December 2003 - cypherpunks-legacy

AA BBS case
by moulton＠netcom.com 17 Dec '03

17 Dec '03

A few months ago there were several posts about the AA BBS case. Here is the info about the sentencing. According to an AP story, Robert and Carleen Thomas were sentenced December 2, 1994 to 37 and 30 months in prison respectively for "transmitting pornography via computer and selling obscene videotapes". The defendents will be ordered to surrender their computer equipment according to U.S. District Judge Julia Gibbons. The defendants will begin their sentences in about two months and will not allowed to remain free during appeal. The Thomases' operated the members-only Amateur Action Bulletin Board System in California. They were tried and convicted in Tennesse.

1 0

Re: using us crypto sw outside usa
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I was wondering what is the legal status for using rsaref ooutside usa. > Is it legal or not? There are three problems - getting a copy, patent, and copyright. Getting a copy of RSAREF means that somebody has to export it, which the US government strongly disapproves of. On the other hand, if you're not a US citizen, and not in the US, and your government doesn't have laws against possessing things that other governments don't want you to have, no problem. Patent - the RSA algorithm patent doesn't apply outside the US, so no problem. Copyright - Most governments do honor U.S. copyrights. Some of the early RSAREF versions said that you may not export it, so there may be copyright problems if you use them outside the US. Newer versions have a warning that the US government doesn't permit export, and recommends talking to a lawyer if this affects you, but doesn't say that you may not do so - so there isn't a problem with permission, and therefore not with copyright. That's nice, because otherwise I would have had to pay somebody outside North America to write a clone. (I had offered anybody on the net outside the US/Canada $100 to do so, but nobody took it, and I now cancel that offer because RSA doesn't forbid overseas use and copies have apparently gotten distributed.) > Also, what is the legal status of RC4 code posted to the net? Uncertain. It was protected by trade secret (not giving anybody copies unless they sign a license contract), but somebody apparently violated their contract and disclosed it anyway. Some places have laws against using information released like that, some don't, some allow the originator of the information to sue. There's also the problem of verifying whether that *really* is RC4. Bill Stewart

