December 2003 - cypherpunks-legacy

RE: Hiawatha Bray's column on key-recovery crypto
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:44 AM 9/11/97 -0400, Hiawatha Bray wrote: >What a cool idea! Why didn't I think of that? > >Hiawatha > >On Thursday, September 11, 1997 9:41 AM, Arnold G. Reinhold [SMTP:reinhold@worl > >> >> Hiawatha, I enjoyed your column (Boston Globe Business Section Sept. 11), >> but why don't you announce that you have a PGP key, print it's signature in >> a column and ask people to use it to send you news tips? This would enable >> a freedom of the press challange to GAK. Further, he could give pointers to Private Idaho, John Doe, etc., and encourage the use of anonymous tips to the newsmedia. Since I operate a cyberspace parking garage (the WinSock Remailer) and since the Lippo Administration is the most Nixonian since Tricky himself, I would think that the major media would be up-in-arms over threats to anonymous communication over the web. After all, which reporter-team doesn't want to be the next Woodward and Bernstein? I can understand (while not agreeing with...) my local rag's opposition to the second amendment, but the total apathy shown to dangers faced by the first is hard to fathom. I read the Herald pretty carefully, yet there has been NOTHING this week on the crypto-controversy. Nothing. While I often disagree with the Miami Herald's reporting decisions (both substance and emphasis) it is rare that I find it this scary. <sigh> JMR P.S. When *Seth* said, "(and wow, do they like to rant on every issue)" about Libertarians, my irony-meter broke its needle. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQEPAwUBNBh3ITUhsGSn1j2pAQF4BQfPZqEWo714dVrd0tQH+fk3jN2nzwUEtlGh wB6ggUbEJ1GX+LaGdEnWlM1xfFYvIB+ej/3PHumw7P3yIYYNt4XI480LVEEFxfWO nohAmIOe19+zt73wTZ1Oa9cNDYdOAbrMS5YW3BeyCY1i6nGkaCqXQteaoEJ4MxE1 V+jRIW9sJAdll4+ATw+xzQafl4K8uFk0soCcaupb05FeJVkLseiBxmLl1kBQwOpr 3Y6O8gO8v+ZmlaWsehlgciM47jkOpaAKNX+4b2mHx0+NrfQcfXNQWQ6JoNbx5NaO L35zof4Ds0bt+t3sIiQG7i7kR5Bbsul4vSfb6R14TtZ6Og== =HOEQ -----END PGP SIGNATURE-----

5 6

e$: Non-Repudiation
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Dr. May said: >the >"ontology" of digital money, the instruments and forms it can take, are >_impoverished_ compared to the real world. Ah... Someone's playing my song... Sorry I took so long, but I wanted to give this excellent post some serious attention, which is hard to come by when you're a person like me (praise the lord and pass the Ritalin ;-) ). >In my eight years of following digital cash work, I've been struck with how >little _economics_ enters the fray. I think you're right, Tim. More and more people are finally realizing that digital commerce *is* cryptography: cryptography as it's applied to economics on a network of microprocessors. After all, Netscape plans to make its money on servers, most important, its commerce servers, the servers that require the most cryptography. A major leader on this front, to my mind -- that is, someone who has been barking on the end of his chain ;-) the longest and loudest about all this, and who has gone out and *learned* how the clearing of transactions happens in the capital markets and elsewhere -- is Eric Hughes. Eric, who, along with Tim May, founded this group to begin with, who has worked with David Chaum, and who designed and built the first anonymous remailers. One of the reasons we don't see much of Eric around here these days is because he's out there putting some rubber to the road in his consulting business, where he's focusing on the very issue of cryptography and its applications to digital commerce, and I wish him well. That is *not* to slight others in this group who are also thinking about this stuff. Not at all. In addition, most of us are looking at other issues in cryptography, like remailers, like keeping the state out of our face, like pithing SSL, and, frankly, most of the rest of us are too busy making a living to do anything but lurk here. Cryptography is huge, and digital commerce is a small conceptual subset of the whole field, no matter how important some of us think it is. Nonetheless, the fact that both of the founders of this group are focusing on cryptographic financial objects and/or their network infrastructure speaks volumes its importance anyway. Having laid down that as covering fire ;-), let's talk about creating an ecosystem of autonomous financial objects on public networks, and why I think that Tim's post is particularly important. The reason we have the multiplicity of financial instruments out there to begin with is because there is money in creating them. But the reason there's money in it is because of the fall of the price of networked computer-based communication. The market they're traded in exists in computers. The decisions made to buy and sell them are at least facilitated by computers. The clearing and