December 2003 - cypherpunks-legacy

NOT_nok
by John Young 17 Dec '03

17 Dec '03

11-7-95. W$J, Page One lead: "The 'Intranet'. Internet Software Poses Big Threat to Notes, IBM's Stake in Lotus." Hundreds of firms are achieving similar groupware linkups with simpler, cheaper systems on the World Wide Web. Dubbed "Intranets," these private networks combine text, graphics and even video to distribute news, answer employee questions, update personnel records and connect far-flung workers. The Intranets link a total of about 15 million workers. These private networks are far different from what most Internet fans see -- the public "home pages." These setups reside on company-controlled servers shielded from the public Web by a security "firewall." The Web has an "open" design that all programming developers can use in common, as opposed to the "closed" and proprietary designs of Lotus Notes, Novell's Groupwise and Microsoft's Exchange. That lets Intranets accept traffic from incompampatible computers more readily, making it easier for customers and suppliers to tap in, and for users to draw data from old mainframes and minicomputers. NOT_nok (10 kb)

1 0

Call For Papers - Conference on Redistributable Software
by John Gilmore 17 Dec '03

17 Dec '03

[I'm hoping that we can get some papers on freely redistributable *crypto* and *security* software -- like PGP or PEM or SSL_eay or Kerberos or brute-force tools or SATAN or Java tools or whatever! I'm on the program committee and am trying to make the conference as broad as possible, not just focusing on "traditional" free software. Help! --gnu] CALL FOR PAPERS First Conference on Freely Redistributable Software Sponsored by the Free Software Foundation 2-5 February 1996 Cambridge, MA Over the past 15 years, free and low-cost software has become ubiquitous. This conference will bring together implementors of several different types of freely redistributable software and publishers of such software (on various media). There will be tutorials and refereed papers, as well as keynotes by Linus Torvalds and Richard Stallman The Conference will be held at the Cambridge Center Marriott, 2-5 February 1996. Papers are invited on any aspect of GNU, Linux, NetBSD, 386BSD, FreeBSD, expect, PERL, tcl/tk, and other tools for which the code is accessible and redistributable. Extended abstracts are due on or before Thursday, 30 November 1995. Authors will be notified no later than 8 December. Full papers will be due Thursday, 4 January 1996. Program committee: Peter H. Salus, chair Robert J. Chassell Chris Demetriou John Gilmore Marshall Kirk McKusick Rich Morin Eric S. Raymond Vernor Vinge Abstracts of 350-750 words (in troff, PostScript, or straight ASCII, only) should be sent to conf96(a)gnu.ai.mit.edu -- ----------------------------------------------------------- Peter H. Salus #3303 4 Longfellow Place Boston, MA 02114 +1 617 723 3092 -----------------------------------------------------------

1 0

Re: forging headers (with more header information)
by Lee Tien 17 Dec '03

17 Dec '03

My apologies. I followed Tim's advice and turned on verbose headers, and this is what I got. Lee Return-Path: freeh(a)fbi.gov Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com (8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct 1995 13:06:23 -0700 From: freeh(a)fbi.gov Message-Id: <199510242006.NAA20123(a)well.com> Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 Date: Tue, 24 Oct 95 16:07:08 -0400 Apparently-To: tien(a)well.sf.ca.us X-UIDL: 814570964.056 > How difficult is it to forge headers? How difficult is it to trace a > message to the actual sender if the header is forged? Not very difficult at all (to forge, that is). This is a quick and dirty example that should be somewhat traceable. If you want pointers on how to trace it, post the whole thing, including headers, to cypherpunks. Louis

1 0

Sign my own certificates?
by cjs＠netcom.com 17 Dec '03

17 Dec '03

Oh jesus, I need to get myself a certificate for the netscape servers at work. All I need are three forms of identification, two written letters, an authorized signature, $300, mailed and faxed, along with an e-mail or two. I think this is an amazing pain in the ass. Any way I could sign a certificate by myself for myself and have it work with the netscape products? Just curious, Christopher

1 0

CYB_lip
by John Young 17 Dec '03

17 Dec '03

11-7-95. Washrag: "Cyber Liberation." The future of American politics is being decided in semiconductor plants in Santa Clara, in the cluttered offices of all-night software designers in Redmond, and, of course, all over the Internet. "At some point in the not-very-distant future," says Newt Gingrich, "somebody is going to have encryption you can't break.... Governments are not going to be able to stop it." This brave new world is closer than you think. It will drastically change the focus of politics because control will be extremely difficult, if not impossible. We're on the brink of a revolution that will make what the Republicans are doing this year look trivial beyond belief. The Internet has the potential to set us free -- to learn anything and do anything, whenever we want. No wonder politicians want to regulate it to death. CYB_lip (7 kb)

1 0

Re: forging headers (with more header information)
by David E. Smith 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 09:08:39 -0800, Lee Tien wrote: >Return-Path: freeh(a)fbi.gov >Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com >(8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct >1995 13:06:23 -0700 >From: freeh(a)fbi.gov >Message-Id: <199510242006.NAA20123(a)well.com> >Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP > (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 >Date: Tue, 24 Oct 95 16:07:08 -0400 >Apparently-To: tien(a)well.sf.ca.us >X-UIDL: 814570964.056 Without having any access to anything but the headers, it looks like you are an employee for SGI and sent the message from there. Look at the last Received: header. It went from sgi.com to mit.edu to well.com and then to you. Dave ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/

