December 2003 - cypherpunks-legacy

Re: Munitions shirt (again)
by Peter D. Junger 17 Dec '03

17 Dec '03

Timothy C. May writes: : At 3:49 PM 9/20/95, Ian Goldberg wrote: : >So, Dave and I got free munitions shirts (they're different, though; : >the font is smaller and they have a bunch of X'd out Constitutional : >Amendments on the back; I think they ere designed by Joel Furr) for : >our bug find. : > : >So I'm wearing it today. The thing is, I live in International House, : >a residence that has 50% non-Americans. : > : >So, any consensus as to whether it's actually illegal to do so? I : >remember some disagreement a few weeks ago that AFAIK wasn't resolved. : : The _consensus_ here seems to be: "This t-shirt is illegal to wear in front : of non-Americans," judging by the comments here. Assuming that the International Traffic in Arms Regulations are the law (rather than the unconstitutional silliness that they actually are), this consensus is correct. The ITAR forbid the ``disclosure'' of cryptographic ``software''--very broadly defined--to ``foreign'' persons ``within or without the United States.'' It says nothing about the medium of the disclosure: whether it is a T-shirt or computer screen. : The _reality_ is quite different, I think, and the "this shirt is illegal" : hype is, in my opinion, just that, hyperbole. Even hyperbull, too. : : Books and written articles containing crypto algorithms are _not_ illegal : for "furriners" to look at. The t-shirt contains at most a fuzzy printing : of an algorithm that has been widely printed in various books and in : articles in mailing lists like ours. The fact that the government does not dare to try to enforce the ITAR against those who publish cryptographic software without a license (and the fact that the Office of Defense Trade Controls has waived its jurisdiction to require a license in one case for a book where it retained jurisdiction for a CDrom with the same information) does not mean that it is not a violation of the ITAR to publicly wear a T-shirt with cryptographic software on it; although it does strongly suggest that no one will be prosecuted for such violations. And that is just as well, since the posting on an anonymous FTP server of the C program that cracks the seed for the Netscape security routines is also a technical violation of the ITAR, as even Mr. May will perhaps concede. The fact that warning the world of this security breach is a violation of the ITAR simply shows how silly--and how dangerous--is the ITAR's licensing scheme for the publication of cryptographic software. : (I agree that there are some unresolved issues with ostensibly : machine-readable forms. The t-shirt is not machine-readable by any : plausible interpretation of machine-readable.) There is nothing in the ITAR that refers to ``machine-readable'' so there is no need to interpret that term. - -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

