December 2003 - cypherpunks-legacy

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Jim Choate wrote: > Let's look at an admittedly contrived example but I believe it will suffice. > There are two fires at opposite ends of the coverage area for a fire house. > On Saturday they receive a call to go to one end, where the wealthy live. > Would you have the owner pay prior to the firemen putting the fire out? > Would they pay some premium beforehand? Now on Sunday a fire occurs on the > other end where the poor are. Assuming they can't pay the bill would the > firemen drive away? If so, wouldn't this in fact pose a threat not only to > the other poor but also the wealthy since the fire might spread if it got > large enough. Would the wealthy then be asked to pay for that run of the > fire truck? What if they refused, how would the firemen pay for the food to > feed their family? Perhaps go out and burn down more rich houses... Contrived? Did you read the post from News of the Weird about the funeral home owners in Bankok(?) who were paying hospital employees to murder patients who were known to them and likely to use their services when they died? (Subject: Oxygen Escrow?) Sadly, no matter what sicko, bizarre scenario you wish to 'contrive' in order to illustrate a point, if your point is valid, then it is likely that you can find a real-life example that runs parallel to it.

2 1

[NOISE] Re: NYT on Netscape Crack
by Rob Vaughn 17 Dec '03

17 Dec '03

Perry sez: >I'll pay for the "I broke Netscape's Security" T-Shirt for the >enterprising person that takes the time to find them in the object >code. (See Sameer's page on the shirts he's developing as prizes for >the Netscape flaw finders.) I find it very ironic that a company that recently raised about a gadzillion dollars through a public stock offering has been able to sit back and let people find problems with their software for free. Now people like Sameer and Perry are offering rewards for it. Kudos to them, but I think Netscape should be the one making an offer like this. A textbook author/prof who taught a class using his own book had a great method for finding mistakes in the new edition: he had us buy the current edition and gave us copies of each chapter of the new edition as we got to it, then he offered a $10 reward for each typo or mistake found, and a $100 dinner for two and credit in the new edition to whomever found the most mistakes by the end of the semester. I made $160 before I had to drop the class due to a schedule conflict. In the end, he said he was able to find over 100 errors, and considered it the cheapest and most thorough proofreading he'd ever paid for. And the class got a big charge out of it. Netscape should be offering rewards for people who find problems with their software. They'll get a lot of hard work for almost free (since you only get paid if you do find something) and in a year or two they'll have one of the most solid applications on the market. Lord knows it'll help raise public confidence too. If a tee-shirt motivates people, think what $US 1000 reward would do. Or $e 2000 in credit towards goods purchased through Netscape commercial servers? Rob V.

1 0

Re: GAK patents, anyone?
by stonedog＠ns1.net-gate.com 17 Dec '03

17 Dec '03

On Tue, 9 Sep 1997, Sean Roach wrote: > At 01:34 AM 9/9/97 +0200, Anonymous wrote: > > >International terrorism as defined in 18 U.S.C. 2331 is > >"activities that > >(A) involve violent acts or acts dangerous to human life > >that are a violation of the criminal laws of the United > >States or of any State, or that would be a criminal > >violation if committed within the jurisdiction of the United > >States or of any State; (B) appear to be intended (i) to > >intimidate or coerce a civilian population; (ii) to > >influence the policy of a government by intimidation or > >coercion; or (iii) to affect the conduct of a government by > >assassination or kidnaping." I can't read this paragraph without shaking my head in awe. Even if their motives were for the best, which is certainly debateable, who here _can't_ think of a few incidents where our own government's agencies were involved in _exactly_ these sorts of activities? I realize that I'm not saying anything that hasn't been noted time and again in this forum, but I suppose I'm young enough that this sort of blatant doublespeak just blows my mind. -stonedog

1 0

Cryptography book source
by Joel McNamara 17 Dec '03

17 Dec '03

Just stumbled on to an online book vendor that advertises over a million titles available for order, many discounted from list. Very nice Web interface. A quick search for "cryptography" displayed 121 titles. A wide range, from Crypto proceedings to technical to historical. Check out: http://www.amazon.com Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you?

