December 2003 - cypherpunks-legacy

Police and scientology visit XS4ALL Amsterdam
by Sam Kaplin 17 Dec '03

17 Dec '03

From: XS4ALL Internet Postbus 22864 1100 DJ Amsterdam tel: +31 20 6222885 fax: +31 20 6222753 PRESS RELEASE ------------- Police and members of Scientology church enter offices of XS4ALL ================================================================ Amsterdam - thuesday september 5, 1995. Today at about 14:00, XS4ALL was visited by Mr. S. Braan, bailiff. He was acting on behalf of the Religious Technology Centre, better known as the Scientology Church, or Scientology for short. He was assisted by a local police officer and Mr. Hermans from the 'Nauta-Dutilh' legal firm that represents Scientology in The Netherlands. Also present were two computer experts (Mr. Ootjes and Mr. Van Suchtelen) a locksmith (to enter had we not been present) and two American employees of Scientology, Mr. Weightman and Ms. Jenssen. Scientology is filing for seizure of XS4ALL's computer equipment. Under dutch law, this means that a bailiff comes in to record your assets. In real-life, the computer-experts that were present have recorded the types and serial numbers of all the computers in our offices. They did not take any equipment, the continuity of XS4ALL's services is not in jeopardy. What is this all about? ----------------------- The Scientology Church claims that the XS4ALL anonymous remailer was used to disseminate documents over the Internet to which the church holds the legal copyright. This has led the church to ask the president of the district court of Amsterdam to grant permission for this seizure as a prelude to legal procedures concerning damages suffered by the church. The remailer in question has been disabled more than 2 months ago. During the visit of Scientology to XS4ALL this afternoon, the remailer was not the subject of any conversation. The organisation seemed totally preoccupied with the information about Scientology that one of our users has put on his home page. Part of this information is said to be a file to which Scientology holds the copyright. If we were to delete the file in question on the spot, they were willing to drop the seizure. Responsability of Internet Providers ------------------------------------ XS4ALL categorically denies any responsability for contents of users' homepages. The users decide for themselves what is on their homepage. Since XS4ALL does not edit the homepages and has no mechanism of control over the contents we strongly feel that the users themselves are responsible for what they say on their homepage. This whole affair demonstrates the need for clarity concerning the legal postion of Internet Providers. We are shocked that our offices can be invaded bij freshly flown-in U.S. cult members. If we as Internet providers are held responsible for what our users say, that will undoubtebly kill freedom of speech on the net. Scare-tactics ------------- XS4ALL is not alone in receiving this kind of attention from Scientology. Scientology, a semi-religious multinational, is at war with a number of people on the Internet. A non-organized group of people on the net has started to openly discuss the activities of the church. Until recently, the church has always managed to supress critical voices by means of sheer intimidation and by engaging in endless legal battle. One of the people that Scientology has a problem with is 'fonss', an XS4ALL user that publishes the F.A.C.T.-net Kit on his home page (http://www.xs4all.nl/~fonss) This kit (which can be found on numerous homepages all over the Internet) consists of a large number of documents that show the true face of Scientology. One of these documents is a piece to which Scientology supposedly holds the copyright and which has been added to the kit without the church's permission. Additional information can be found on the Internet: http://www.cybercom.net/~rnewman/scientology/home.html http://www.xs4all.nl/~fonss news:alt.religion.scientology news:alt.censorship news:alt.clearing.technology