2 1

Re: Project: a standard cell random number generator
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:50 PM 9/20/95 -0700, you wrote: > In this sense, NSA ought to be *encouraging* Intel and >IBM and Motorola to put "generate random bits" instructions into >their instruction sets... Is _that_ what was going on with Pentium division? Less seriously, thoguh, a UART might be a good place to add a random number source, since it may be able to extract randomness from communication line jitter, is usually an easily replaceable part on most machines, and communicates at a higher speed than you're likely to need for most randomness applications. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: MIME
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:24 AM 9/21/95 +0000, shields(a)tembel.org (Michael Shields) wrote: >> >I think that it must be the content-type that is causing problems, >> Yes, I agree. Make it something like ASCII text >But it's not text/plain. It's PGP'ed text/plain. The only way to >indicate this in MIME is with a content-type. (Yes, they're working on >a general way to encapsulate encryption.) Part of the problem is that application/pgp is being used both for encrypted data and also for clearsigned data, which really have different handling needs. With clearsigned, you might want to read it, but might also want to PGP it. One possibility is to do multipart messages with the body in one part and a detached signature in another. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Fraud Can Flourish Without the Internet
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The New York Times Letters Thursday, September 21, 1995 Fraud Can Flourish Without the Internet To the Editor: Your Sept. 19 front-page article on the discovery by two University of California graduate students of a flaw in Netscape, the software used for purchases over the Internet's World Wide Web, raises a number of obvious questions. First, who needs high tech to per- petrate fraud? Any unscrupulous commercial employee could use or sell your credit card number without employing technology. Every time you hand your card to a waiter in a restaurant, it disap- pears for several minutes. The de- partment store clerks and gas sta- tion attendants you deal with also have access to your card number. How secure is that? Ever give your credit card num- ber over the phone to make a purchase from a mail-order house? Or to secure a reservation at a hotel? Who's to say that the em- ployees you're speaking with are honest? Or that your phone is no tapped? Or theirs? I shop on the Internet; I may get ripped off. What's my liability? Fifty bucks -- sames as the other scenarios I've described. That's in my credit agreement with the card issuer. So why all the hoopla? Is credit card fraud significantly more preva- lent on the Internet than in other modes of purchasing? Or is the banking industry whip- ping up hysteria among purchasers to curb fraud losses? Was the work of those graduate students funded by someone -- directly or indirect- ly? If so, by whom? A banking consortium? A high-tech company working on some patentable security scheme? ROBERT HERRIG Peekskill, N.Y., Sept. 19, 1995 The writer is a systems consultant. DEADBEAT <na5877(a)anon.penet.fi> for the I.L.F. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAgUBMGFgp/FZTpBW/B35AQFiuAF/c7DUidkXEe1oBdRpsmfzkXzii44qFPQ3 YQui2lORNA8RUaWiB25poSLFNdiBMJnX =duqf -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

RE: CIA & ESPIONAGE
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Date: Thu, 31 Aug 1995 02:31:07 -0700 To: cypherpunks(a)toad.com From: Bill Stewart <stewarts(a)ix.netcom.com> Subject: Re: CIA & Espionage >> >It was said that Pres. Clinton had given a speech while >> >visiting the CIA HQ in Langley/Virginia. He allegedly >> >said in this speech that obtaining industrial >> >informations has the highest priority and this were the >> >new task for the spies. Did he really say the priority was stealing information from other people, or only protecting Big American Companies from those nasty French Spy Agency persons? (Clinton being who he is, I'd expect him to say a politically correct version of the latter, whether he means the former or not, just like his predecessor.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

adobe and microsoft products cheap, 22
by pumei＠vester.com 17 Dec '03

17 Dec '03

MICROSOFT OFFICE Pro 97 only $399.00 (Full Version) for Windows 95/NT Get the latest verion of Micosoft Office Pro 97 that includes new versions of Word 97, Excel 97, Powerpoint 97, Access 97, Outlook 97, and Bookshelf Basics for the awesome price of $399.00 !! Compare our price to your typical store price of over $650.00 !!! ------------------------------------------------------------------------------ ADOBE PHOTOSHOP 4.0 only $450.00 (Full Version) for Windows 95/NT/3.1 Professional Image Editing Adobe Photoshop 4.0 is the world standard and professionals choice in photo design and production for images used in print, multimedia, and on the web. Its packed with new creative features - and its even faster than before. Compare our price or $450.00 to your typical store price of over $600.00 !!! ------------------------------------------------------------------------------ ADOBE PAGEMAKER 6.5 only $399.00 (Full Version) for Windows 95/NT Worlds leading desktop publisher Designed for all your layout needs, Adobe pagemaker 6.5 is the best professional publishing software for printed and online pages. It smoothly integrates with Adobe Photoshop, Adobe Illustrator, and other Adobe products. Compare our price of $399.00 to your typical store price of over $600.00 !!! ------------------------------------------------------------------------------ ADOBE ILLUSTRATOR 7.0 only $299.00 (Full Version) for Windows 95/NT Vector drawing and illustration Adobe Illustrator 7.0 is the industry standard illustration software. Its speed, flexibility, accurate color, and rugged production stability make it one of the fundamental tools everyone depends on. Now this new version adds even more power plus brings it all the web for online graphics. Compare our price of $299.00 to your typical store price of over $450.00 ****************************************************************************** TO ORDER: Please call D.J. Distributors at (919) 537-9222 to order by credit cards (visa and mc only please). OUR STORE HOURS ARE M-F 10-5 EASTERN TIME. IF YOU NEED TO FAX YOUR ORDER PLEASE SEND CC#, EXPIR. DATE AND YOU NAME AS IT APPEARS ON YOUR CARD (FAX # IS: 919-537-3125). * Shipping is $7.95 for all U.S. orders and $24.00 for all others. )To=c