1 0

Info about Linux
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Joe Block, jpb(a)gate.net, sez: > I want to run linux on this beast and would like some suggestions from the > list - which of the linux CDs do you recommend? Hi, I've got Linux. Linux comes in different "distributions" - collections of files that have been integrated into a coherent system. My distribution is sold by Yggdrasil, (408) 261-6630, (800) 261-6630, for $39.95. I like it because it comes with a single boot floppy, and will run off the CDROM once it boots, so you can check it out without even having a hard disk installed. If you've got time, patience, a good, fast net connection and a whole lotta floppies, the slackware distribution (and a couple of others) are available via anonymous FTP from sunsite.unc.edu. There are also several other distributions available on CDROM from various vendors. Check the ads in the Linux Journal (subs(a)ssc.com for subscription info, (206) 527-3385, or at one of the bookstores I mention further down). If you know about computers, and are willing to put some time into mucking around fixing little petty problems, you can get a very nice system. Mine is a 33 MHz 386 (this is a little too slow for me, but works well), with 8MB of memory (sufficient, should have more), and a nice fast 2.1 GB Fast SCSI-2 Quantum Empire 2100S hard disk. I invested in the hard disk as I felt it would be a lasting value in future computers. I'm skimping on ISA bus cards for the PC as I want to get a PCI bus machine, probably a 100MHz 486, in a few months. You will be able to install Linux, the compiler, basic utilities, and the kernel sources with the disk space you have. You'll want to get more hard disk. I would recommend installing Linux a couple of times, just to see how it goes, before committing to a permanent installation. If you can't get more disk space, you can leave the Yggdrasil CDROM in your drive all the time and run the programs off the CDROM. Slower, but it works OK. I highly recommend the Linux Bible, from Yggdrasil, whatever distribution you get. Read the "How To's" on the various hardware options _before_ purchasing any new hardware. There are many supported peripherals, but I understand many of them work only marginally. For example, the UART chips generally used in PC serial ports are quite inadequate for driving an internet connection, as your machine will spend all its time servicing one-interrupt-per-character interrupts, but a serial card with a 16 character buffer that works just fine is available quite cheaply. You can FTP the bible from ftp.yggdrasil.com, but you'll want the hardcopy as it is over 1000 pages. The cover price is less than the cost of the toner cartridge you'll burn printing it. The How To's, the Linux MetaFAQ and lots of other info are on rtfm.mit.edu and sunsite.unc.edu. I've used lots of Unix systems, from System V on a 286, to Sun workstations, Vaxes, and even a Cray running Unicos, and I can say that Linux is equal to or better than any of them as far as what the OS can do, in some respects much much better. (I removed SCO ODT from my hard disk to install Linux. I might reinstall it on a second drive just to test my programs). There are still lots of glitches, but you have the source code, and access to comp.os.linux.help, where everyone else has the source code too - it beats the Hell out of Sun's technical support, IMHO. With about two thousand dollars more hardware, I would have a machine I would enjoy as much as a fifteen thousand dollar Sun, with the source code to boot ;-). One thing I highly recommend: if you or anyone you know is planning on setting up a full-time Internet connection, use a Linux box as a router, running PPP or SLIP out a modem, and ethernet on your LAN. Even a slow 386 has enough performance to service a SLIP connection at 28 kbaud, and since you have the source code to the kernel and all the internet server software, you can implement a firewall any way you like. I'm contemplating preparing my own distribution, which would be a very stripped-down Linux kernel and OS utility set, on a small number of bootable CDROMs, to allow one to install a firewall router on a small hard disk. Don't hold your breath waiting for this though. There is a security enhancement I mean to try once I've set up my own full-time router (watch for http://crawford.sc.scruznet.com, in about two weeks, maybe a month). I want to remove the ability to set the setuid bit from the kernel. Trying to set the setuid bit on a file will abort the process. Of course you can't install system software if this is done - but I could boot off a different kernel to do maintenance. This would prevent the problem of a hacker breaking in and dropping a program in my path that the hacker intends me to accidentally execute as root. There would be ways to set the bit (writing into the raw disk special file) but it would require more effort to accomplish. Crypto enthusiasts in the US and Canada can get Matt Blaze's CFS - I just got the sources, and haven't tried them out yet, but I understand there is already a Linux port. Now here's a puzzler for you. The People's Republic of China is working very hard to modernize, but still lacks capital for much hardware investment, so you see banks using 386 boxes to run an entire bank, if the bank uses a computer at all. A couple of years ago I heard that the PRC signed a deal with some big Unix vendor to supply the nation with computers and software, for many millions of dollars. Why don't they use Linux? The PRC is certainly not lacking for educated people who could do all the development they need. You can get Linux books and CDROM's from the Computer Literacy bookstore on North First Street in San Jose, and Powell's technical books in Portland Oregon. Powell's does mail order, and has a Web page which allows you to search their inventory for books. They've got lots of crypto books too, 2600 Magazine and lots of engineering books. I think the URL is http:technical.powells.portland.or.us. Development versions of Linux are available for Macintoshes and MIPS machines. If I were to use a Linux Laptop, I would put it on a Macintosh Powerbook. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Kudos
by usura＠xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks and congratulations to Todd for a job well done with the CP signing service and Raph for his excellent work with premail. An appreciative lurker/learner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuA9wioZzwIn1bdtAQFXnwGAitqcooxfEeABifXLhmxmRAQKlM90Gm6K Y2vmZi3kjSYWpDMYQNkID+HXYTeps30Q =oN3X -----END PGP SIGNATURE-----