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros _________________________________________________________________ What's on CNN _________________________________________________________________ Health banner Taking the pulse of family health & fitness rule REPORT: U.S. TO PAY HOSPITALS NOT TO TRAIN DOCTORS Doctor graphic August 24, 1997 Web posted at: 10:22 a.m. EDT (1422 GMT) WASHINGTON (CNN) -- In an effort to reduce a glut of physicians in the United States, the federal government will pay training hospitals hundreds of millions of dollars not to train doctors, The Washington Post reported Sunday. The initiative, part of the new federal budget agreement, also for the first time essentially forbids hospitals from increasing the size of their residency programs, the paper reported. Medicare underwrites residency training programs heavily. Taxpayers spend $7 billion a year on the training, with each resident translating into an average subsidy of $100,000 a year.IN CONTEXT Medicare spends up to $7 billion a year on physician training programs. But with one physician for every 380 people in the United States, critics say the government is paying for more doctors than it needs. Under the new plan, Medicare will instead pay hospitals to shrink their residency programs. Hospitals that voluntarily reduce residency training programs by 20 to 25 percent over five years will get the full amount of the lost subsidies for the first two years, with payments tapering off over the next three years, the newspaper said. After five years, the payments will cease, leaving the program with fewer residents to underwrite. Administration health officials and leading Republicans say the program will save Medicare money in the long run, the Post reported. The payments are the government's first effort to constrict the pipeline of people entering the medical profession, and one of the few times the federal government has used subsidies as leverage to shrink a particular work force. New York tried program first The program mirrors an experimental program in New York endorsed by the Clinton administration earlier this year. Under the agreement between the Greater New York Hospital Association and the federal Health Care Financing Administration, which runs Medicare, New York is to receive $400 million over several years to train fewer doctors, especially in those in certain specialties. Of the state's 75 teaching hospitals, the Post reported, 42 signed up for the program -- nearly four times as many as expected. But the agreement drew fire from teaching hospitals in other areas of the country who were cutting their residency rolls voluntarily and absorbing the cost of the lost subsidies without federal assistance. Some say agreement may have been unnecessary Some government officials quoted by the Post said the glut of doctors, particularly specialists, in the United States was a growing problem, and argued that the budget agreement was a valuable cost-cutting tool. "It remains a voluntary matter of choice for these teaching hospitals. It isn't a mandate," said Ari Fleischer, a spokesman for committee chairman Rep. Bill Archer, R-Texas. Others wondered whether it was necessary. The number of doctors training to become specialists in some fields has declined dramatically despite the subsidy program, the Post article said, due to well-publicized warnings that jobs for specialists were only available in less populated areas. The United States boasts over 700,000 physicians, more per capita than any other country. rule Related story: * Welcome to washingtonpost.com + washingtonpost.com: National News Related site: Note: Pages will open in a new browser window * Health Care Financing Administration - The Medicare and Medicaid Agency External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Taking the pulse of family health & fitness rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by Hal 17 Dec '03

17 Dec '03

From: shamrock(a)netcom.com (Lucky Green) > This is unnecessary, since there is no "true" ecash. DigiCash's ecash in > its current form, the only version David Chaum is willing to licenese, is > fully traceable. Popular Cypherpunk's myths nonwithstanding. > > First, the recipient of funds is non-anonymous by design. Second, any payer > can trivialy make the recipient of a ecash note known by revealing the > blinding factor. For purposed of lawenforcement, DigiCash's ecash in no > more secure than if the (insert horseman here) billed his fees to a credit > card. This is not completely correct; there is a degree of anonymity in DigiCash's ecash. That is anonymity of how a person spends his money. Neither the bank nor the payor is in a position to learn who or where a particular piece of ecash comes from (assuming that anonymous communication means are used). This is not trivial anonymity. IMO the greatest privacy threat posed by credit cards is exactly this, the tracking of spending information and patterns. With credit card payments a great deal of information can be learned by the credit card company about what I do. With ecash almost no information is learned, only the raw amounts I spend. And if I occasionally make payments to myself even that is blurred. Ecash is not all that we might hope it could be but it is more than a myth that it allows untraceable transactions. Hal

