December 2003 - cypherpunks-legacy

big word listing
by It's supposed to crash like that. 17 Dec '03

17 Dec '03

As a security measure, I am trying to get a massive dictionary of words together, and each time a user changes his/her password, it checks the list to see if the password is in it. My question is, are there any pre-built lists of this nature? I am currently only using a spelling dictoinary, and would like somthing a little bigger.

4 3

"Hey Phil! Stop telling people *not* to use PGP!" (plus: "help me with my PGP
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bryce Wilcox <wilcoxb(a)nagina.cs.colorado.edu> writes: > And I say "No no no, using a key which you got through the Net is better > than using no key at all, just be aware that if someone *really* wanted > to spy on you that they could have tampered with it. When you see Cousin > Joe next Christmas you can compare keys with him and make sure you have the > right one." I suppose one could always send Cousin Joe an encrypted message and see if he can read it..... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMBAPON74r4kaz3mVAQGoXQP9HYxFLJ3BEs5YhJ3Yaf3NGbUTIwB3pBw+ QNAzqiuKcNQmQ8/EZ160FK8JeeKAwMcSHA/a+/coG5+82DEiDfbkyLRXJK60c+j3 jVksrm3jxd9nfBk1SrWddHj6SYg8+0Rxz9aNFkfmwcNWJVPNcDkwvzAHZ1wO9rqZ gPaq8xIjfAA= =1I7d -----END PGP SIGNATURE-----

1 1

Free Java courses in CA
by cman＠communities.com 17 Dec '03

17 Dec '03

[[ This is another reason why I think Java is worth looking into -- on one hand, there will always be free tools available, in addition to commercial tools; on the other hand, it is being strongly supported by SUN ]] The SUN Sacramento Training Center announces the following FREE courses. The Java Programming Series: #1 An Overview of the Java Language The Java Programming Series: #2 Accessing Data Files The Java Programming Series: #3 Simple GUI Applications The Java Programming Series: #4 Program-to-Program Communication The Java Programming Series: #5 Applets Design and Implementation The Java Programming Series: #6 Accessing an Oracle RDBMS Each course is: - 2 hours in length (they always start at 9:00 AM on Fridays) - fast paced - an introduction to the course topic - FREE It is assumed that each student: - knows C and/or C++ language syntax - has a basic understanding of object oriented programming - has a personality that enjoys taking a jump-start course and then learning the rest of the technology via projects, newsgroups, and email-alias discussions. You should NOT attend this class if: You are a techno-weenie. You are already an experienced JAVA programmer. Instructor: Matthew Calame -------------------------------------------------------------------- A DRESS CODE is REQUIRED of all students. Dress Code: Traditional Silicon Valley casual attire (blue jeans and company tee-shirt) -------------------------------------------------------------------- Current Schedule: 08/04/95 The Java Programming Series: #1 An Overview of the Java Language 08/18/95 The Java Programming Series: #2 Accessing Data Files 09/22/95 The Java Programming Series: #3 Simple GUI Applications 10/06/95 The Java Programming Series: #4 Program-to-Program Communication 10/20/95 The Java Programming Series: #5 Applets Design and Implementation 11/03/95 The Java Programming Series: #6 Accessing an Oracle RDBMS Note: If your group needs training at a different location or at different times, please contact matthew.calame(a)west.sun.com. -------------------------------------------------------------------- Courses will be held at: Sun Microsystems 8880 Cal Center Drive Suite 200 Sacramento, CA 95826 -------------------------------------------------------------------- To Enroll: (1) Send an email to: java-training(a)sacto.west.sun.com The email should contain your: Name: Company Name: Mailing Address: Telephone Number: Fax Number: Email Address: **OR** (2) Send a fax to: 916-362-3287 Attn: Matthew Calame The fax should contain your: Name: Company Name: Mailing Address: Telephone Number: Fax Number: Email Address: -------------------------------------------------------------------- Regards, Matt ---------------------------------------------------------------- Matthew B. Calame Systems Engineer Sun Microsystems Computer Corporation Phone: 916-856-5507 or 916-856-5500 Email: matthew.calame(a)West.Sun.COM Fax: 916-362-3287 Sun Mailstop: USAC02 Address: Sun Microsystems 8880 Cal Center Drive Suite 200 Sacramento, CA 95826 ---------------------------------------------------------------- - Note to Sun employees: this is an EXTERNAL mailing list! Info: send 'help' to java-interest-request(a)java.sun.com

1 0

Re: big word listing
by Chris Gorsuch 17 Dec '03

17 Dec '03

The crack library points to some dictionaries which have not only real and "imagined" (literary) words, but also words from other languages as well. All in all a good resource. -see adams message for pointers However, the reason I write is if you decide to add users previously used passwords to the dictionary, make sure your "appendages" to the dictionary are secured. Users are notorious for forgetting to change or reusing on other machines the passwords from various servers. The advantage is that your users will never be able to reuse their old passwords. The disadvantage is that your admins can attempt to hack other machines using these passwords. A "cryptographic" solution would be to simply store a hash of the password rather than the password itself in the "appended" dictionary. A CRYPTOGRAPHIC solution would be to use one time passwords :). Chris Gorsuch chrisg(a)ti.com *I am not responsible for the content of the above message :)