1 0

ecash trial issues explained
by Marcel van der Peijl 17 Dec '03

17 Dec '03

(This message is not an official DigiCash message but represents my personal opinions) Here are some answers to issues recently discussed on the cypherpunks list. I do not read this list as that takes too much time, I only read what people that do read forward from the list to me. Stefan Brands is not excluded in any way from the trial. His request was never received at DigiCash. Several others in the CWI crypto group (all that applied) did receive their accounts. There is no 'political boycot'. The ecash software allows for multiple payment protocols to co-exist. Besides the currently implemented protocol and the Stefan Brands system there are more possible systems. We are not fixed in any way to the current protocol. Besides the patent issues, it is not clear which protocol is better. Last time I checked (a week ago, I am currently on the road) there well over 500 or 600 active ecash accounts. But there are another 1000 accounts waiting, and new requests coming in between 10 and 100 per day. As the mail that was sent out explains, the trial is rolled out in phases. The result is that the software is more 'robust' before large quantities of users run into the same problem, in the sense that it works on any OS in any configuration with any network hookup, no matter how 'bad'. (We are not in the business of being a 'network helpdesk'.) Potential ecash vendors have had priorities in being assigned ecash accounts. But they are also 'harrassed' for actually doing what they promise to do. Because we can not support a 24 hour staff and we want to keep response time low, people in time zones close to ours (GMT+1) have been issued accounts first. At the moment we are confident we can scale up the trial. I promise you it will not be several more months before everyone can join the trial. People that run into ecash problems are almost always helped or replied to the same day, and often within the hour. However, some people send their problems to the wrong address, such as the generic ecash info address or the feedback address, which may result in not getting an answer for several days. If mails go to ecash-bugs(a)digicash.com, the developers involved immediately see the mail and help out, provided they are technical mails and have sufficient information to actually be able to give help. As you can imagine, problems described as 'it does not work for me' without any extra information take a few mails back and forth, and tedious searching in log files, before the actual problem is clear. You can understand the anonimity of the system does not make that easier. People that compare FV or other systems and ecash are really comparing apples and pears. From a business view they may look the same, but how they operate is totally different. Ecash is the only system that allows for full anonimity on the buyers side using public key technology. We strongly believe it should not be possible for anyone to see all individual transactions a person makes. The business model used is also different. We do not charge users or shops a fee to use the ecash system, and provide the ecash software (both client and shop) for free, and give support for free. Unfortunately this does mean we are not getting large sums of money to spend on slick marketing schemes. Just a final remark before totally boring you to death: Some of the people that post unfriendly messages on mailing lists, like Stefan Brands, do so before actually mailing to us. Please give us a fair chance! Marcel van der Peijl Ecash technical project leader DigiCash bv http://www.digicash.com/

1 0

Info about Linux
by jya＠pipeline.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Responding to msg by crawford(a)scruznet.com (Michael D. Crawford) on Sat, 3 Dec 1:4 AM Thanks for this Linux info. FWIW, PC Mag's John Dvorak plugs Linux and Yggdrasil in the December 20 issue. He says, "there's no excuse not to have Linux as a primary or alternative operating system ... highly recommended, bargain of the year." - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuCI6SoZzwIn1bdtAQGzsAF/bDaj0dXzETyOkhL+qN+EfJYumWR6Oocj m4drVaoXQBnuEmQMM4UfOwcTt6tqsr/a =saEy -----END PGP SIGNATURE-----

1 0

Re: How do *I* use PGP?
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 5:30 PM 12/1/94, TheElusiveMatthew wrote: >It has been my belief that there isn't an effective way for me to use PGP, >but with all the hubbub, I thought it might be worthwhile to verify this. > >My internet access is through a personal account provided by my employer. >It is on a machine used exclusively by employees of the University of >Illinois (no student accounts). What kind of machine is it? How do you read mail? A PC mail reader? >My primary access to this account is through my IBM xt (dos 3.3) at work. >This machine is occasionally used by others and is outside of my control. >I also use many of the public access Win/Mac machines on campus. >I have no pc of my very own. The XT might be difficult because of memory issues, but there are versions of PGP for UNIX, Mac, and PC, sp..... Bob -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLuCM/OS0CjsjWS0VAQGUCAQAngYMNWJsk0ZpZfKS54JBcyND9HswtoIt 2U9a9pzDkSFxUyUYNvBRPzvaabjRtG6wBhaS/t7in7rxFCQ9TEPYha4pu6SXRXM6 XclYnCw/9zHJRCtRHMHAT0ijYvQvqPirDcQS7TzhRUfEbXAI1A6VN2X3OVGIyU14 pwZb72SgNh4= =j2U3 -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

