December 2003 - cypherpunks-legacy

Global Filesystem Guild
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

To reduce the vulnerability of a single user/BBS to having their files confiscated/stolen, could a distributed WAN filesystem be implemented with k-redundancy, e.g. the files wouldn't disappear until k servers (located in various unknown or inaccessible places) failed? The price of storage would vary with the level of redundancy desired. For security the servers would only store cyphertext, etc. Local cacheing to reduce network load. Andrew File System (from Transarc/IBM) implements the distributed filesystem and namespace and some security, but not the redundancy for RW files. (And it's not shareware). Issues: Quota management. Pricing (for space or time) Security: (only store cyphertext?) Ownership: (who gets to delete files?) ... Sort of the next level beyond SecureFS?

2 1

http://www.vocaltec.com/gti.html
by Duncan Frissell 17 Dec '03

17 Dec '03

As seen on page B1 of today's WSJ: > [Image] > > Talk over the Internet with your own voice. > Communicate with people from all over the world. > And all this with your existing Internet account. > > Internet Phone (TM) is a unique software product that opens a new and > exciting dimension for Internet users. With Internet Phone you can use > the Internet to speak with any user all over the world! Yes, real-time > voice conversations over the Internet, at the price of a local phone > call or even less. > > All you need is Internet Phone, a TCP\IP Internet connection and a > Windows-compatible audio device. Plug in a microphone and speaker, run > Internet Phone, and, by clicking a button, get in touch with Internet > users all over the world. Whether you want to meet new friends, get > information personally, or make the direct business contact, Internet > Phone is for you. A friendly graphic user interface and a smart > Voice-Activation feature make conversation a snap. VocalTec's > sophisticated voice compression and voice transfer technology makes > sure your voice gets across in a flash, using only a fraction of the > available bandwidth. > > Internet Phone always presents you with an updated list of topics and > on-line users for you to choose. You can even set up Quick-Dial > buttons which give you immediate access to frequently called users. > Once you establish contact with a user, communication is carried out > directly over the Internet. > > [Image] > > How can I order Internet Phone? > > To be able to fully use Internet Phone over the Internet, you need a > unique registration code. The Internet Phone software license can be > purchased for only US$49! This is a special limited time offer (The > standard retail price is $99). All you need to do is fill out and send > us this order form, and we will supply you with the registration code. > > You can even download the Internet Phone software and evaluate it for > free! Without the registration code, you can use all of the Internet > Phone features, but are limited to 90 seconds of speech. You have > nothing to lose - check it out. > > You can download your free evaluation copy of Internet Phone from > ftp://ftp.vocaltec.com/iphone.zip. > > For business and power users, VocalTec offers the Internet Phone Kit. > The Internet Phone Kit includes, in addition to the Internet Phone > software, unique hardware that improves sound quality and dramatically > reduces bandwidth consumption. > > Internet Phone System Requirements: > > 486SX PC - 25 MHZ, 8MB RAM (recommended) > > WinSock 1.1 > > An Internet TCP\IP connection (minimum connection: a modem > SLIP\PPP connection of 14,400 baud) > > Windows 3.1 > > Windows-compatible audio device > > SEE ALSO: > > > [Image] Ordering Internet Phone > > [Image] Internet Phone: Main Features > > [Image] Request More Information > > [Image] VocalTec Home Page > > > ------------------------------------------------------------------------ > > VocalTec Inc. * 157 Veterans Drive, Northvale, NJ 07647 * Tel: > 201-768-9400 Fax: 201-768-8893 * info(a)vocaltec.com