1 0

More Energy ... Less Fat !!! (3 day trial)
by 75402529＠delphi.com 17 Dec '03

17 Dec '03

************************************** EAT THE FOODS YOU LOVE NO WILL POWER REQUIRED ************************************** Anyone who has struggled to lose weight, like I did, can tell you DIETS ALONE DON'T WORK ! That's because the difference between thin and overweight individuals has more to do with metabolic rate than what they eat. It's believed most lean individuals have a metabolism designed to BURN FAT ! We have designed a product that works several ways to help you achieve maximum results from your weight-loss program. This unique blend of herbs, botanicals and Chromium Picolinate, improves your metabolism so your body relies more on stored fat and less on stored proteins. "LOSE THE FAT.... NOT THE MUSCLE" Typically, up to 30% of lost weight is muscle. This lowers your metabolic rate and slows calorie-burning. This lowered metabolic rate makes it hard to keep lost pounds from creeping back. Result: the "Yo-Yo" syndrome in which weight is repeatedly lost and then regained. After each lose-gain cycle the portion of fat increases. To break this vicious cycle, it is important to lose only fat while maintaining, or even increasing muscle. Studies show that optimal chromium nutrition is an effective part of long-term fat-loss programs. Our unique formula of specialized herbs and botanicals is coupled with the best source of chromium available, patented Chromium Picolinate. HERE'S EVIDENCE ! Several double-blind crossover studies conducted along with clinical and laboratory tests at a leading university and hospital have proven that the ingredients in this product are effective. Without changing dietary or exercise habits, over a six-week period, subjects in separate studies lost an average of 23% body fat or approximately 4.4 lbs. of fat, and increased lean body mass by 1.5 lbs. People over the age of 46 did even better, and women seemed to do the best. People with elevated cholesterol levels averaged a 10% drop in LDL cholesterol. WHAT EXACTLY IS CHROMIUM PICOLINATE? It's a bioactive chromium with clinically proven benefits. Chromium is vital to good health and is essential for the efficient functioning of insulin. Poor responsiveness to insulin is common and is linked with increased risk of being overweight, heart disease, elevated blood fat, high blood presure and diabetes. Over 90% of American diets provide much less than the minimal amount of chromium recommended by The National Academy of Science. Most forms of chromium are not easily absorbed by the body, but chromium picolinate, being bioactive, is easily absorbed. In fact, it has been shown to reduce body fat, lower cholesterol and even reduce elevated block-sugar in diabetics. THE DIET BREAKTHRU OF THE CENTURY !! "Over the last 10 years, I have tried a variety of weight loss methods, spent thousands of dollars and failed at all of them. By December 1995, I was the heaviest I had ever weighed-235 lbs. I had no energy. My self-esteem had hit rock bottom... I was introduced to Thermo Lift and have never looked back! My energy level has boosted and my weight loss increased... In total I have lost 70 lbs. and went from a size 22 to a size 12. The most amazing part - It's So Easy!" Becky "I began using Thermo-Lift the seventh week of gymnastics training to achieve a specific result: a washboard stomach. By the end of the eighth week all I could see were solid stomach muscles! I recommend Thermo-Lift to all my muscle therapy clientele for its superior fat burnng and muscle toning abilities." Chris "I had tried everything to lose weight but nothing worked. With Thermo-Lift I was amazed at how quickly I lost weight - 4 pounds in 4 days! My energy level has sky rocketed and it's helped me curb my chocolate binges. Thanks!!" Gloria 100% SAFE AND NATURAL! THE INGREDIENTS Chromium Picolinate: Helps your body use stored fat for energy while maintaining lean muscle mass. Bee Pollen: Effective for combating fatigue, depression, and colon disorders. Siberian Ginseng: Is a good source of energy and endurance, as well as mental and physical vigor. Gota Kola: Aids in the elimination of excess fluids, fights fatigue and depression. Guarana Extract: Increases mental alertness and fights fatigue. A very high energy source. Ma Huang Extract: Helps to increase energy; controls appetite. Also includes: White Willow Bark, Bladderwrack, Reishi Mushroom, Rehmannia Root, Ginger Root, Licorice Root, and Astralagus. NUTRITIONAL BREAKTHROUGH! Now You Can Safely Shed Unwanted Fat - Without Dieting Or Strenuous Exercise! It's The Way To Firm Up Without Giving Up The Food You Love! IT'S SO EASY ! All You Do Is Take One Capsule Twice A Day! No Messy Powders! No Starvation Diets! You'll Lose Weight And Feel Great! IT REALLY WORKS! Thermo Lift Improves Your Metabolism So Your Body Burns Excess Fat! The Result Is A Leaner, Trimmer, Firmer Physique!! Order your Thermo-Lift today! One - month supply is only $29.95 ************************************************************* SPECIAL - TRIAL SIZE !!!!! ************************************************************* 3 Day Trial Size for $3.00 If you order within the next 5 days ( For trial size - include a self addressed stamped letter size envelope ) Fill out and Mail In: YES!! Please rush me a one - month supply of Thermo-Lift! Enclosed is a check/money order for $32.95 (includes $3.00 Shipping). Name:___________________________ Address:_________________________ City:____________________________ State:____________Zip:____________ Phone:__________________________ Email Address:____________________ Mail to: Dynamic Marketing Solutions Dept. DSM824 P.O. Box 79057 Houston,Texas 77279 The information contained in the report was derived from many medical, nutrional and media publications. It is not intended for medical or nutritional claims but for information and educational purposes. Please consult a health professional should the need for one be indicated. This is a NO DIET, NO WILL POWER, easy to LOSE WEIGHT!! Lose Weight, Eliminate FATIGUE, and FEEL GREAT!!!

