December 2003 - cypherpunks-legacy

First Payments WG Meeting Announcement
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

The World Wide Web Consortium is holding a Workshop on payments. The workshop is intended to be a small, technically oriented meeting of its payments working group. Although it is a members only event I am willing to listen to special pleading, alternatively companies may wish to join the consortium at our extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for details. -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! ANNOUNCE: First W3C Payments WG Meeting, October 11 ---------------------------------------------------------------------------- What: 1st W3C Payment WG Meeting Where: MIT EECS, Grier Room 34-401 (subject to change) When: Wednesday October 11, 9am - 5pm Who: W3C Member Representatives ONLY URL: First W3C Payments WG Meeting W3C is making progress on supporting electronic payments on the web. This WG Meeting has been called to foster discussion and feedback between W3C and its members. Discussion will focus on proposals to the W3C for payment protocols, interfaces, and e-commerce support. The agenda for the electronic payment workshop is still being settled. At the current time we have confirmed presentations by VISA, IBM, W3C, and the Financial Services Technical Consortium (FSTC). Additional invitations have been issued, and suggestions for additional presentations would be welcome. Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) with suggestions. There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. Contact Rohit Khare for details (khare(a)w3.org) To RSVP for the Payments WG Meeting, email the coordinator, Phillip Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This workshop is aimed at technologists; please include a brief description of any relevant payments work you or your organization are involved in. This is a preliminary announcement of the date and time only. We have arranged for hotel rooms at the Kendall Square Mariott. To qualify for the MIT discount, notify Susan Hardy (susan(a)w3.org) For a review of the Consortium's plans, see W3C's report on Electronic Payment Schemes and the Third W3C Security Workshop.

1 0

Re: getting netscape to support the remailers
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I started thinking about what it would take to get Netscape > to support sending mail through the remailers, after having > read the S/MIME specs which Netscape 2.0 is apparently going to > support. Perhaps with enough browbeating Netscape 3.0 will support > the remailers. Netscape doesn't need to support remailers explicitly since Netscape will be supporting Java. I think a remailer client is within Java's capabilities... Anyone disagree? andrew

4 3

[NOISE] Re: Easter Eggs
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 9/26/95 -0400, you wrote: >I also think that in Netscape their existance is an >indication that the managment at Netscape is a bit less uptight than >management at some other places. Depends on the department. They have at least one manager at Netscape with a permenent case of high blood preasure. (He happens to be in charge of the support department.) >I didn't know about the FishCam Easter Egg, but I know that Netscape >has a couple of Easter Eggs related to the activity indicator in the >top right of the display. Typically this is the Big N logo with >animated meteors, etc. flying by when the window is active. One >Easter Egg temporarily turns this into a compass which spins to >indicate activity. Another causes the animation to show a dragon >(Mozilla) breathing fire for the remainder of the session. I won't >spoil your fun by telling how to find them. If he is not running X Windows, he is going to be searching along time for the Compass easter egg. You also need X windows to find the Mozilla animated icon hack on Jammie Zawinski's page. Which easter eggs that are available is dependant on which client you are running. obNetscapeHack: There is a feature called a "cookie file" in Netscape that is ripe for exploitation as a security leak. If you are using a Netscape server (and you may not even need that), you can feed all sorts of information into it without the user's knowlege. I have heard of one page that overloads the cookie file until the machine runs out of drive space. I am sure that there are other exploitable holes there... Any takers? | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

3 2

IBE_dam
by John Young 17 Dec '03

17 Dec '03

9-26-95. W$Japer: "On-Line Service to Assist Global Trade." A group of multinational companies is expected to unveil today an on-line service to businesses to engage in international trade. Dubbed IBEX, it is a joint effort of AT&T, Dun & Bradstreet, General Electric and the U.S. Chamber of Commerce to let businesses use on-line traffic to line up suppliers, negotiate contracts, make and receive bids, and arrange the delivery of goods and services around the world. IBEX expects the backing of Chase Manhattan, Microsoft, DEC and Simon & Schuster. The IBEX software allows companies to sign on and submit a request for goods or services, which is posted anonymously. The request could be styled using an array of categories offered by the service, including location, product category, payment and shipping terms. The customer would then receive bids from businesses hoping to land the contract. Once a bid is chosen, the identities of the businesses are disclosed and negotiations begin. IBEX allows them to attach documents such as confidentiality agreements, contracts and purchase orders. IBE_dam (5 kb)

