December 2003 - cypherpunks-legacy

Re: Netscape 2.0 beta
by Raph Levien 17 Dec '03

17 Dec '03

I just got Netscape 2.0 beta for DEC Alpha. Here are my initial impressions: * Still no Java support (for DEC Alpha) :-(. * I saw no hints of S/MIME support. Did I miss something? Do the binaries for other platforms support S/MIME? I have access to HP, and will probably demand a Sun account from the powers that be here, just so I can run Java. I _really_ want to test S/MIME. * The mail reader facility looks pretty good. The smooth integration of MIME and HTML objects is really quite nice. On the other hand, there are a few UI quirks that will no doubt get ironed out over the coming months. * The .mailcap parser _still_ doesn't recognize %{variable} style entries. Thus, I wasn't able to test Michael Elkins' PGP/MIME format for compatibility with Netscape. The %{} syntax is in the spec (RFC 1524), guys. * To send mail, Netscape apparently connects to the SMTP server running on localhost. I haven't confirmed this. Thus, I don't see any way to integrate Netscape and premail :-(. Guess I'll just have to wait for Netscape script (from what I've seen so far, it's not possible in pure Java). * No user-defined headers from mail :-(. Thus, I couldn't put an "In-Reply-To: " header in this followup. * News is also not bad, but I find I can't zip through tons of low S/N newsgroups the way I can with trn. I tend to rate newsreaders in number of messages deleted per second. I think with a bit more tweaking on the UI, it could really sing. * One slick feature of news is its ability to decode binary postings, apparently in both MIME and uuencode formats. However, I wasn't able to figure out how to decode multiparts. * The UI render code has a number of cosmetic defects (possibly related to the DECness of my machine). One new one is that drag-and-drops leave the Bookmarks window in an inconsistent state, leading one to want to press ctrl-L :-). Overall, nicely done. Mozilla will clearly remain the standard in Web browsers, for the next few months anyway. Raph

1 0

Re: Netscape 2.0 beta
by schampeo＠imonics.com 17 Dec '03

17 Dec '03

Raph Levien wrote: >* To send mail, Netscape apparently connects to the SMTP server > running on localhost. I haven't confirmed this. Thus, I don't > see any way to integrate Netscape and premail :-(. Guess I'll > just have to wait for Netscape script (from what I've seen so > far, it's not possible in pure Java). You have to set this in the preferences dialog. The default is localhost, assuming that your UNIX box is set up correctly to send mail. I don't know about you guys, but my mailhost is called 'mailhost'. One thing that I found with the newsreader was that it doesn't do POP correctly. No matter what you do with your mail, it still doesn't check for read vs. unread articles. This is fine when you have a mailbox with one message. It can be annoying when you have 110 messages in your mailbox and don't want to 1) delete them or 2) download them twice. Not that I'm complaining. I'm still gigling from the introduction of frames and client-side imagemaps (which also don't work on the Solaris 2.4 version, running on Solaris 2.5beta/CDE)... Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

1 0

The Ultimate GUK[TM] (Globally Unique Key) Biotech Racket
by Nahum.Goldmann＠ARRAYdev.com 17 Dec '03

17 Dec '03

Adam Shostack writes: >... For keys to be >really global, there needs to be a mechanism in place for insuring >that key ids are very probably unique. ___________________________________________________________________ And Hal <hfinney(a)shell.portal.com> >... The fact is, we live in a world populated by >people and companies and we use names to identify them. I will grant >that there are problems with uniqueness but... ___________________________________________________________________ No problem. The ultimate way to ensure that keys are globally unique is to link them to the person's own genetic code. Fingers they might cut, but... Just imagine, in 1999+ every department store and a mall in the land will provide a service of a quick DNA scan and key mapping. Most likely they will put the small scanning machine in the shoe repair section, to substitute for the metal key cutting business. You put your hair in and -- voila! -- the thing will insert your unique key in your own smart card. For corporations they might require to keep in perpetuity a piece of a founding CEO in a cookie jar. The U.S. Government will have to unearth again poor Ulysses S. Grant, this time with a far more valid reason. Or perhaps Mr. Clinton would volunteer a donation in kind. With so much of happy progress, one might like to puke... Except, there is too much genetic material there to incriminate you far beyond the reasonable doubt. Unless, of course, you can afford Mr. Cochrane as your attorney. Being a Goldmann, the last thought really scares me. Very best to all and sundry. ___________________________________________________________________ P.S. Scott Brickner <sjb(a)universe.digex.net> said: >... Remembering >that we're talking about a world that's sufficiently changed as to >permit anonyms at all... Right on! Nahum Goldmann, ARRAY Development Inc., Ottawa, Canada Phone 613-733-0399, FAX 613-733-5691, email: Nahum.Goldmann(a)ARRAYdev.com> Homepage: http://www.ARRAYdev.com/ N. Goldmann, Online Information Hunting - the first book for the end-user!