1 0

Drastic crypto crackdown
by Anonymous 17 Dec '03

17 Dec '03

>From the New York Times cybertimes: Proposed U.S. Rules Would Slow Encryption Software Downloads By PETER WAYNER Under a proposed set of rules being circulated by the Commerce Department, the Clinton Administration is considering regulating Web servers that allow people to download encryption software. Among the sites that would be affected are those now operated by companies like Netscape, Pretty Good Privacy, and Microsoft, all of which distribute software over the Web. Under the proposed rules, access to such sites would be more tightly controlled or could disappear altogether in the future. The proposed new regulations would be modifications to the Export Administration Regulations used by the Bureau of Export Affairs in the Commerce Department to regulate the flow of encryption software from the United States. The Commerce Department took control of the regulations at the beginning of 1997 from the State Department after the software industry pushed for a more responsive bureaucracy. The version of the regulations being circulated is an interagency draft, a document designed to give other agencies, like the Federal Bureau of Investigation or the National Security Agency, the chance to comment on them. For this reason, Commerce Department refused to comment until the new rules are published in the Federal Register. The spokeswoman from the Commerce Department also refused to check the authenticity of the proposal, a copy of which was given to CyberTimes by a software industry representative. Several other industry representatives confirmed that the document was legitimate. Most of the new regulations involve tuning the details of the administration's key-recovery plan, which would allow industry to export software with a built-in back door for the police to use to gather evidence. For instance, the new regulations would require key-recovery encryption software to be injected into the message stream for law enforcement use at least every three hours. The requirement for Federal approval of a Web server, however, is buried inside the densely written, virtually impenetrable document, and the change is not even noted in the executive summary at the beginning. The new regulation would require that anyone setting up a Web server offering encryption software seek an "advisory opinion" from the Bureau of Export Affairs. The opinions carry no weight in court and only serve as an indication of the agency's view on the matter at a given moment. A company could later be prosecuted for exporting software despite receiving permission in an advisory opinion, although the existence of the opinion should offer some emotional support with the court. The purpose of the rule is to force the Web server to take all prudent steps to ensure that encryption software is not leaving the country. Currently, companies like Netscape or PGP ask anyone requesting encryption software to fill out a form certifying that they were not breaking the law. They also check the destination domain to ascertain whether the receiving computer was located within the United States. They could then deliver the software over the Web without waiting for any government action. The proposed regulations do not set out any hard and fast guidelines for a company to meet. They only suggest that sites that allow encryption downloads include an "access control system either through automated means or human intervention, (that) checks the address of every system requesting or receiving a transfer and verifies that such systems are located within the United States or Canada." When Netscape originally set out to distribute the version of its browser with high-grade encryption over the Internet, the company sought the opinion of the State Department, which gave permission in their version of an advisory opinion. But the new regulations would effectively force Netscape to shut down its Web servers until the Commerce Department could rule again -- a process that can take several months. This waiting time is what worries companies. Although Vice President Al Gore promised that the Commerce Department would reply promptly to all applications, delays have increased for companies since the beginning of the year. Those delays, in turn, stymie widespread distribution of new software. This new regulation frustrates Peter Harter, global public policy counsel at Netscape. "It seems to be inconsistent with the Vice President's 'do no harm' promise to treat commerce online the same as commerce for physical stores," Harter said. "I'm not aware of any procedure that would require retail stores such as Fry's or Egghead to apply to the Commerce Department." Netscape depends heavily on electronic distribution to provide its customers with the latest version of its products. New versions that fix bugs and plug security holes are made available on the Web as soon as possible. The regulations are ambiguous enough that they may require a company to seek separate approval for every new server it installs. Kelly Huebner Blough, director of government relations for Pretty Good Privacy, said: "When we first release a product, it's available off the Web. Then a few weeks later you can order a product in a package." The company currently sells about 15 percent of its new packages through the Web and it hopes to sell more that way, she said. Pretty Good Privacy is also in direct competition with Entrust Technologies Ltd., a Canadian encryption software company that is allowed to sell many of its Entrust products throughout the world. Canadian regulations permit export of full-strength encryption software to most parts of the world if the software is developed entirely within Canada. The company's Web server does check domain names to detect whether the software might be going to Libya, Iran, Iraq, Cuba, Angola, Syria, North Korea, France or Singapore. The software industry worries that the Administration's proposed regulations will restrict the growth of Internet commerce because encryption is a crucial tool for secure transactions. While most software companies do not include encryption technology at this time, many suggest that its use will continue to grow because encryption is the best defense against fraud on the Net. Banks, for instance, may find that the regulation is another regulatory burden to providing online banking. Stewart Baker, a former general counsel for the National Security Agency who now practices at the Washington law firm Steptoe & Johnson, said that the difficulty the regulators face is that the regulations must adapt to a quickly changing Internet environment. "They're saying 'Here's the basic standard. Show us what you're trying to do. If you're doing what we feel is a good faith effort, then we'll approve it,'" Baker said. "They don't quite say that, but I suspect that's what's going on." To draw an analogy, he compared the action to a hand check in basketball, a move by which a defensive player warns someone with a ball that they're there by touching them. Adam Shostack, a Boston-based consultant to several major banks and financial institutions, said that the current rules were already making it difficult for his clients to take care of their foreign customers. The new regulations, Shostack predicted, will just make matters worse. "We've never needed the permission of the government to publish anything in this country," Shostack said. "I don't see where their legal authority comes from. You can't make reasonable business plans when they reserve the right to change the rules in bizarre and unconstitutional ways." The rest of the proposed regulatory changes would provide clarifications to unanswered questions that others have had. For instance, source code could be shipped without restriction to Canada without a license if the new regulations are adopted. Software could also be shipped to Bulgaria, the Czech Republic, Hungary, Poland, Romania and Slovakia without support documentation.