1 0

Crypto *import* ban?
by Brad Dolan 17 Dec '03

17 Dec '03

What exactly does a ban on import of "defense articles and services" which are not in "furtherance of world peace" mean? Could you ban crypto imports? Imports of chopped liver? ---------- Forwarded message ---------- Here is a final rule issued by ATF regarding the import of "defense articles" into the United States. It appears in the Federal Register at 60 FR 47866 (9/15/950). This becomes a regulation in the Code of Federal Regulations, Title 27 CFR, part 47, Importation of Arms. Sec. 47.52 Import restricitons applicable to certain countries. (a) It is the policy of the United States to deny licenses and other approvals with respect to defense articles and defense services originating in certain countries or areas. This policy applies to Cuba, Iran, Iraq, Libya, Mongolia, North Korea, Sudan, Syria, Vietnam, and the States that comprise the former Soviet Union [list of countries omitted]. This policy applies to countries or areas with respect to which the United States maintains an arms embargo [list of countries omitted]. It also applies when an import would not be in furtherance of world peace and the security and foreign policy of the United States. [end excerpt]

1 0

Deadly Argyles [was Miami Vice]
by jordan＠macandco.com 17 Dec '03

17 Dec '03

>>>> Here's one: http://cnn.com/US/9709/09/briefs.pm/crime.sock.reut/index.html - Jordan <<<< He should have kept them rolled in his pants where they belong! For the browser impaired: [Begin quotation] Police think sock is gun, shoot man September 9, 1997 Web posted at: 7:43 p.m. EDT (2343 GMT) MIAMI (Reuter) -- A Florida man who covered his hand with a sock to work on his car was recovering in the hospital Tuesday after being shot by police who were told he had a gun. Bobby Whipple, 27, had wrapped his hand in a dark sock while working on his car Saturday, prompting at least two people to alert police to a man wielding a gun. After receiving the reports, 14 officers surrounded Whipple and five of them, including one using a shotgun that shoots pellets, opened fire when he did not respond to calls to put his "weapon" down. A spokeswoman at Jackson Memorial Hospital said Whipple was in good condition. "Witnesses said that he had a gun and the officers assumed they were correct ... He took the position of an aggressive stance," said Pat Brickman, a spokesman for the Metro-Dade Police Department. "At this point, we don't have any indication that they acted inappropriately when faced with deadly force." The Miami Herald reported that Whipple's attorney was preparing a civil rights lawsuit against the police department over the shooting. Copyright 1997 Reuters Limited. All rights reserved.

1 0

medical records next. does it ever end?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ref: http://www.nytimes.com/yr/mo/day/news/washpol/medical-files.html and, of course, we all know that our friendLY, loyal, trustworthy, and obedient police departments can keep a secret and protect the innocent. NYT lead article today indicates Clinton bowing to LEOs to: ...gain broad access to patients' medical records, with hardly any restrictions on use or redisclosure of the data. "We recommend that providers and payers be permitted to rely on the statement of law-enforcement officials that an inquiry meets these standards," the administration says.... and we all know the police never lie when theY're fishing! The administration proposal would not require law-enforcement agencies to get court orders or to notify patients when they seek medical records. Patients would not be assured of an opportunity to challenge the disclosure of their files, though the records could later be used against them in investigations or prosecutions. fourth amendment mean _anything_ to these petty dictators? has the US become just another bananna republic at the interest of the power brokers? are we stretching the idea of a republic a bit thin? "Our recommendations accommodate the interests of law enforcement rather well," said an administration official who helped draft the proposal. "The Justice Department got almost everything it wanted." THIS is what is wrong with the US! the courts have become adversarial playgrounds for the prosecutors for the benefit of the "state" the old rule used to be if you were _charged_ by the Feds, start plea bargaining --if you go to court, the sentence will triple. just "fuck" the concept of innocent until proven guilty, or 'hey, man, you were arrested, weren't you?' Andrew Fois, an assistant attorney general, said, "There has been no documented history suggesting that law-enforcement agencies have abused their current access to medical records, or that existing federal and state law is inadequate to guard against such a danger." LIAR! I'll bet this man would lie to his own mother if it meant his courtroom body count ratio increased. What state or federal law? there is no restriction to LEO access currently; Congress is considering bills on protecting access, and the LEOs want total exemption from the rules. TIME FOR THE INTERMOUNTAIN EMPIRE TO SECEDE FROM THE UNCONSTITUTIONAL GOVERNMENT IN WASHINGTON. -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNBbEvb04kQrCC2kFAQHysAQAuRJTdS96yudsRASI2x3xVHey1N/hYYfN NCl/9FAr+TJsF+yWtSUhDLnE/1MODaIPjWomsDOla282kmrMZUQQa8CuYyw3e/xu uAwuw3bbqUfvJ13afwc7ddgusyAxbtDDxICv/ys/rFvHJCK9Ri8tKYKA6/7OZXqj L+6tueo6dI8= =ykmY -----END PGP SIGNATURE-----