3 2

Re: Cypherpunks@hks.net service
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> It will sign any message sent to cypherpunks(a)hks.net with its >> (currently 384 bit) key and forward the signed message to >> cypherpunks(a)toad.com. > > No offense, but what's the point? What's next, automated key-signing The point is that if Eric insists on arbitrary rules that threaten the list, some bright c'punk will "write code" to circumvent the assinine rule. Use technology to solve problems... But that is why a number of folks have posted that the rule is at best ill conceived. Eric simply hasn't listented. Thus the recent mini-flame war that again lowers the signal to noise ratio on the list. He wants the world to use encryption. So do I. But the tools are not there for even the net-heads on this list. There is nothing close to tools suitable for Joe Sixpack. Changing the rules on c'punks won't change that. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuCljioZzwIn1bdtAQEjewF+N4i7B7kdkeGyi+ggI4PjQAbQ6Uyl+45i mqbyWWGDptWY/nsZOmLmBnX8T64U1JuH =e2n2 -----END PGP SIGNATURE-----

1 0

Re: First Virtual?
by jya＠pipeline.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Responding to msg by eric(a)remailer.net (Eric Hughes) on Sat, 3 Dec 9:56 AM Not a big deal, but for Unix-fans who deign toy-PCs, PC Mag of December 20 has two brief pieces on First Virtual, indicating that its mass-market greenbucks are abuying hard pitch Xmas-adcopy. One dim-spots other "digital buck" services SpyGlass and Open Market, cash-poor things. See pp. 32 and 61. [First time use of the sig below, be gentle, still learning how to get PGP-signed message in this mailer.] - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy6rxQQAAAEEANW657bMcILCSaEYHV46DQWojtHDv6UQ2qGz+6wG5g5Q7KMz QkQjM+fYNScW4fDUYH02wLG5x/E5hYwSaYal0k0b6G9m921QKqhVYj2+QzfiMqce N45t4GjSNBdwmNywZEyz5RKXbAWm78DmAt9Ro3M8AGvG1XrsU4Sb9hQ07hCVAAUR tB1Kb2huIFlvdW5nIDxqeWFAcGlwZWxpbmUuY29tPg== =F0Xj - -----END PGP PUBLIC KEY BLOCK----- - ------------------- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuCvBioZzwIn1bdtAQGKqgGAnUpbIyAQ4aE1d0iHHZQLpj8yn2jRHruS oK8hqFI8AI07p0pMGl7kcgm1OefM/zOy =aTQt -----END PGP SIGNATURE-----