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

> Black Unicorn posted a very interesting info summary on the > subject of foreign state US$$ forgery. > >This is a story I heard, long ago, from a Brit, Mr Waterlow, >about something that happened to his grandfather, chairman >of the Waterlow bank: > >Early in this century Portugal didn't print it's own money but >contracted this job to the Waterlow Bank in England. Some >skilled conmen succeeded in making the bank beleive they were >representatives of the Portugeese National Bank. Then they >ordered a huge amount of new bills and got away (at least >for some time) with it. Tis all in a book: "The Man Who Stole Portugal". I picked it up for about $2 in a bookstore a few months ago. Very much worth a read. An incredibly audacious escapade. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures Windsor Consulting Group | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199509052310.QAA10027(a)jobe.shell.portal.com>, hfinney(a)shell.portal.com (Hal) wrote: >This is not completely correct; there is a degree of anonymity in >DigiCash's ecash. That is anonymity of how a person spends his money. >Neither the bank nor the payor is in a position to learn who or where a >particular piece of ecash comes from (assuming that anonymous >communication means are used). So it is harder to compile dosiers on people. Big deal. The recipient can still determine who gets the goods paied for by the "anonymous" ecash by conventional means (hint: shipping address), so the payee anonymity is of little value as far as protecting the privacy of the payer (most likely the recipient of the goods) is concerened. Ecash of course is of *no* value for the various assasination markets, drug dealing, money laundring, etc that routinely get mentioned in the same paragraph as Ecash. The reason is the *full traceability* of the payee that has been deliberately built into the current version of Ecash. A "feature" that you may rest assured will be part of all future versions backed by anyone with even marginal reputation in the financial markets. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMEz/CyoZzwIn1bdtAQErdwGA3TrIYF5+O1EOQ+qdCyZRo8ePJnxmAAAl EeES8xBtWDBFwqUXTFRbj1hqLv9kwQ6K =7w8Q -----END PGP SIGNATURE-----