1 0

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Mark Murray 17 Dec '03

17 Dec '03

> > "Peter D. Junger" writes: > > : Where the hell did you get that idea? [that the ITAR applies to > > : foreigners abroad]. > > > > >From Section 120.17 of the ITAR which provides: > > > > _Export_ means: > > > > . . . . > > > > (4) Disclosing (including oral or visual disclosure) or transfering > > technical data to a foreign person, whether in the United States or > > abroad . . . . Hmm. Not only is this law unenforceable, it is unenforced. Anyone, non-US or otherwise can buy crypto books - you just can't get the code on floppy. Bruce Schneier went through this procedure when he CJ'ed "Applied Cryptography". \begin{lighter_note} The illegal bit about (for instance) the munitions T-shirt is that it has a bar code. _This_ makes it illegal for export, because not only is it machine washable, it is machine readable. \end{lighter_note} Academic exchange of mathematical knowledge has never been under scrutiny. "Technical data" will have to be interpreted to mean somethiing different, like details of the inner workings of militart encryption equipment and the like. M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

2 1

encrypt-key remailers
by Jennifer Mansfield-Jones 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello, all -- I've a semi-clueless question for the gurus here. I'm trying to use the Encrypt-Key option on some of the mixmaster (type I) cypherpunks remailers, and running into trouble. Please pardon the level of gory detail here; I'm at a loss to see what I'm missing, so I present a verbatim record of what I have tried so far. Consider the sample remailing directions below. The remailer-help documents include very similar examples. The single-space indenting is only to indicate where files are included, and avoid complaints from pgp-aware mail handlers. :: Encrypt-Key: apasswd Request-Remailing-To: cardtris(a)umich.edu Subject: reply-block-test ** The above gets encrypted with flame's public key, yielding a normal little PGP message. The block gets :: Encrypted: PGP Prepended onto it, and the result looks like: :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6.2 hIwDQyA95PVgp+UBA/4/Vm0EMi2BYBCioaLe35qx1rOxQVGEYoulmwjdDtFsXTup L08nyycNVIdxIAW5O+0T4kVuV3/ycAd84SmxDAls9n5Ebc6vP+gwE+dWCaY1TNok 1Ju08hheCJ2nC0piiN/eT0eR646fMvKGI1CiitBKXPSSkPT6alYlQvLPxd+uV6YA AACBvZthKwNEb5DQg/5otGH3njgrJISEyvgEKDZaMFuOUPzxk4IZ4NXm0v2cgHVz yxMelKz4WHnOylmZ3WWTFmngukIdasIiFf5avRZ/A4Ff1FRXf7SpxvTfGpA4pYPE yjmFhsw/NCnRVqBAH65MiU0USQhPZkZDwLe6spBaJpxENq5C =/tbc -----END PGP MESSAGE----- Trying the above, I find that it does *sort of* work as a reply block. If I append sample text and send everything to remailer(a)flame.alias.net, I get a reply back that looks like, for instance: Date: Mon, 6 Nov 1995 19:22:13 +0100 From: Anonymous <nobody(a)flame.alias.net> To: cardtris(a)umich.edu Subject: reply-block-test ** The appended text, which I expected to come back conventionally encrypted with 'apasswd', has just vanished into the void. Obviously I'm missing something... probably something that seemed painfully obvious to the writer of the remailer help file. If I omit the encryption key and '**', I can get reply blocks to work fine, even chained through multiple remailers. Suggestions? many thanks, -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Dept. of Biology Jennifer Mansfield-Jones University of Michigan cardtris(a)umich.edu http://www-personal.umich.edu/~cardtris/cardtris.htm ^---- PGP key available -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJ5ueHTZ8yRAewEFAQEewgP/U3OhcBaKSjd1Jpg51UX7NMD3SfrF56WI fQExYw1lG70GqfEko9T1ft89mDJlj1IvjToR6TJPws8P919Y2qikw333wCt6A9eR pTMf2Jy1OjKwXRIqlFtrIMky+X2jUYDSMk3H+U1IwT7jjJUfVtzPuSEia0ZzFGmi U5BLQvrLamQ= =z1yS -----END PGP SIGNATURE-----

2 1

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Mark Murray 17 Dec '03

17 Dec '03

> > Mark Murray writes: > > Hmm. Not only is this law unenforceable, it is unenforced. Anyone, > > non-US or otherwise can buy crypto books - you just can't get the code > > on floppy. Bruce Schneier went through this procedure when he CJ'ed > > "Applied Cryptography". > > To my knowledge, Bruce Schneier never CJ'ed "Applied > Cryptography". Phil Karn did that. Point is, it got CJ'ed, and easily too. In fact I understand that the process was 'trivial'. Just the software on floppy was a problem. M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

1 0

Re: Sign my own certificates?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Oh jesus, I need to get myself a certificate for the netscape servers >at work. > >All I need are three forms of identification, two written letters, an >authorized signature, $300, mailed and faxed, along with an e-mail >or two. > >I think this is an amazing pain in the ass. You forgot about the sperm sample. I wouldn't necessarily consider that pain, though... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0