December 2003 - cypherpunks-legacy

Re: responce to graphic encryption replies
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

> ... The graphic file is going to have a highly correlated > structure, long runs of white space etc. This is not the case for digital imagery. For any given band, if you sample a significant portion of the image it would not be surprising to see a more or less random distribution over the range. > The statistics for such a file > would be different than the random distribution you'd get from using the > wrong key. If you decrypt with the wrong key, do you get a random distribution? Would this be the case for all wrong keys? Would the statistics change in any discernible pattern as the keys got "closer"? > Even if the graphics format is compressed, leading to a more > even distribution, ... This may give a better result. Most compressions involve a shift to the frequency domain with a quantization of the samples. You might be able to write a detector based on this discontinuity. You could also try throwing an edge detector or some other morphological recognizer at the output. It would still be cheaper than having to a man in the loop, but you're going to spend a lot of cpu time. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

2 1

Re: applications
by Steve Bryan 17 Dec '03

17 Dec '03

At 5:50 pm 10/13/95, cYberpUnc wrote: > I know this isnt what you guys generally talk about but I was curious. >Off the top of your head do you know of any sites where I can get kracking >apps for macs? Any information would be greatly appreciated. Before looking at the address information I was going to send a one line: "Go away" reply to the question. I thought you promised to try to be less obnoxious. If you'd calm down and read the list for a while you might realize why this might not be the place to pose such questions. Why not take a look at the newsgroup alt.2600? You might find it a rather rude place to frequent and I'd certainly never send my 13 year old there (my oldest is currently 8) but I get the impression the topics you'd find there might prove more interesting than the political and/or technical discussions you'll find here. By all means enjoy yourself here but spend more time listening. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)gofast.net |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

Re: Anguilla Cypherpunks Meeting
by cman＠communities.com 17 Dec '03

17 Dec '03

[various comments about extraterritorial reach] Laws that affect the behavior of citizen-units, no matter where they go, rest on the theory of "personal jurisdiction". Note that in addition to ITAR, the various laws on money laundering, as well as the RICO statues, apply to US citizens wherever they may be. Ditto for tax laws -- one of the little gems that I learned last week was that penalties to failure to report worldwide income are going to be substantially increased. I guess they're not getting very good compliance for some reason...

1 0

Re: Netscape question transformed
by carolann＠censored.org 17 Dec '03

17 Dec '03

And some of us wish 2.0 would show images (the windoze 16 version) And I'm not even clever, and have downloaded three copies. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. > > --Jeff > >-- >Jeff Weinstein - Electronic Munitions Specialist >Netscape Communication Corporation >jsw(a)netscape.com - http://home.netscape.com/people/jsw >Any opinions expressed above are mine. > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

AP on trashing/computer fraud ring
by cman＠communities.com 17 Dec '03

17 Dec '03

Although I generally agree that capturing information online has certain advantages to the criminal over going through the trash, that certainly didn't stop this bunch. Doug [wondering if this will affect the market for home shredders] ======================= ATLANTA (AP) -- Thirty people have been charged in a $10 million fraud scheme that involved counterfeiting checks, bank statements and credit card receipts pulled out of the trash. ``What we're finding is people are getting more and more clever with what they pull out of the trash,'' U.S. Attorney Kent Alexander said. ``This is the most clever scam I've ever seen.'' The defendants, who defrauded people in 17 states, used checks, bank statements, credit card receipts and other documents from garbage bins to create counterfeit checks, false driver's licenses and false credit reports, Alexander said. Investigators said software was used to rub out information on the discarded paper. Counterfeit blank checks, printed on high-quality color printers, were allegedly used to defraud banks of $2 million. A core group of about eight people moved the operation to Atlanta from New Jersey five years ago because they thought it would be easy to take advantage of Southerners, the prosecutor said. Of the 30 people charged, 24 have pleaded guilty, Alexander said. Twelve of the 24 have been sentenced to jail terms of up to eight years and restitution of up to $218,070.

1 0

airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Roy M. Silvernail wriote: >Have you flown recently? They now ask you this scripted question about >whether you have been approached by anyone you don't know since arriving >at the airport, and warn you not to accept anything from a stranger or >leave your carry-on baggage unattended until you board the plane. The >ticket agent told me it was a "new FAA regulation". I hadn't flown >anywhere for a few years. Anyone know how long this has been happening? > Goodbye freedom, hello police state. >I wonder how long before I need a passport to cross a state line... The US is merely trying to catch up to what the Europeans have been doing for over a decade. In fact, the US still has a way to go. You ought to pass through Heathrow in London some time to see what real airport security looks like. The US security changes are a recent response, starting after the World Trade Center bombing and being stepped up on a continuing basis. Today you need a picture ID to board with your ticket. Tomorrow...? We have lived in relative safety compared to the rest of the world, but I think those days are over. Usual disclaimer. Bob Bruen.