1 0

why pgp sucks
by Eric Hollander 17 Dec '03

17 Dec '03

if i use a command like pgp filename it will automatically figure out the right thing to do with the file. if it's encrypted, and i have the key, it will attempt to decrypt it. if it contains keys, it will ask if i want to add them to my keyring. if it's signed, it checks the signature. this sucks! if i'm trying to write a program to automatically process incoming mail (for instance, to see if it's encrypted with a specific key), i certainly don't want to have the possibility of people being able to add garbage to my keyring just by mailing it to me. is there a way of saying pgp -decrypt-with-key user_id filename and have it return some error code indicating whether or not the file was in fact encrypted with user_id, and also gauranteeing that it won't do other fun stuff with the file, like add it to my keyring? is there a way of using pgp in a diagnostic mode, to just inform me of what the file contains (is it signed and/or encrypted, from who and to whom?), without processing it, and without interaction, and without messing around with the keyring? has anyone written some scripts to do this kind of thing? or should i just wait until some of the groups working on the other encryption software get it out? e

9 21

Fun with numbers: Payment Switches
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Saw this on buyinfo. At first blush it reminds me of the old CMU "Billing Server" without the gopher... >From: treese(a)OpenMarket.com >To: www-buyinfo(a)allegra.att.com >Subject: technical paper: Payment Switches for Open Networks >Date: Mon, 13 Feb 1995 13:24:48 -0500 >Original-From: Win Treese <treese(a)OpenMarket.com> > > >"Payment Switches for Open Networks" by David K. Gifford, Lawrence >C. Stewart, Andrew C. Payne, and G. Winfield Treese is a technical >paper describing Open Market's Internet payment switch. It will be >presented at IEEE COMPCON '95 (San Francisco, March 5-9). A preprint >is available from http://www.openmarket.com/about/technical/. > >Here is the abstract from the paper: > > We describe the first operational Internet payment switch that > provides real-time authorization suitable for direct use by merchant > servers. A payment switch is a server that creates digital > representations of conventional financial instruments, and forwards > authentic payment orders on these instruments to their corresponding > conventional financial networks and institutions. Our payment switch > provides support for time-based and item-based pricing, implements > switch based authorization and settlement aggregation for > micro-payments, and includes an extensive customer support system in > order to provide a high level of customer confidence in electronic > commerce. Fraud control is based on a transaction-specific > multi-level security model that accommodates existing Internet > browsers. Multiple authentication technologies are applied to every > transaction. > >More information about COMPCON '95 can be found at > http://www.hal.com:80/compcon/ > >Win Treese >Open Market, Inc. >treese(a)OpenMarket.com > ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: West (was:HR830 - Anyone tracking this?)
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

>- House republicans introduce legislation with a section > requested by West Publishing that will provide sweeping > changes in federal freedom of information act, and prevent > federal agencies from creating a public database that use > the West Publishing page numbers to reference case law. Well, the West citation system *is* proprietary, without a doubt. This is a case where ease-of-use has completely dominated. Court records are completely laced with West citations. >- The "West Provision" would also end its lawsuit with Tax > Analyst, a Virginia publisher, who is seeking access to the > Department of Justice JURIS database of court decisions in > order to put the information into the public domain. Tax > Analysts alleges the JURIS database of court decisions are > subject to FOIA and not protected by copyright. A victory > by Tax Analysts in this case will lead to a public domain > database of federal court decisions. The Tax Analyst lawsuit: destined to fail from the start. If they want to do this they will have to come up with their own indexing/citation system, and then get everyone to adapt to it. About as likely as putting 73v AC wiring in every home in America.

2 1

Fwd: Re: West (just a minute)
by Alan Pugh 17 Dec '03

17 Dec '03

the most reasonable and easiest to implement solution to eliminating the need for west's page number system is to just number each paragraph. anyone can do this. ----------------- Forwarded Message Date: Sat Feb 11, 1995 5:57 am EST Source-Date: Sat, 11 Feb 1995 05:49:47 -0500 (EST) From: Craig Hubley EMS: INTERNET / MCI ID: 376-5414 MBX: craig(a)passport.ca TO: * Alan Pugh / MCI ID: 370-1548 Subject: Re: West (just a minute) Message-Id: 81950211105718/0003765414DC2EM Source-Msg-Id: <m0rdFOe-0002IhC(a)forged.passport.ca> U-Mime-Version: 1.0 U-Content-Type: text/plain; charset=US-ASCII Hmm, how hard could it be to eliminate West page numbers? There couldn't be more than a couple of cases on each page, if each page number were replaced by links to each case, a lawyer could tell on the first glance which of the three was right and mark it, assuming a reasonable HTML/SGML editor or something. Seems like it could be done as a part of daily work and the results accreted somewhere. -- Craig Hubley Business that runs on knowledge Craig Hubley & Associates needs software that runs on the Web craig(a)passport.ca 416-778-6136 416-778-1965 FAX