settlement of these instruments are done on computers. However, these systems are all centralized, closed, private systems. For that reason, the very accelleration of processing cost-effectiveness which created them is going to sweep them away someday. The bleeding edge of all this is the so-called 'synthetic' security, something which exists as a software manifestation of the most recent financial theory, sometimes only experimental and a few hours old, sometimes sold to an investment bank's clients just like any other security, secondary markets and all. A combination of purchases and short sales of put and call options on a particular bond, which behaves like the bond in price, for example, without having to hold the bond itself. This is usually done because the liquidity or the transaction cost of holding these instruments is lower than that of the bond. In addition, since unwinding of the synthetic security should yield the price of the bond after transaction costs, any discrepancies between the two yields an opportunity for arbitrage. Of course, in the early days, all of 10 years ago, theory held somewhat more promise than reality. The great "portfolio insurance" fiasco of the early 80's arose from the fact that the options trades which were supposed to offset the fall of the price of a security in this fashion turned out to be not very liquid after all. When the time came to unwind these positions in a hurry, they got stuck. That's not as much of a problem these days, as evidenced by the proliferation of increasingly sophisticated securities based on the same idea, which trade and settle just fine, Note that we're talking about book-entry entities here. That is, these modern securities are creatures of an environment where software "applications" reside on a particular computer on a particular local or private network, to manipulate centralized accounting entries on that computer or elsewhere, in order to reflect the expected or traded value of a security. Things that live "on" a computer. It's controlled completely from the outside, with the exception of the behavior of the market. Not "in" it, or "in" the network the computer's hooked into. Notice how different all that is from a digital certificate like Chaumian digital cash. When you get a digital certificate, you receive it through a cryptographic protocol which ensures that it is what it says it is. If the certificate is traded on-line, then the certificate's issuer vouches for it right then and there. If it is traded off-line (someday, I hope...) the certificate speaks for itself, just like a dollar bill's supposed to. As such, it can reside anywhere, not as a book-entry "on" a central computer somewhere, but "in" the network. Notice also we are backing down a level of abstraction from the status quo. A certificate is what it says it is, it is not book-entry, which is a pointer to something which is what it says it is. That's the paradox of modern book entry systems. A book entry used to just "point" to a physical certificate, which in turn points to a cash-flow or a series of cash-flows of some kind. Of course, the term "book entry" is almost exclusively used to describe clearing capital market trades without the physical exchange of certificates for other pieces of paper (receipts, checks, signature guarantees, etc.). The institutional ideal in this environment is a clearing-house wire clearing the trade in exchange for a bank wire transfer settling the trade. The book entry becomes the primary abstraction, not any certificate it is supposed to represent. The problem with book entries, of course, is the problem with any database. You have to manipulate that database, and to do that, you have to get access, and to do that you need permission... you get the point. In a capital market, that costs money, and it's costing more and more as a percentage of the revenue derived from the transaction, because to get access, you need human permission and intervention. If a human isn't supervising things, people take advantage of their access. Mr. Leeson of Barings was a classic case in point. Meanwhile, Moore's law keeps lowering the cost of the rest of the production cycle. Another problem, closer to the heart of this list, is that of anonymity. The ultimate authority to modify that particular line item or database field derives from the "owner" of that entry, since it is usually modified by someone else, "a chain of custody" is needed: audit trails, and of course, True Names are necessary somewhere, even with numbered accounts. The primary point for inventing double-entry bookeeping was so owners could control accountants, after all. When electronic book entries started replacing paper ones, the resulting economies of scale caused great centralization to occur. As I've said here before, lines were cheaper than nodes, and things got bigger and bigger. The advent