1 0

Re: Munitions shirt (again)
by liberty＠gate.net 17 Dec '03

17 Dec '03

Dear Cypherpunks: I sent this yesterday, but it appears toad may have eaten it. Here it is again. JMR -----BEGIN PGP SIGNED MESSAGE----- Ian Goldberg wrote: <snip> >>So, any consensus as to whether it's actually illegal to do so? I >>remember some disagreement a few weeks ago that AFAIK wasn't resolved. And Tim replied: >The _consensus_ here seems to be: "This t-shirt is illegal to wear in front >of non-Americans," judging by the comments here. And since _I_ started all this trouble with a private e-mail to Futplex; I'll now jump in saying again, [IANAL]: "This t-shirt may or may not be illegal to wear in front of non-Americans," from my reading a while back of the dense text of this silly law, [I'll spare all of you a quote of it, but there's text that MIGHT be interpreted that way.] >The _reality_ is quite different, I think, and the "this shirt is illegal" >hype is, in my opinion, just that, hyperbole. I agree with Tim that actual enforcement of this silly a law is unlikely, especially in Ian's case right now, and *especially* during our US (election) "silly season," for obvious reasons. The availability of strong encryption is unlikely to be a major issue during this election cycle, despite Cypherpunk efforts, and enforcement of this dumb law would be a "gift" to those of us who think it should be. [I hope I'm wrong here, but I think you're safe, Ian.:)] >Even hyperbull, too. I wouldn't go *that* far, though. Poorly written, ambiguous, statist<g> laws can be interpreted in any number of ways and for a variety of reasons having little (or nothing) to do with justice. <sigh> JMR <snip> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMGBvrW1lp8bpvW01AQFj1AP8C1RKpayv6V15sTBLiFLWV4tlfWRUuLfm JVWgeUeHUFxBV1EttbGv30iTmwlCJmBab/wLUag9S57DLZ6Ajed7jQe0rpra56Nl OgmM1gGU8nJJazYeqiWbYrOc/VSheSqQVLAj+vOoufW8XnU1iFkXQnRziCcyO2Nc bto4hKBrFWY= =qlSx -----END PGP SIGNATURE----- Regards, Jim Ray "People are deceived in masses, but enlightened one at a time." -- Dick Boddie. ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Prosecution of Cracking Security Systems
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:42 PM 9/20/95, Brian Davis wrote: >Certainly, Cypherpunks has gotten press lately, and what I've seen has >been good press. Capitalize on it. > >Finally, I've got to say that, as someone new to the concepts discussed >here, I found it extremely cool to read about the latest break here and >then see it in the news a day or two later. Indeed, it gives you a day's head start in preparing a prosecution! (Just kidding, of course. Brian may be a DA, but he's showing signs of being "one of us.") And on a serious note, the cracks of these various systems are helpful to the overall community. Better locks. To pick up on a point Brian made several days ago about whether or not hackers who break into systems should be applauded, criticized, prosecuted, whatever, this is how I see things, in direct parallel with the recent Netscape cracks: * Situation 1: A person who enters my home by bypassing locks cannot claim to be "just testing security" and should be prosecuted for trespass, if nothing else. * Situation 2: However, a person who publically demonstrates that a well-known type of lock is weak and can be easily bypassed is well within his rights and is, I think, doing the community a favor. I mean that he demonstrates this on a lock, or system, and not by breaking into a system. (It may be true that some number of potential thieves use the knowledge that a given lock is weak to commit crimes, but that's not the responsibility of the person demonstrating the weakness.) (Sidebar: There are some subtleties. What about someone who breaks into a computer system and leaves a harmless message announcing his intrusion? What about someone who enters my house while I'm asleep and leaves a message saying "Get better locks!"? What about Randall Schwartz and his security checks of his employer, Intel?) It seems clear to me that the breaking of Netscape's security is an example of Situation 2. And many cracker break-ins are Situation 1, though in many cases the crackers are not full-fledge criminals and may think they are just testing security. (This goes to motive, I'm sure Brian would agree, and may be why a 16-year-old cracker gets a suspended sentence instead of hard time.) (A more problematic case is what about systems with very weak or no security? This is somewhat like a yard with no clearly marked boundary, no fence, etc., or like a beach towell with valuables left on it. We've debated issues like this several times on the Cyberia list, so I won't here.) One thing that worries me is that some of the proposed laws about intellectual property and enforcment of copyrights may make it illegal to try to break the cryptographic protections of systems, even systems one has control over. (Some similarities to the "no reverse engineering" shrink-wrap licenses.) It's conceivable that Netscape Communications could, under these "anti-hacking" laws, seek a prosecution of some future Goldberg and Wagner. My guiding principles about locks and security are these: * Theft is theft, even if a bicycle is left unlocked or a house door is left ajar. * However, the first line of defense is for a property owner to lock his property up, to place fences around property, etc. Cops cannot protect in all situations, which is why security services and tools exist. * Since enforcement resources are limited, I can understand why the investigation of a theft involving unlocked, unsecured property is given low priority. This doesn't make the theft "right," and if the thief is somehow caught he cannot use the "But it was unlocked!" defense. (These problems are lessened in a system where people pay for protection, as with insurance systems, and of course as with anarcho-capitalism of the sort discussed by Benson, Friedman, and others.) --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Nuclear Hedge Funds / Social Engineering in History / Wiretap DiFi
by Sean Roach 17 Dec '03

