets .."
by ethridge＠netcom.com 17 Dec '03

17 Dec '03

>I am writing this under sun's unix imitation of Microsoft's >and Apples GUI. I am using their almost acceptable ASCII editor. > >I leave a window open for a long time. > >Then I attempt close down the window, an operation that I can >do in Microsoft Windows with a single double click. In unix >I click on the border to bring to popup a menu, carefull drag >to the right point on the menu, then release. In addition >the menu names are confusing. If you want to minimize a >window you have to "close" it. If you want to cause a window >to cease to be, you have to "quit" it -- Hey did I not already >quit it when I forgot about it and went to do something else. > > >A warning message comes up: I have not saved. I am offered the >options of quiting or not quitting. > >Gee guys, did it never occur to the great unix gurus that at >this point the option that the user most likely wants to do >is save the file. How come the number one most common option >is not in the message box. I think you've confused whatever poorly designed GUI you've chosen to use with UNIX. The GUI on my workstation at work doesn't behave like this. It's not as intuitive as my Mac, but it does bear a rather frightening resemblance to the Windows system that my brother has on is Compaq. Unix isn't a GUI, or even a UI. It's an operating system. And it performs that function better than most. allen allen(a)well.sf.ca.us It's dangerous, child, to come to conclusions ethridge(a)netcom.com when you don't have any facts. my opinions are my own Dr. Hemlock, The Eiger Sanction

1 0

Re: anonymous mailing
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199501280110.UAA12579(a)bwh.harvard.edu>, Adam Shostack <adam(a)bwh.harvard.edu> wrote: > The Economist is written anonymously becuase it prevents >"Dan Rather syndrome." You mean getting beat up by randoms screaming "What's the frequency, Kenneth?" - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLymZfhNhgovrPB7dAQGIOgP/UYbdUbAzhhsqwzQ8FVZzcKFaxPHed6Zk uu/m7ShxcS1/Ok1KPLf0a4S3E1jGLsyfrZwCaFAJTTViMO1Cq/BgNaY9TE3lhqZT Zx7zPDgaJJVQhDw34X62vD5lFRWmxqgn8mdgyQ+/G4x7TJom1jbIeQgpfwObB0Hq 62OK1R+I/6M= =lYEA - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLynSWyoZzwIn1bdtAQGCSQGAoc8P9J6Ffg9FQwiJgZDT8IlGkRot2UNv IOdE6m8xWJTn8U68u6TBUcc0Z/ldLjpg =FG1N -----END PGP SIGNATURE-----

1 0

Even more unix holy wars.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

jamesd(a)com.informix.com wrote: >but in unix you type: > find . -name filename -print This assumes the find command actually works ;) Find doesn't follow symbolic links, which renders it mostly useless. It doesn't follow symbolic links to avoid falling in a infinite cycle. Of course, any second year computer science student can devise an algorithm that follows symbolic links and detects when it is in a cycle, to escape. The unix philosophy "small is beautiful" <--> "when faced with a choice, cop out and take the easy route" This is all well documented in "The Unix Hater's Guide." How would I go around undeleting a file under Unix? It's easy on the Mac. Doing it under DOS is ugly, but it works. But with unix, there is no way. More productivity has been lost because of accidental erasure under unix than was lost dealing with the internet worm, than all security breaches combined.

1 0

Re: Even more unix holy wars.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Perry E. Metzger wrote: >Did I mention that DOS used to make you use EDLIN out of the box? Did I mention that UNIX used to make you use ED out of the box? > that Unix is somehow harder to use than DOS. Of course it isn't. Train somebody under BSD (say using csh/tcsh/zsh) and they are totally prepared to get to work under ksh/bash/sh under SVR4. The commands are the same and so are the options, on say things like ps. NOT. Unix commands are powerful and easy to use. For example, to kill a process I have to use "ps -aux" or "ps -ef" depending on which flavor of unix I'm running, note the process id, and do a "kill -9 id". Why can't I kill a job by name (i.e. I can do a "fg %emacs" but not a "kill %emacs".) Unix is filled with design abortions like this. > that X is harder to use than Windows How about better Windows software is available?