3 2

Re: Graphic encryption
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Andrew Loewenstern <andrew_loewenstern(a)il.us.swissbank.com> > > > Is there anything particular in graphic encryption? I usually > > encrypt graphics and document images as regular files with regular > > encryption... > > I believe graphic encryption outputs a valid image file that is apparently > white noise until you perform the decryption transformation on it. An > obvious way to do this with a non-lossy file format is to encrypt pixel vales > with a stream cipher. Another way to make the image unviewable would be to > shuffle the pixels or rasters with a PRNG. > I thought it was the ideas presented in Dr Dobbs last year of encoding other information in a graphic image so that the image still looked the same, but the other information could be extracted...i.e. using the image as a covert channel. Does anyone know what they're really talking about? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: subjective names and MITM
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Scott Brickner <sjb(a)universe.digex.net> > > Patrick Horgan writes: > >Given the difficulty of finding primes, how likely do you think it is that > >given one of the well known methods and finding the first 1024 bit prime > >that pops out would give you an effective attack? > > I'm not an expert here, but I understand the "well-known methods" to > essentially use some formula that "tends" to generate prime numbers from > uniformly distributed numbers, feed it a "good" random number, and then > check to see if it's really prime. If it's not, pick another "good" > random number and try again. The entropy in the prime is the same > as in the random number generator. > Can someone give me pointers to literature on this? Books prefered. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: cypherpunks digicash bank?
by cman＠communities.com 17 Dec '03

17 Dec '03

>Douglas Barnes <cman(a)communities.com> writes on cypherpunks: >> I'm afraid you may have somewhat misunderstood the motivation behind >> the Identity Agnostic paper. In no way is it intended as a way of >> not facing the music wrt regulators in the country(s) where such an >> institution has offices. The IA approach is intended as an possible >> alternative for an institution that might otherwise license from >> Chaum. > >So it's intended for avoiding patent issues only? Yes, and not really so much because of price. I'm not the only person who has found David hard to work with -- he has apparently decided to only license "respectable" organizations that will not, in his eyes, make his technology look "bad". I can tell you from painful, expensive experience that a band of cypherpunks does not qualify as "respectable" in his eyes. Alas for David, his technology is fundamentally cypherpunk -- there is little motivation for a "respectable" institution to be the first penguin on this stuff. So, if you're a bank, licensing from David is cheap and relatively painless, but there are powerful disincentives to deployment. Also, assessing demand is problematic. For a small cypherpunk startup, the demand is obvious, there are powerful incentives, but the cost of licensing and David's reluctance to license a slightly wild-eyed startup act as a barrier. There is certainly a middle ground, but nobody seems to be stepping forward. My understanding was that we were exploring the idea of a much smaller, non-bank organization going into the digital cash business. Note that while this is theoretically interesting to me, the fact that I'm talking openly about this stuff is largely due to my decision _not_ to get personally involved in this kind of venture except as a sidelines cheerleader, or as an absolute last resort if nobody deploys. Given that we're talking about a small, cypherpunk-motivated NBFI, I think the IA stuff will work fine. It should be presented to the regulators as if it were a fully-blinded system, since there won't be any guarantee that blinding isn't occurring. You raise the issue of using software not supplied by the "bank" -- if we're talking about a c'punks project, I'd assume you'd make the full source code of the system available. The change of a client from non-blinding to blinding would be about two lines of code. You've also discussed the issue of commercial uptake -- as I see it, one of the primary goals of a project like this would be to provide incentive to deploy to the allegedly numerous Chaum licensees that have not implemented a damned thing so far. And, with a nice interface -- or at least the sort of generic GUI interface you can get with Java -- it might do surprisingly well on its own merits. Realistically, as soon as someone large comes along, you're likely to get squashed. But it would be an interesting ride, and you might just end up getting bought out instead of squashed. As for a limit on transaction size, my understanding is that Mondex is using $300 initially as a transaction limit. This certainly seems reasonable, and it skates in underneath a lot of magic numbers.

1 0

anonymous cash without blinding
by Clifford Neuman 17 Dec '03

17 Dec '03

Date: Sun, 8 Oct 1995 14:20:27 -0700 (PDT) From: Wei Dai <weidai(a)eskimo.com> Now if the bank allows this exchange of old coins for new coins to be done over an anonymous network (e.g., a remailer-net), then the system is anonymous as long as you don't move physical money in or out of the system. Maintaining anonymity when moving physical money in and out of the system is what blinding helps you to do, but this will be less useful in a fully digital economy where such movement will be infrequent. See: Gennady Medvinsky and B. Clifford Neuman. NetCash: A design for practical electronic currency on the Internet. In Proceedings of 1st the ACM Conference on Computer and Communication Security November 1993. For a discussion of the tradeoffs for this weaker form of anonymity. You can find postscript for this paper as: ftp://prospero.isi.edu/pub/papers/security/netcash-cccs93.ps