5 4

Netscape rewards are an insult
by fc＠all.net 17 Dec '03

17 Dec '03

The idea that Netscape (like Microsoft) thinks they can get free testing services from all over the net by real experts just by offerring a tee shirt is down right offensive. I have a better idea. How about an open market in break-in software. We crack Netscape and offer the crack code to the highest bidder. Bids start at US$25K per hole. For the insult, Netscape has to outbid the competition by a factor of 2 to get the details of the hole. Here's how it works: - We get a panel of 5 cypherpunk judges who test each claimed hole. - Exploit code is sent to the panel for verification. - If they verify the hole, it is put up for bid. - Winning bidder gets the code for 3 months before it is released on hacker BBS systems throughout the world. - The panel of judges splits 25% of the money paid for the code as pay for their efforts. The rest goes to the author. I have an even better idea. How about if Netscape gets some competent programmers with real security expertise, adds in some good change controls, a serious internal testing program, quality control ala ISO-9000, internal IT auditors, external IT auditors, training and education for their employees, and everything else it takes to be in the software business in a serious way. As an alternative, we could help them contact the shareholders for a lawsuit. After all, they are a public company now and are responsible to the shareholders for the value of their stock. If it goes down because they aren't doing an adequate job of software quality control, the officers may be personally liable. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

7 8

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: > The idea that Netscape (like Microsoft) thinks they can get > free >testing services from all over the net by real experts just > by offerring >a tee shirt is down right offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors, which are piling now, on MS being a Peeping Tom when it comes to hard drives are true, I wonder if there might be a way to send a byte bomb to their bit bucket??.......

1 0

Re: Netscape question transformed
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:12 PM 10/13/95 -0700, jsw wrote: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so >> hackers have time to find bugs before the full version is released. Don't >> take me wrong I have only been on the net fer a little over a year and Love >> Netscape. And If I knew what I was Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the >company, it is virtually impossible to get complete testing coverage. >Given the incredible variety of machines, OS's, peripherals, etc. >that are available in the real world, there is no way we could >re-create every possible configuration in the lab. I think that the main reason people have problems with the testing offer on the beta is the lack of responses to bugs in the past. I have seen many complaints from people on the net complaining that bugs they had reported in .90 had continued on into new and continued versions. That if they recieved a message back from Netscape it was just an infobot, and a rather hostilly worded one at that. (The infobot has been lightened up a great deal.) Netscape has never had the staff to properly respond to the mail volume they have recieved. They have been trying to improve this but it is difficult to man such a project with people who are able to sort through the piles of dreck to find those people reporting serious problems. (Also, the bug rewards are only for "serious bugs". Who defines what is serious and what is not. I know of a couple that have been hanging around for a couple of versions now. Maybe I should test if they got fixed with 2.0b1. Probibly not. They only hit a handful of people.) Netscape is still a pretty new company. Some seem to forget that .90 was only released about a year ago. How long does it take to get a proper QC department in place? (After the shakeup in February(?) when the new President was hired, I would have thought it would have been done then. Now I am not so sure...) I know of at least one product that went out the door in recient months that was not properly tested. (The stack and dialer used with Netscape PE comes to mind.) I realize that sales sometimes forces things to be released before its time, but there has to be some basic controls for quality control. (I will not mention some of the bigger gaffes with 1.0 and 1.1 since not all of those were publicized. A few simple things could have caught them before they went out the door.) I want to see Netscape succeed, but when you hear about things like product being released on the net without warning those people responsible for supporting it, bug reports being ignored so a ship date can be made, and the like, it makes you really wonder. I am finding problems with 2.0b1 that could have been found just by using the product for a couple of days! Most of the problems I have seen with Netscape could be solved with better communications between departments within the company and some strong testing procedures. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. Somethings are real simple. Things like giving it to a handful of people and letting them use it for a couple of days before you release it to the rest of the world. 90% of the bugs will be pointed out through having someone beat on it as they would any other peice of software. And those people should be someone other than the programmers. (Sometimes you get too close to the code to really stress it properly.) I agree that you need to have a beta program. Not everything can be tested. But QC is important. This is not Uncle Jim's pet project anymore... All of this has been brought up on the net before. Sometimes it seems like the responses are more defensive than trying to find out the real problems and fix them. So far, you have been one of the few who has pushed for getting some of these things fixed in a timely manner. (I can name a few others as well. They seem to get burned out after a while though...) I think my biggest questions right now are: "Is there a formal testing procedure for product that is about to go out the door? Is there a real QC department and do they have the power to stop releases if significant problems are found?" | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

[URGENT] Where are we meeting today?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, I spaced the announcement and I can't find it in the archive. Somewhere at Sun... Would someone please forward me the original post? TIA, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH/+ACoZzwIn1bdtAQGkrgF+JqKcgWrM4VFYaQGbmR6gCg5SBzQe5Php Qv9OxqnfcFFgbs6ZzzMkf+IietdzliuI =SZst -----END PGP SIGNATURE-----

1 0