3 2

netscape bug
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DF8qC9.4Cw(a)sgi.sgi.com>, "Vladimir Z. Nuri" <vznuri(a)netcom.com> writes: > P.M. notes that anywhere there is a data-driven buffer overflow (which > he suspects are all over netscape) he can get code to execute anything > he wants. this reminds me of the > Morris internet worm that ran exactly the same way. it used a > bug in the finger demon that caused a string buffer overwrite > (via strcpy, instead of strncpy) to execute customized code. > my question: I have not seen the specifics of how this works. does > this require specialized knowledge of the native machine language on the > host machine? or is it just used to cause something like a core dump > to get a command line or something like that? I question the accuracy of this. The fingerd bug was that a string in the static data area was read in with gets which could be overflowed. At some point in memory after this input buffer was the string constant that stored the name of the finger command. What the Morris work did was to overflow the input buffer and replace the string constant "finger" with "csh". When fingerd then exec'ed the command, that gave you a shell running on the machine. While it is certainly true that you can stomp on memory in static buffers, it's not clear that you can execute whatever code you insert there. If the buffer happens to be allocated off the stack (and the stack grows down) then you can modify the return address. Of course, you have to know the address of whatever code you want to execute. And that code has to do something useful. Presumably, if there are two bugs, one which lets you write over a static buffer and one for a buffer allocated from the stack, then you could execute code of your choosing. Of course, that also assumes that you can execute from the data area which is not always true. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

4 5

DH in IE and NT
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Microsoft will use Diffie-Hellman in Internet Explorer 4.0 and Windows NT. See: http://www.cylink.com/html/microsoft.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNBbQejltEBIEF0MBAQFqowf+MnienInvTNqib8YfVxKXLQMpw17yymA2 YRlXalaClmwMnE2LzMwBKqwC9wFm+FPNWIAz8q5O36+k9IEDepCVazZpyar64/En HhUZ+7F8ZGnuxvNScDBhexxUFkSAU/fuPRcqETZIMwE1kHIBGkVO/28KBF+MJ8Aj engwErZi6lFHMqiS8378/iyJ01wxRmMqI2sMTeF7Ub8kWMh7bEq24y9xF8mRVwsg DAguXZsagGapgB/pIqT/L4xP2uBIxYCKrqCJw6KtB9tsffraw9NHBzvkaZn1d7bo c2V7GF4adk6BE4oFmdjRa03o6j0nr8sKpHPlHlxo1hmslZ8fjPxTWQ== =LXf8 -----END PGP SIGNATURE-----

1 0

Anyone for testing MOSS?
by Raph Levien 17 Dec '03

17 Dec '03

I've just gotten TISMOSS 7.1 running (whew!) and wondered if there was anyone else out there who could exchange encrypted email with me. Here is my public key: alias:raph@cs.berkeley.edu public-key:MFkwCgYEVQgBAQICAgADSwAwSAJBAKQ2qG5eZDa58HpVxM9fpru2hDVVkw0iK GC3BMhagHpio7XlGydpkbY3iSV08U92VVbkyTeB2aWhSe2xUUaONPsCAwEAAQ== I guess I'll probably wait until next week to test S/MIME. Raph

1 0