2 1

North American Crypto Archive status (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Michael Paul Johnson ----- >From cpunks Mon Aug 11 00:38:22 1997 Message-Id: <3.0.3.32.19970810222548.00923ad0(a)teal.csn.net> X-Sender: mpj(a)teal.csn.net X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Sun, 10 Aug 1997 22:25:48 -0600 To: coderpunks(a)toad.com From: Michael Paul Johnson <mpj(a)ebible.org> Subject: North American Crypto Archive status Sender: owner-cypherpunks(a)toad.com Precedence: bulk -- Start of PGP signed section. WHAT HAPPENED TO THE NORTH AMERICAN CRYPTO ARCHIVE? The North American Crypto Archive at http://www.sni.net/~mpj/crypto.htm is rather limited right now. I have deleted everything except the few files that I contributed to the site. This was to save money, since I suddenly lost some sponsors (who wish to remain anonymous, but I appreciate them greatly) who were paying for the costs associated with the site. I am still planning to resurrect the North American Crypto Archive, but this will likely take a while. I think that almost all of the files were successfully rescued before the site went down by at least one person. Note that much of what was there can be found by following the links at http://www.sni.net/~mpj/freecrypt.htm or by using appropriate search utilities. WHY RESURRECT THE NORTH AMERICAN CRYPTO ARCHIVE? 1. To provide a place for U. S. and Canadian citizens to freely and openly exchange cryptographic information, papers, programs, etc., without fear of government reprisals. 2. To provide a friendly central repository for cryptographic libraries, code, and papers, thus making it easy to find and use such information. 3. To provide a reasonably high bandwith connection for North Americans. 4. To exercise "freedom of the press" and press towards a constitutional EAR. HOW MUCH SPACE WILL THIS TAKE? My total archive space was at about 125 megabytes, but it had been trimmed from what I would like to have. For example, downlevel versions of software were generally deleted, and some things that are historically and cryptographically interesting were not carried. I forsee usage of around 500 megabytes or more in the near future if we can make room for it. The storage need not all be at the same site, however. HOW MUCH BANDWIDTH WOULD IT TAKE? I'd like to see at least ISDN connectivity. I've seen as many as 425 files downloaded in a day from the current archive. Again, the storage and loading need not all be at the same site. WHAT DO YOU MEAN BY NOT HAVING ALL THE STORAGE AT ONE SITE? I envision a new plan for running the archive such that one master index page (like the "export controlled" one at http://www.sni.net/~mpj/na) points to hidden directories all over the continent, wherever free space can be gleaned. The only requirements on the remote sites to maintain the "export controlled" status would be to maintain a cron job that changed the name of the hidden ftp directory containing the files on the same schedule and using the same key as used at the index site. For now, http://www.sni.net/~mpj/na can remain as the password-controlled index site. This does require a slight change to the architecture of the "export control" system in that the directory name would be a function of the current time (UTC) and a secret key, instead of being truly random like it is, now. The relative loss of security in this change is inisgnificant relative to the (obvious) weak links of the system. (Yes, I know that it can be defeated, but I also believe that the system complies with the EAR as well as most do, anyway.) The gain in this approach, of course, is that the index and ftp site need not reside on the same server, as long as the system clocks are reasonably well synchronized (within a few minutes). One other advantage of having several sites is that popular files can be placed on several different servers to lower the average traffic from any one server and to make the system more robust against failures and overloads. The archive would still have a single point of failure (at least initially) in the index site, but that could also be replicated fairly easily as long as users don't mind obtaining a separate password from each index site. WHAT REMOTE SITES DO YOU PLAN TO USE? I've had several people make inquiries or make offers, some of which sound better than others. I hope that this one open letter answers all of the questions that I got. I am looking for sites that: 1. Are *nix-based (at least for now). 2. Have some free disk space and bandwidth that can be used for this cause. 3. Have GNU C++ installed (or at least are identical to a host that I have access to that does). 4. Grant me access to a shell account and an ftp account to maintain the site. 5. Grant me access to cron so that I can have the hidden-directory renaming program run at the right schedule. 