1 0

Re: MIME based remailing commands
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from mail: 10-Feb-95 Re: MIME based remailing co.. Rick Busdiecker(a)lehman.c (1667) > If you start your header name with X-, then you are conforming that > gross, ugly atrocity that is MIME. And yet, by using headers rather > than TGUATIM, you help to preserve sanity and avoid that vast majority > of MIME slime. Well, I have no idea why you think that MIME is an "atrocity" or "slime", but it is perfectly clear that you have no idea what it actually *is*, since "X-" headers have nothing whatsoever to do with MIME. The "X-" headers are defined by RFC 822, which has been the standard for Internet mail formats since 1982. Perhaps you should learn what MIME is before you embarass yourself further. -- Nathaniel

2 1

Re: UMich student arrested for rape story
by Richard F. Dutcher 17 Dec '03

17 Dec '03

> From: "L. McCarthy" <lmccarth(a)ducie.cs.umass.edu> > Rich Dutcher writes: > > They *do* have to prove intent -- as to how, that's what juries are > > for. BTW, he used her real name in the post, with no disclaimers > > about fiction. From what I have heard, if he had said the same thing > > in her presence, he could have been arrested for assault. > > Based on the NY Times article I've read, you're omitting some important > extenuating circumstances here. For one thing, it was apparently posted to > alt.sex.stories, which seems to obviate the use of "fictional" disclaimers. > Furthermore, he did _not_ identify her as a UMich student. > Well, I was quoting a small AP story in a paper notorious for clipping articles short, so I knew that some [if not many] circumstances would be missing. In conversations today at Potlatch 4 I learned of other circumstances, albeit not necessarily what I would call "extenuating" ones. And the lawyers, of course, will be spin controlling from now until a verdict. > I don't see the relevance of "if he had said the same thing in her presence". > He *didn't* ! There's an enormous difference between making a comment about > a person to third parties, and making the comment to that person. > Not necessarily -- there's lots of case law that the threatened person need not be present to be threatened. The people present are still witnesses. I agree there's a difference, but its nature isn't obvious. Precisely what that difference is is up to judges, juries and [goddess help us!] legislators. > According to the NY Times story, the woman mentioned in the story only heard > about it because reporters asked her about it ! I find a great deal of irony > in the report that the controversy started because an alt.sex.stories reader > in _Moscow_ tipped off the UMich authorities. > Irony noted and appreciated -- but it does illustrate the "public" nature of the forum. > It appears that the Russians are allowed to read erotic fiction, while the > Americans are forbidden to read it, and get tossed in jail for writing it. > We've come a long way, baby. Yeah. > > -L. Futplex McCarthy I was in high school while the Supremes [the real Supremes, with Earl Warren, not the bogus nostalgia group currently wearing the black robes] were doing the decisions that allowed Joyce and Lawrence to be sold in bookstores, and I was taught Shakespeare from a bowlderized edition of Romeo & Juliet. Trust me, we aren't in a place remotely like that now [not that there aren't plenty of people trying to get back there]. Which is not to say I'm complacent -- when I have money to spare from Green work, it goes to the ACLU. Eternal vigilance and all that. And this dude is entitled to presumption of innocence, a jury trial, and all the other paraphenalia of procedural liberty. However, given the information available to date, I see no reason to believe that he's been busted for writing "erotic fiction" rather than threatening a woman. Violence against women is too real, and in other contexts courts have held to a standard of what a "reasonable woman" might fear. BTW, does alt.sex.stories presume fiction, or is it pretend truth like the readers' sex stories in Penthouse?