1 0

my key
by desert!desert!kafka＠consolat.xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6whatever mQCNAiz8ExIAAAEEAMCOBYWuMLd+bWGzyLIO2Nr+jQOydZ3azOVkRtsz0sgaRmep UoMcAdpfAdDp3QzyQ5yzYfw5xqcFqiTJDaSNd0vncAHpsA2gQl727B1blg4qVlDY 5mNlJUG6CVrAq11eqI0pYIfw/uNlysvt/qKIEh4lK4ShLhBaab5mNggyLQMFAAUR tB9LYWZrYSA8a2Fma2FAeHM0YWxsLmhhY2t0aWMubmw+iQCVAgUQLnyB6lnfdBSN VpE9AQGB1QQAqQcj/2Vzml1gb9QsYsfRa9cQYMIn9xlOYcABtkIFiNoVfKnPu8s+ d+RMWCzpFcLjMVVFsS54RyBYF8tQ80ffWJWITQS0MPS8ucZn/RHjht4ZYu81NpY9 V1mG98Enm9HeFNSxcid5Q7VIP17AEUMzSqG3GLMcWKrHz/fBq4UGevG0H0thZmth IDxrYWZrYUBkZXNlcnQuaGFja3RpYy5ubD6JAJUCBRAtWR9SBN4BepzgcqkBAUfx A/4opPXbFsoGg/qvqmQACKXJcVTu0SCYRJlnT10fs8k57Qpz01E7gWqLprJ74JBW Pi9hjPih2AleNVEIiATQC/VFSI1IR293lX3+1UM+ET/D8EZsRlpQqiPw1//GLxAt X8tKjgMI292jyg3rtzcJ1dvlP+9PFX/yNLrHJ39UhrfWbokAdQIFEC3JH5a/Fnjq Veer/QEB7qcC/3DcCtqXAyVVEs5mmrq/aFTgBatg68iU7tLsz1882G2y2avoZla5 WlTVXaSTZhmA9PK+4vbsxOW9TG1avwZDVTKIl7ibQL0z04WOyBYaH1PxLcbjKwUm c2P/Cb8bVO889okAVQIFEC3JH386SFmmUgayqQEBIyEB/il0p2+45H8dFIqiaTt2 1AQP7gzJFzVBeU3McoHFrJMY6IH97jWpwGUICq136kn+8Ry5anW5I4ZmWRO6nmm5 TFuJAFUCBRAttLsHlHKYXXmU9wUBAYc5Af9eXImYLf3OfwvAFXLqFh1LLA3lBqM2 j1BBYibphrCZPq99Bm29ntwm3yfMFKobsNP5tOX6t9RbULo3qMnfyvrZiQCVAgUQ LbSdrFnfdBSNVpE9AQE0awP/Yr3tJmdwBTuHYEr0Jf2YMclLXkkFT1Q1XFim1UZK rDNeJhPJE0ppHR0Qqbmr7GIsLNjU1ThCcS0RnoHA7XA5GkeIO8M+EI4EUFWcxnJq aNKWASZZ0WY4WeLEWgNkYvi2kZ853nvszzIl5mSRu7iZN+CWO3NZEsVeCCeWtkgM EEeJAJUCBRAtsmhKvmY2CDItAwUBAca7BACO6MWkKbkzGpMVXpU8YckWeejod6rw YsWP72/eFxSLj/Hm2bwXvxsrMHbli1h0Vg1qUwXoqjoGFtXsdyTRubBvYNjZWlV7 +c/iKs0nTZjXRd3WINMcxoxNj8ocg+gBgMkkC4sH7bMPFbX1C3mw22l3K7qGnndL gfdRuYe00Vr2gokAlQIFEC2nH78Hrbnp9ffk/QEBmQgD/RmiG3wvn1N6AIQgGZvW mhbStQ6S5ak6wBODMMxcvtoiAwpQ6fMZ8SNFRte33IglC54GCA6Rr1eF+dzLMJ5j PUVph5DkW/bWP/TuY7L8aZFM7M09dN01eqFCRxhNSKWI8yiF6vDigE/Po/INlJB5 JKTjx9TUuyiN/eX8ixJ0eTC+ =io0v - -----END PGP PUBLIC KEY BLOCK----- _______________________________________________________________________________ kafka(a)desert.xs4all.nl Cryptoanarchy, MDMA, Tekkkno, SL-1200 <blink> Kafka's home page _______________________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuCy7CoZzwIn1bdtAQGPVQF7BdmQzFQCE3GvRiFWRrfwB10Bwvh9XxEc tKwWorCuX8qmUd8VyajqgHLITJRqPyig =1wO5 -----END PGP SIGNATURE-----

1 0