1 0

Crypto's Role in Evil?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Surely most of you know of my interest in enhancing liberty and freedom through strong crypto. (The many newcomers to the list in the wake of the Netscape news may not, but take my word for it...) And I have clearly indicated that many of the implications of strong crypto, anonymous remailers, untraceable digital money, data havens, and so on, will severely undermine many programs that some people think are useful and good. We avoid discussing these issues so as to avoid ideological flame wars, but the effects are still there. In the view of some of us, strong crypto and the swirl of ideas called "crypto anarchy" will mean that the transactions people enter into are the ones they wish to enter into. No more "affirmative action," no more transfer payments to the indigent and lazy (or to anyone else, except by personal choice), no more quotas, no more workplace rules (at least in cyberspace). Transnationalism, regulatory arbitrage, etc. (Granted, this Cyper-Millenium may not arrive by the time the real millenium arrives, and the precise form is unclear. But there is little doubt that the strong crypto most of us advocate will strongly advance the "libertarian" agenda, and will have very negative effects on "traditional liberalism" and law-based "social justice" policies. My personal view is that an ever-shrinking elite (20%, then 10%, then 2%, ...) will dominate high-value transactions, with the mass of humanity offering little or nothing worth buying. Just my view.) But Lucky Green has touched on some items I feel dutybound to comment on: At 8:19 PM 10/8/95, Lucky Green wrote: >Let me illustrate this with an example. During my visit to Dachau >Concentration Camp, I saw original lab notebooks of experiments designed >to increase the survial rate of pilots downed above the cold waters of the >North Sea. A noble cause. > >The notebooks contained pages upon pages of tables listing survial times >vs. water temperature, the data gained by dropping subjects into a tub >containing water of a defined temperature. There are places and countries which are attempting to outlaw the _use_ of these Nazi medical experiments. The implication: Nazi medical data will be one of the first sorts of information to go into Cypherpunk data havens. Maybe not put there by Lucky, maybe not even by me (though I see nothing wrong with using the data...the Jews are dead, and not using the data does not bring them back, so....). People need to at least think about what our anonymous remailers and data havens are likely to involve. Consider some entries: - results of Japanese medical research on Chinese captives in Manchuria (apparently the experiments were extensive, and American doctors gained access after the war...the experiments gave us our first lead on biological warfare, as the Japanese had exposed a lot of captives to various toxins and biological agents) - results of experiments on live subjects in Third World nations (right now it is "uneconomical" to do much of this, because of the lack of a market for the data) - data on RU-486 abortifacients and similar drugs, and at least _some_ people think abortion is murder. (I hold to the notion that a child can be killed up to the time he is christened, or given a name. This gives from several days to several weeks (or even longer, in some cultures) to decide if the newly-born organism is actually human or not. This has no crypto relevance, except to indicate that many of us hold views considered extreme to others....we're not all just "Pro Choice" in the liberal sense.) - better methods of killing people (not just the pseudo-science in the "How to Kill People" sorts of books that Loompanics and Paladin sell, but a real "information market") - "How to Make Anthrax Bacillus in Your Basement," "Nuclear Triggers," etc. In the next 10 years, expect a couple of "controversial" documents to appear on anonymous sites. In the next 10 years after that, expect an explosion of information. (I could be wrong...I'm trying not to sound optimistic about it happening too soon.) >I them saw more tables of the effects of various methods investigated to >revive hypothermia victims who were near death. One of the treatments >under investigation was dropping the patient into boiling water. Surely >this type of research falls under the category of evil. Does anyone have a URL for these results? >Ponder this, Indeed. And crypto anarchy will make this information liquid and widely available, perhaps even stimulating the production of even more such data by various means. ("Evil Hypothetical": The mostly-doomed orphaned street urchins of Calcutta, Rio de Janeiro, and Mexico City are grabbed off the street, subjected to various experiments, and the results sold on anonymous information markets....I could even make a kind of argument that since they're going to die anyone, why not get some useful data out of them. And why not subject prisoners facing execution to various experiments? Yes, both paths have problems. Doesn't mean someone won't meet market needs this way, though.) Oh, and did I mention the markets for organ transplants? Anonymous matching of recipient needs could be done, with the only real world contact being the arrangement for the patient to fly to a hospital in Burma or Singapore. The harvesting of organs from the ultra-poor? (The topic of organ-legging has been well-covered by dystopian SF, including works by Niven. Information markets add a new and intriguing dimension.) --Tim May, who will pay $35,000 for accurate mortality studies on at least 20 subjects of Iboviroxinase-D. Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Two bugs in CERN3.0 HTTPD
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: Ray Cromwell <rjc(a)clark.net> > > Suffice it to say, the CERN code is *littered* with temporary local > stack arrays, and I'm guessing that many of them have faulty bounds > checking (or none at all) > > -Ray Three cheers for C++ which let's us make types without these problems:) Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Nov. meeting: Austin, Tx
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, The next meeting of the Austin Cypherpunks will be on Nov. 7 from 6-8pm at Ted's Greek Restaraunt on Congress at 4th. near Oscar Snowden. We will be meeting in the rear. The get together yesterday was pretty well attended with 5 person as well as Strick from the California cpunks. Thanks to those who attended and hope to see more of those who didn't at the next meeting. Jim Choate CyberTects ravage(a)einstein.ssz.com

1 0