1 0

Re: Java (was Netscape: the big win)
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Personally, I think the whole recent debate here about Java, Netscape, TCL, Safe-TCL, Telescript, Linux, etc., has been very useful and stimulating. The detailed exposition of ideas by Ray Cromwell, Doug Barnes, Hal Finney, and several others is exactly what this list is all about. At 7:24 PM 7/21/95, Douglas Barnes wrote: >Note that I'm championing the use of Java as a portable language, >with a portable windowing toolkit, that will (real soon now) have >commercial tool support from a variety of vendors, as well as free >tools available on the net (the best of both worlds.) > >The whole issue of how to do cryptography with applets is kind of >complicated, and is something Amanda and I have been working on very >dilligently. They hard part is determining what the interface is >between trusted code (that you have installed on your machine, or >ultimately, that you've specifically designated as being trusted >based on secure hash) and untrusted code that comes from random >web sites on the net. Ray's list of the many applet-based applications (so to speak). this stuff Doug is working on, and Hal's ideas, all could lead to a next-generation of Web-oriented user tools. I have no idea, of course, which of the various languages and tools will succeed. But it's good to see so much interest the past year or two in new languages...it was looking for a while like C++ would be the only game in town. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Problem synchronizing sockets...
by rross＠sci.dixie.edu 17 Dec '03

17 Dec '03

> I'm a newbie at socket programming so this is probably going to >be an easy question (I hope). I've been developing a client/server >project using SSLeay and I'm having problem synchronizing my messages. >More specifically, I use a combination of SSL_read and SSL_write to >exchange messages bix my client and server. The problem is that my >client is reading (SSL_read) before the server is done writing and reads >an empty buffer. This does not occur all the time but often enough to >make things quite unreliable... I've tryed using the select() command >but that doesn't solve it. Help..... > > Andre This is generally true of sockets programming. You don't know that you'll get as many bytes as you request. The simplest solution is to loop your read calls until you get what you need. See BSD Sockets: A Quick & Dirty Primer for a sample solution. The URL is http://www.ntua.gr/unix/sockets.html ----------------------------------------------------------- Russell Ross email: rross(a)sci.dixie.edu 1260 N 1280 W voice: (801)628-8146 St. George, UT 84770-4953

1 0

Re: It had to happen...
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 12:45 7/21/95, David Lesher wrote: >Note that last I heard RM Sr. had retired & moved to New England. >He is an interesting ....character... for lack of a better word. I got that impression from the description in Cuckoo's Egg.

1 0

Re: New Form of DOS Attack
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>If you want to deny the Feds the opportunity for some energetic service of proc>ess >all you have to do is hire Rodney King to move in. Once he is onsite, the Feds >will be helpless. Just keep your Greenpeace Special (tm) sat cams focussed >on old Rodney and you have absolute immunity from all incursion. Err, hasn't he just been indicted again?

1 0

science foundation interested in anonymity
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

A mindblowing opportunity to promote the cypherpunk ideal of anonymity in a highly reputable and influential context recently dropped into the lap of a friend of mine. This close friend of mine got an inquiry from an extremely prestigious science foundation into the possibility of studying anonymity in cyberspace. It is an entirely embryonic stage right now, but a director at this association is interested in commissioning papers, interviewing subjects, having focus groups, perhaps even organizing a conference on the subject, particularly the "social, legal, and technical" angles. This may have major impact in the various and sundry studies influencing future policy on the "information highway". If you can forward me some leads, I would appreciate it greatly, and I will get you in touch with this key person. At this point the contact is at an idea stage and probably would benefit greatly from talking to organizers of similar endeavors. Also this project would involve fundraising for the cost of the studies, so anyone you might know with an interest in sponsoring this kind of endeavor (particular corporations, although that would be a bit paradoxical I admit), please send me email. For example, if someone could get me the name/phone/email address of whoever chaired that panel on Anonymity a few years ago at the Conference on Freedom and Privacy (Helsingius and Gilmore were panelists), I would greatly appreciate it. many thanks-- ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

1 0

Re: The OS wars and DOOM...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Apps have migrated from Unix to the Mac and the PC before in the > past. In the further past, this has included curses and > other-types-of-text-control packages such as PC versions of Emacs > and nethack and the like. > Of course, this was not done with graphical programs; everyone > knows that graphics isn't Unix's strong suit, and what it has is > so different from the PC, etc., blah, blah,... > Except that for the past two or three years, it's been WRONG. > One of the hottest games on the PC, DOOM, was originally written > in Nextstep (a Unix variant, and a ghetto even amidst the "ghetto" > of Unix) and then ported to the PC. Being a resident of the NeXTSTEP ghetto, please allow me to chime in. While Doom is written on NeXTSTEP boxes, that's about all the game itself has in common with it. The game is carefully written in strict ANSI-C and any portions that must be OS specific are separate. They have a VGA emulator that allows them to run Doom on non-DOS boxes. All of the platform independance comes from the discipline of the developers (who are extremely talented, IMHO). In contrast, Lotus Improv was NeXT native and had to be completely rewritten over a period of at least 3 years to get it to work on Windoze. The primary reason Id software (and Trilobyte among others) uses NeXTSTEP (over DOS or any other unix environment) is because it lets them write in-house tools like map and monster editors really fast (and really slick too!). On any other platform it would take much more time and effort to write the tools and they probably wouldn't be as nice either. Since these tools aren't being sold to customers, it doesn't matter that they only run on a dead-end niche software platform that costs $1000 per user (and $5k per developer!!). This strategy makes sense for a commercial video game where there is the opportunity to save major amounts of time and effort through the use of custom tools (and the incentive of major amounts of cash if it is successful). However, this strategy definitely doesn't make sense when you are talking about a cypherpunk donating their spare time to write a freeware (or copyleft) crypto app. Better would be to just write the app for the target platform or write it using an environment that is designed to be platform independant (like Java). andrew ...able to work cypherpunks relevance into virtually any thread......and uses Python instead of NeXTSTEP when writing stuff that needs to be platform-independant...

1 0