6. Are likely to be available for a reasonably long term. 7. Are in the USA or Canada and controlled by a U. S. or Canadian citizen. WHAT MAKES PEOPLE THINK THAT YOU WILL GET ALL OF THESE FREE RESOURCES? The same thing that makes me think that people will donate otherwise idle CPU resources for the fun of cracking a DES key or factoring very large numbers. HOW DOES THE "EXPORT CONTROL" SOFTWARE WORK? Ahh... here is the meat of the message that keeps it on topic for coderpunks and sci.crypt: First of all, it is important to understand the design restraints. The EAR states that mere posting of cryptographic software on the internet is not an export if guests must affirm a couple of things (see the regulations) and if there is some kind of check that the "address of the receiving computer is verified to be in the USA." Strict compliance with the latter is impossible, but if the guest's email address is in a domain not commonly used in the USA and Canada (.gov, .com, .org, .edu, .mil, .net, .us, or .ca), then I suspect the guest of lying and deny access. Naturally, this is imperfect, but it is honestly the best I could figure out how to do on a normal ISP shell account that gives me no CGI script access. This really boils down to the honor system. That is OK with me if it is OK with the U. S. Government, and the way I interpret the law, it is. Given that, here is the process: 1. http://www.sni.net/~mpj/usa is an html form that asks 3 "magic" questions to verify eligibility to legally access the strong cryptographic software, as well as the guest's email address. The 3 questions all default such that the user must change each answer to be granted access. The email address must be correct, because the user name and password are sent back via email, not as a web page. The "submit" button sends this data to cgiemail, an application that Colorado SuperNet does allow me to use. This form also invites nonqualified guests to explore most of the same data via http://www.sni.net/~mpj/freecryp.htm (links to crypto sites outside of North America). 2. When cgiemail gets the data from the above form, it simply formats the data using a template I supplied and mails it to me at mpj(a)csn.net. 3. I have an incoming mail filter that checks for any automated messages from cgiemail (which all have a rather long fixed hexadecimal number for a subject line), and processes them. If the guest answered all 3 questions properly, and the email address given doesn't "look foreign," then a form letter is filled in with a valid user name and password and mailed to the given email address. (There are some other checks, like limiting the email address to one destination, etc.) Noncompliant requests are simply discarded (since the "thank you" message from the submission form really already answered them). I thought about a courteous denial letter, but most of the bogus submissions also have bogus email addresses, so I decided not to do that. 4. If our guest can spell his or her email address right (among other things), then the email message directs him or her to http://www.sni.net/~mpj/na with a valid user name and password. 5. http://www.sni.net/~mpj/na is password protected using the security features of the Apache web server (as slightly tweaked by Colorado SuperNet). This is the index of the files in the archive, which are in a subdirectory of a hidden directory with a non-obvious name. 6. The hidden directory names are changed periodically to discourage the use or posting of a copy of the page at http://www.sni.net/~mpj/na without password protection. The idea is that by the time the cheater posted it and anyone found it, the hidden directory names would have changed again, invalidating the renegade index. The index is altered on the same schedule to the same new names by a companion program. (Right now the same program does both tasks, using a truly random number based on the arrival times and CRCs of all of my mail, but this would have to change in the new distributed archive model). IS THAT REALLY GOOD ENOUGH? I think so. It is the best export control model that I have seen that doesn't lock out U. S. and Canadian citizens in the U. S. A. and Canada. I saw a little more elaborate system on a Microsoft web site for distributing some 128-bit RC2 software, but it locked me out because it didn't like the way Colorado SuperNet registered their "whois" information. It also locked me out from work, since SSL connections can't get past our firewall. My model is much less likely to lock out a duly qualified guest, and it is much better than my old "warning message only" model that I used before crypto export regulations passed from the ITAR to the EAR. WHAT ABOUT CRYPTO SITES OUTSIDE OF NORTH AMERICA? Please keep them up, and be ready to mirror any information that might suddenly become legal to export from the USA on short notice. I say this because the EAR is being challenged in court, and it is likely that cryptographic software export regulations may be struck down. It is also likely that the U. S. Government may quickly move to replace those regulations with others in a very short amount of time after the EAR is struck down. I don't want to encourage anyone to violate currently active regulations, however. If you have a good cryptographic software site outside of North America, and it isn't on my list at http://www.sni.net/~mpj/freecrypt.htm, please let me know. WHAT IS YOUR PGP KEY? RSA key for PGP 2.6.x: ftp://ftp.csn.net/mpj/mpjkey.asc (mpjA) DH/DSS key for PGP 5.0: ftp://ftp.csn.net/mpj/mpjdhkey.asc (mpj(a)ebible.org) (Note that my RSA key uses mpj(a)csn.net for an address. That old address still works.) -- End of PGP signed section, PGP failed! ----- End of forwarded message from Michael Paul Johnson -----