1 0

Re: Security Update news release
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFIKyx.63G(a)sgi.sgi.com>, shamrock(a)netcom.com (Lucky Green) writes: > Do the new versions use PGP's randseed.bin? If Netscape even only looks at > data used to keep PGP secure, Netscape will be banned from my computer > and every computer I am responsible for. -- For good. This is ludicrous. You couldn't compromise PGP's security even if you posted the contents of randseed.bin to the net. It's contents are carefully sanitized before it's saved to disk and before it's used. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: First Payments WG Meeting Announcement
by pays＠gctech.edelweb.fr 17 Dec '03

17 Dec '03

At 15:41 26/09/95, Phillip M. Hallam-Baker wrote: >The World Wide Web Consortium is holding a Workshop on payments. The workshop >is intended to be a small, technically oriented meeting of its payments working >group. Although it is a members only event I am willing to listen to special >pleading, alternatively companies may wish to join the consortium at our >extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for >details. > >-- >Phillip M. Hallam-Baker Not speaking for anoyone else >hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html >Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! > >ANNOUNCE: First W3C Payments WG Meeting, October 11 > >---------------------------------------------------------------------------- > >What: 1st W3C Payment WG Meeting > >Where: MIT EECS, Grier Room 34-401 (subject to change) > >When: Wednesday October 11, 9am - 5pm > All that is extremely fine and an awaited initiative BUT for one point the EXTREMELY SHORT DELAY and notification!!!!!! Our company is just in the "joining the consortium" process, especially because we were expecting such an event. However, to be able to catch a flight and spend a couple of days at MIT within less than a fortnight is another matter. I don't yet know if we will able to attend, and we really would hate to be unable to attend and participate. Thus I would urge the Web Consortium to consider postponing this meeting for at least 2 or 4 weeks so that any interested party is able to decently cancel other commitments and get prepared for the meeting. If W3C is really interested in attracting all interested party, it would be fair as I suspect we are not the only ones with Please let me know as soon as if this is possible or if I must as soon as possible try to change my agenda. regards, -- PAP _________________________________________________________________________ PAP: paul-andre.pays(a)gctech.edelWeb.fr tel: +33 1 34 52 00 88 fax: +33 1 34 52 25 26 GC Tech "The Globe Online and Globe ID Technology Company" http://www.globeonline.fr/ http://www.gctech.fr/