1 0

alt.religion.your.operating.system.sucks
by Joe Turner 17 Dec '03

17 Dec '03

I mean no disrespect, but the attrocities commited by the aged masters who wrote most of the operating systems are well documented. I have run into this line of thinking in many occasions (my <insert compiler or operating system> is better than yours...), although it it seems to be more of a sore spot to those who love thier compiler/ interpreter. Most of these observations are made out of ignorance. I get paid for programming under NT, windows, MS-DOS, VMS, RSX, and UNIX, not insulting the designers or users. Additionally, I deal with other people in other companies who love thier AS/400s and IBM mainframes. Hell there is even several programmers here who go misty-eyed everytime the word Amiga is mentioned. I bet there is even someone out there who believes that he/she could write a GUI operating system in COBOL (if someone has accomplished this I would love to see the punch cards...). UNIX is a programmers environment. It is very flexible, and you can do just about anything you want to, provided you have the ability. Spawning processes and child processes are trivial, and much more efficent compared to windows-NT and VMS. Additionally, I don't know of too many operating systems where the source code is floating around. I mean so what if it doesn't come with a pretty shrink wrapped package and a thick getting-started, if you have a question just go find the source code. Geez. And as far as a GUI, most of my work revolves around plain old ASCII. X windows may be "standard" now, but it didn't stop SUN, DEC, etc., from making their own proprietary (errr.. I mean "optimized") versions. I don't know why there is so much whining about: - My GUI interface sucks - Your GUI interface sucks - Your mother's interface sucks. I see no reason to puke up this garbage other people. VMS is more secure (interlock intrusion detection, etc.), but any operating system is only as strong as its users/administrators. The one thing I do not like about VMS is the way the system libraries are structured, but such is life. I was not consulted when DEC was designing the operating system. Thier Xwindows system needs some work, but it does work. NT is cool (if you are running on a 300MHz Sable). I think it is something special when you can run UNIX, Windows, and OpenVMS applications simultaniously on the same box. Can your operating system do that? Hell, for $3500 you can by a 166MHz alpha that will do this. System 7 is great. I just didn't like it. I didn't like the way I was isolated from the hardware, forced to take what the designers thought I needed. Just my preference. Besides, Apple equipment was, and still is overpriced (I should know I used to own several). Windows isn't a true multitasking operating system, and besides its like the old joke, Q: "how do you turn a 486/66 into a 286?" A: "run windows!". But like it or not, it is here to stay. I do like programming under windows over dos, simply because it is a pre-emptive operating system and forces the programmers to write structured code (for the most part) to intercept the messages. But the serial driver code sucks. PDP-11/RSX. Ewwwwww.. MS-DOS. If you want to write fast graphics, assembly is the way to go. Windows just can't keep up. Sure Micro$oft released win-G, but what's the point. Your operating system is so much better than mine are, as is your keyboard, your mouse, etc., My point is that every operating system, programming language, or whatever has benefits and detracting points. If you want to continue this discussion, I will be more than happy to create a list for it,.. then you can rant until you fingers are bloody. -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597 Finger for PGP KEY.