3 2

law vs technology
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently there's been a great deal of discussion on this list about upcoming legislations (HR666 S314 etc.). Maybe it's time to step back a little and look at the bigger picture. I've been assuming (perhaps incorrectly) for some time that most cypherpunks hold a belief somewhat like the following: There has never been a government that didn't sooner or later try to reduce the freedom of its subjects and gain more control over them, and there probably never will be one. Therefore, instead of trying to convince our current government not to try, we'll develop the technology (e.g., remailers and ecash) that will make it impossible for the government to succeed. Efforts to influence the government (e.g., lobbying and propaganda) are important only in so far as to delay its attempted crackdown long enough for the technology to mature and come into wide use. But even if you do not believe the above is true, think about it this way: If you have a certain amount of time to spend on advancing the cause of greater personal privacy (or freedom, or cryptoanarchy, or whatever), can you do it better by using the time to learn about cryptography and develop the tools to protect privacy, or by convincing your government not to invade your privacy? I argue that since there are many more people doing the former (EFF, CPSR, etc) than latter, that you'd be more effective if you spent the time on the former. Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzvayTl0sXKgdnV5AQEBvAP+MqsGer5pg2xM6+pYG7DgCSttUyAoG8I6 Hm/atFUdRauZ1WREpi3XTXEmNgT9m+QuON5+6rnUrfkizAdjr9EPFnXxMa8am8TZ W7iQBuKb/KktbClbQyKzndeAOQ3oIOi4ahdn5eseOCWc3wX/WcjR6w9WJ6yPWoTJ 6fcglCGgo/8= =Pc1V -----END PGP SIGNATURE----- E-mail: Wei Dai <weidai(a)eskimo.com> URL: "http://www.eskimo.com/~weidai" =================== Exponential Increase of Complexity =================== --> singularity --> atoms --> macromolecules --> biological evolution --> central nervous systems --> symbolic communication --> homo sapiens --> digital computers --> internetworking --> close-coupled automation --> broadband brain-to-net connections --> artificial intelligence --> distributed consciousness --> group minds --> ? ? ?

3 2

the problem that destroyed PGP
by peace＠BIX.com 17 Dec '03

17 Dec '03

Return-path: <peace(a)BIX.com> Received: by bix.com (CoSy3.31.1.50) id <9502112132.memo.28092(a)BIX.com>; Sat, 11 Feb 1995 21:32:20 -0500 (EST) From: peace(a)BIX.com Date: Sat, 11 Feb 95 21:32:20 EST To: cyperpunks(a)toad.com Message-ID: <9502112132.memo.28092(a)BIX.com> Subject: the problem that destroyed PGP So finding a KeyID is the problem that destroys PGP eh? Well I would just take that as the problem to solve, not a reason to throw the baby out with the bath water. All we need to do is design a distributed, hashed database. Should be a piece 'o cake, right? Let's see, first of all the problem is the receiver of a message who gets just the KeyID. First of all, the trusted keys should be expected to be local (in some webby sense). But lets assume that the key is new, not in our local cache. Now my scheme would put a net of keyservers that ALL know each other. The local environment puts in a request to its usual keyserver. That is the keyserver that typically has the keys that the receiver is likely to trust. Now it is certainly possible to imagine a case where a key is not in the receiver's expected server, so what's next. Well the keyserver knows ALL the other servers, right, so just copy the original receiver's request to all the other keyservers. If that gets to be too big, just build a real net where every keyserver is at most two hops away from any other one, then the intermediate servers that could not honor the request would forward it to all the servers it knew. I purposely propose that only two steps would ever be necessary to limit the explosion, but I see that as no real limitation, the rule could even be modified if there was really any need. Hey look, the net supports archie and a host of other non-structured search mechanisms. Why create a search hierarchy where such things are not natural. Why create a naming hierarchy where such things are not natural. By the way, the dockmaster.ncsc.mil note is a good example of a naming hierarchy that has nothing to do with the employment of the person. Anyone working in the security field can get an address there. And any member can get acm.org or ieee.org. But I can post from any of there different net addresses which do not even agree at the very most basic level. So why would my KeyID be naturally associated with any one of .net, .org or .com? Peace ..Tom

5 7