1 0

Netscape Stock Prices
by Jeff Simmons 17 Dec '03

17 Dec '03

Here's the history of Netscape's stock price to date, with the dates of some Cypherpunk exploits, the Wall Street Journal Articles about them, and major Netscape press releases. Date High Low Close Volume 950809 75.000 53.750 55.500 3851.8 950810 56.500 51.375 51.375 2795.9 950811 53.000 48.750 51.500 1907.4 950814 51.750 50.250 51.250 530.9 950815 55.250 51.250 54.625 1040.6 Damien's Crack - AT&T deal 950816 56.500 55.250 55.625 997.6 Developer's Partnership announced 950817 55.250 52.500 54.875 562.5 WSJ article re: Damien 950818 55.250 52.250 52.625 409.5 950821 52.750 51.000 51.000 290.0 950822 51.500 50.500 50.625 258.5 Win95 Navigator released 950823 53.500 50.500 52.000 414.2 950824 52.000 51.250 51.250 119.7 950825 52.000 51.250 51.250 89.2 950826 Brute Crack 950828 51.750 51.000 51.000 210.2 950829 51.250 46.750 48.250 1037.9 950830 48.500 46.000 46.625 319.3 950831 49.500 45.750 49.500 423.0 950901 49.500 47.750 48.750 164.4 950905 49.250 46.000 46.250 277.8 950906 49.500 47.250 48.750 351.9 950907 50.750 48.750 50.250 499.1 950908 51.000 50.000 50.250 147.6 950911 54.750 50.250 53.250 533.7 950912 54.500 51.000 52.250 211.5 950913 52.750 50.000 50.750 150.8 950914 51.250 50.250 50.250 79.9 950915 53.750 50.250 53.250 242.1 950917 Ian & Dave's Crack 950918 55.250 51.750 52.500 350.1 New Software Announced 950919 53.250 49.000 53.375 373.5 WSJ article re: Ian & Dave 950920 56.250 53.250 54.750 302.5 950921 59.125 54.250 58.750 436.9 Collabra Purchase Announced 950922 63.250 59.750 62.750 807.7 Ray's overflow bug 950925 69.000 62.250 67.000 684.0 WSJ article re: overflow bug Stock prices from MIT's stock price history server and the Wall Street Journal. Cypherpunk dates from Sameer's Hack Netscape Page (not sure when Ray posted). Press anouncement dates from Netscape's home page. Any typos or mistakes from me. -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

[More NOISE] Re: Netscape for OS/2, when? (Re: Another Netscape Bug)
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:30 AM 9/26/95 EDT, Sentiono Leowinata wrote: >I wish Netscape will port it to OS/2 (already ask them, but no comment >from Netscape). I don't try it on Netscape 1.1N as it doesn't run >reliably under Win-OS/2 (10 min -> crash! ;) According to Netscape they will *NEVER* support OS/2. (They have made the statement a number of times.) They seem to think that OS/2 will never amount to much. (They may be right...) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

RE: More on "Entropy"
by David Van Wie 17 Dec '03

17 Dec '03

David Van Wie wrote: >>The entropy E is defined by the sum across n states of -P_i log_2(P_i), Timothy C. May wrote: >Hah! Another physicist converted to the information-theoretic view of entropy! Indeed. I was able to track down the literature, and it is most interesting. I am still a little bit skeptical of the "superset including thermodynamic entropy" school of thought, but I haven't finished reading all of the materials yet! Clearly, the IT "version" of entropy is a well defined and useful thing.... >I should've pointed out in my reading list that several names stand out in >this interpretation: I'll read with that endoresement in mind. Your thoughts on rigorous, _concise_, design criteria for sources of entropy would be appreciated (unless there is good quality work in the literature I haven't come to yet). dvw

1 0

RE: `Random' seed.
by David Van Wie 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)crypto.com> wrote: >Here's my current favorite quick-and-dirty true-random-in-software generator. >Use at own risk and read the comments carefully... [...] > * Physically random numbers (very nearly uniform) > * D. P. Mitchell > * Modified by Matt Blaze 2/95 [...] > * WARNING: depending on the particular platform, truerand() output may > * be biased or correlated. In general, you can expect about 16 bits of > * "pseudo-entropy" out of each 32 bit word returned by truerand(), > * but it may not be uniformly diffused. While this comment provides some general information, it does not give the expected entropy in the form of testable assumptions. A first step in this direction is to provide the entropy series used to arrive at the 16 bit per 32 bit word estimate. The second step, as I recommended last week (RE: RNG Resource FAQ... on 9/22), is to provide a concise argument drawn directly from the mathematical weaknesses of the entropy series. In that post, I posed the following four criteria because they address the mathematical (theoretical) weaknesses of the entropy series, while using a vocabulary that should be sensible to a rigorous designer: 1) The states exist and can be identified. 2) The number of states n is known. 3) The index value i uniquely identifies a state. 4) The function P_i is known and well-behaved. In this way, an analyst can review both the entropy series itself, and a _concise_ statement of the criteria under which the series is defined (i.e. when the 4 mathematical weaknesses have been appropriately addressed), and the argument "why" has been scrutinized against the code or proposed design. dvw

1 0