6 7

Secure (!?) Remailer Net
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Maybe I'm way behind the curve on this, but... The traffic analysis that we've seen so far mainly just documents tcmay's "everybody a remailer" concept. If you look, you will notice that these analyses all assume that Alice and Bob are _not_ remailers themselves, and for a good reason. If Alice and Bob _are_ remailers, analysis of the type used here is worthless, especially if Alice and Bob have a policy of not sending any mail unless they first receive garbage, and of sending out garbage whenever they get a letter. HOWEVER, the analysis makes another assumption--that messages are indistinguishable. This assumption does not correlate, as I understand it, with the current remailer net. There are, as I see it, a couple of modifications that (I think) would not impose to great a burden on our longsuffering coders, and, as a side benefit, might allow more flexibility in other matters as well. Standard packet sizes, as I see it, are not very difficult to implement, with a couple of assumptions. (I now assume that all traffic is intra-remailer-net) First, the message is signed with the sender's key. (More on that later.) Suppose a signed message to be forwarded is smaller than the standard packet size. The sending remailer adds a Cutmarks: header. At the end of the message, the cutmark is added, followed by sufficient garbage to fill out the standard packet size. The message is then pgp'ed to the recipent _with COMPRESS = OFF_. Upon receipt, the message is decrypted, and its origination can then be triply verified (at least). From: line, packet size, and PGP signature. Since the message claims to be from a packeting remailer, the packet size should be the standard one. The recipient now has the message that was sent to it. This message is probably itself encrypted, so it can be handled (almost) as if this message were just received. This includes stripping the garbage and (probably) decrypting the message to get the forwarding information. Note that this system would allow the extropian remailer to be compatible with Matt Ghio's alias system. (Right now, the remailer doesn't like separate pgp packets, or packets it can't read, or something.) Under the current system, the precausion is entirely warranted. To make life even more fun, there is no good reason that non-remailers cannot be in on the action! Alice, sending to Bob through Chaum, pretends to be a remailer. That is, she prepares her message to Bob, (encrypted), and adds the Request-Remailing-To: Bob(a)nowhere.org, and signs it. She then observes that the message is too small, so she adds the Cutmarks: header, etc. When Chaum receives the packet, he opens it, removes the cutmarks, and sees a signature he does not know. Chaum then sends a request to pgp-key-server(a)omniscient.gov for the key, and holds the message until he gets it. He then compares the address and name on the key recieved to the message. The signature is good, so he is ready to send the packet to Bob. But Bob can be in on the game as well, since there is no reason that he cannot handle the Cutmarks:, the signature, and the nested encryption. In fact, Alice could include a copy of Bob's key in the message for Chaum to use, after a Recipient-Key: header. Bob can also verify that the message was actually routed through Chaum. If Chaum is concerned that, at some future time, Eve might supeona his key ring in order to demonstrate that Alice and Bob are using Chaum, Chaum can alternately request keys that he does not need from the servers, and delete (older) keys in the ring. In other words, if all the remailers can handle nested pgp packets and cutmarks, we are close to moving all small messages to a standard size. What if the file is too big? If the file is too big, break it in pieces. We need a header, Multipart Message: n of m. Note that since this is assumed to be _inside_ a pgp wrapper, it is secure. The recipient could hold and merge the files as needed. If the message to be forwarded is too big, split and continue. Since the messages are ascii armored, the split/combine protocal is to concatenate. Message parts could be made equal size to minimize the chance of a message barely bumping over the limit as it moves. Of course, Alice could break her message to Bob directly, but we cannot assume that all would do this for us. This also means that if Alice sends a message to Bob in the clear through Chaum, and David, that the message will be encrypted from Chaum to David. Thus, if Eve wants to know which message from Chaum to David is the one from Alice to Bob, (perhaps to know that it is _not_ the message from Frank she is interested in) she knows only that it was one of the messages from Chaum to David after Chaum got the message from Alice, and before David sent it to Bob. While Chaum and David can both read the message, it still provides mixing capabilites inside the remailer net itself, and thus, some protection to Frank. (Who apparently needs the help.) A word on remailer keys: Since pgp uses square-and-multiply for exponentiation, we see that the amount of work needed to sign a message is d(m) * (d(e) + o(e)) where d(m) is the digits of the modulous, d(e) digits of the exponent, and o(e) is the number of ones in e. (I don't remember the technical term.) Since the public key is small, each of the parts of the private key will be large, BUT, there is no reason to assume that we cannot get lucky, and find an m such that d(e) + o(e) is much smaller than expected, (d(m) * 3/2, roughly) thus greatly reducing the system demand of the remailer. In fact, it might be possible to move to 768-bit keys for those that have kept their sizes down in the past. If pgp handles each prime separately, we look for a double-lucky modulous. (And a source of random numbers that does not involve striking keys!) Cypherpunks come up with really neato ideas for somebody ELSE to code... (Sorry guys, but I've not figured out how to get Unix/TCP/etc working on my Amiga...yet...) By the way, the following key id's are showing on the list, but are not on the servers: 27D5B76D 231C7021 34ED427F E37385DD. The first is the auto-signer at bb.hks.net. Also, my modem isn't too thrilled with my connection these days, If the signature fails, look for obvious errors in the text. Sorry. "PGP?" "ITAR!" "Oh, RKBA!" |--------------------------------------------------+ ----------------- 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> ) |44B3D866 3D551E2E --------------------------------------------------- |F89222A6 338CDE24/ | ----------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLym3unmgMs8UcStNAQEAZggAlIsw7HDs4V2GU3DQo7Fx5TiRO6+6mW2B 7Qjn6I+CY1URQQbA3bhPvYoJUt2o3DJ0BCLRej03L/7mdRJmqS3f/1m+juflqPm7 oKlonwpOpFNg2kFSzjE4IpAgIcgi7tHgaLKsIfQ4+QO3s4pJdwAf8VMBHGLyWd2Z h9mNaKgUeKHjhHys2zATm6FNMipcAQgU8sFOl4/YIGyso+cfj4iSXAK4NM4tolDZ uca7l6bQdW5vwRjCJhNmKo+GuSHCY/QczbZZ9R5SkE58LrOVj1MY2x3qcg6gD04X Veddx83tLLsvnh02psRkWH+n0tv7GP8s8cle1ziJcgT96DrQIW6qMw== =t9x5 -----END PGP SIGNATURE-----

1 0