17 Dec '03

At 09:14 PM 9/9/97 -0400, declan wrote: > ... >I'd like to ask that if anyone is planning to Nuke Washington, they >politely let me know so I can go on an extended business trip to the >Montana mountains. I mean, it's just common courtesy! ... What? And have another Juy Falkes Disaster? One of Guy Falkes co-conspirators warned a parlament member who happened to be Catholic to stay clear on the appointed day, that is how word got out. You would feel compelled to tell your closest friends. Who would, if they didn't just blab outright, tell others that they might want to leave. Ultimately, someone who dates a congressional aide will tell the aide, who having a certain loyalty to the congressperson would warn the congressperson, etc... No, it's best that you die. But at least you'll die a martyr.

1 0

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Jim Choate wrote: > Let's look at an admittedly contrived example but I believe it will suffice. > There are two fires at opposite ends of the coverage area for a fire house. > On Saturday they receive a call to go to one end, where the wealthy live. > Would you have the owner pay prior to the firemen putting the fire out? > Would they pay some premium beforehand? Now on Sunday a fire occurs on the > other end where the poor are. Assuming they can't pay the bill would the > firemen drive away? If so, wouldn't this in fact pose a threat not only to > the other poor but also the wealthy since the fire might spread if it got > large enough. Would the wealthy then be asked to pay for that run of the > fire truck? What if they refused, how would the firemen pay for the food to > feed their family? Perhaps go out and burn down more rich houses... Contrived? Did you read the post from News of the Weird about the funeral home owners in Bankok(?) who were paying hospital employees to murder patients who were known to them and likely to use their services when they died? (Subject: Oxygen Escrow?) Sadly, no matter what sicko, bizarre scenario you wish to 'contrive' in order to illustrate a point, if your point is valid, then it is likely that you can find a real-life example that runs parallel to it.

2 1