1 0

Re: Scientology and police visit XS4ALL Amsterdam
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:09 9/5/95, announce wrote: [...] > Police and members of Scientology church enter offices of XS4ALL > ================================================================ I am wondering about the legalities of booby trapped computer equipment. Would it be legal if a clear warning to the fact was posted on the hardware? Interesting side note: a few months ago, several hundred 5 gallon containers of insecticide were stolen from the lot of an agricultural supply dealer here in California. The incident made a small note in the SF Chronicle. It was mentioned that the FBI is taking part in the investigation. What wasn't mentioned was that this insecticide is an ideal precursor to various forms of neuro toxins, namely Tabun and Soman, two types of nerve gas so vicious and toxic that even Hitler refused to approve their use. I predict that eventful times are just around the corner. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Emergency File Wipe Algorithim
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:47 9/5/95, Sameer R Manek wrote: >> May I also point out that the rules of economics do not apply to the >> federal government, since it insitsts - quite successfully - on having a >> monopoly on using lethal force to extract arbitrarily large amounts from >> hundreds of millions of working Americans? > >How do you figure the above? You only get to go to jail if you don't >pay taxes...then you can't pick up the soap. If aren't willing to pay your taxes, which by the way are nothing but forced labor for a large part of the year, it is unlikely that you are willing to spend the same or more forced time maufactoring license plates. If your resist that kidnapping and introduction into a slave labor camp that follows a "conviction" for not paying your taxes you will be forced to comply. If you then resist that force you will be killed. Chisel it in granite: the ultimate threat by which any government compels compliance is _always_ lethal force. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0