of the microprocessor has been continually eating away at these large control hierarchies, and making them harder and harder to maintain. Things are getting out of control again. In an out of control environment, like that found on public uncontrolled networks like the internet, software has to be autonomous. A certificate, like a piece of digital cash, is an autonomous entity. As we said before, it is what it says it is. Because of a cryptographic protocol, you trust the thing because of the way it behaves, not because you trust the people who gave you access to it. Now, Tim is talking about another type of autonomous entity, an agent, basically, a "friendly" virus. A piece of code which is launched or launches itself on one machine, crosses a network, runs itself on another machine, and returns with a result. Our current concept of software agents implies that there's something on another machine needs to be "got", usually a database requiring access and permissions, which is why people who manage centralized repositories of information are nervous about them, just like microcomputers made their mainframe predecessors nervous. On the other hand, it's easy to see a scenario where two agents arrange to meet somewhere on a *public* network, in the presence of another "impartial" agent to exchange certificates, trading, settling and clearing all in one shot. Unsupervised. Out of control. Because the agents are engaging in a cryptographic process which "breaks" if the entities behave improperly, fraud is supposed to be prevented. Which brings me to something which goes right to the heart of one of our most cherished ideas here on cypherpunks, the idea of crypto-anarchy: with the right cryptography, agreements become uninforceable because perfect anonymity disconnects the "pointers" between digital and physical identity. Crypto-anarchy means that states don't know who to force to do what. Technology does this, it's reality, it's not optional, so we better get used to it. The catch to all of this is a curious conceptual double negative called non-repudiation. I had trouble remembering the name for a while, I kept wanting to say "plausible deniability", in the spirit of Admiral Poindexter. But I've had to remember the real name, because the idea's so damned important. Right now, the canon of commercial law for the entire free world (just so I can't be accused of quibbling here :-) ) is completely based on the concept of non-repudiation, that is, you can't repudiate an agreement, or a trade, or you or you face legal sanction. Force, in other words. Ultimately, the state can send you to jail, or worse. About a year ago, when www-buyinfo had active discussion on it, (and had not yet been turned into cyphe$rpunks by my reflexive redirection there of all the e$ cheezy-bits from cypherpunks ;-), ) I got into an interesting discussion there about non-repudiation and I didn't even know I was involved in one. We were arguing about a familiar dichotomy in the concept of digital cash, the difference between on-line and off-line protocols. I was arguing that on-line cash was better because it was a more "peer-to-peer" proposition than an online system, which required access to a network connection, and high-bandwidth processing at the certificate issuer so the issuer could participate in *every* *single* *cash* *settlement*. That invasive participation struck me as antithetical to the whole concept of a hyper-distributed geodesic economy that I thought that digital commerce was going to become. The technology which made it possible for anyone, anywhere, to sell anything digitable -- music, movies, information, teleoperator control sequences, professional services, and financial instruments -- to anyone else, while using the cheapest possible transaction protocol, that is, cash, a protocol which immediately and finally clears and settles a transaction, will win out in the end. So, I was finding myself twisting in the wind about all of this, trying to figure out how offline cash was going to have to work if double-spending was possible, how could be kept to managable levels. I found myself saying things like (forgive me), "Well, if they double-spend, put 'em in the airlo- er, throw 'em in jail!". In other words, we have the key of the double spender, even if she's anonymous, so we could use snitches, subpoenas of bank records, and plain old detective work, to send her to jail should she repudiate the agreement to not double-spend. It's hard to see how that would happen in a perfect world with perfect anonymity, much less in a world where nation-states couldn't collect income to pay for judges, courts, and LEAs. Nick Szabo was gleefully slapping me around the head and shoulders about this, and I retired from the field. So, no matter how much the idea refuses to leave my thick Frisian head, I'll leave that big, red, dog ("Hey, baby...") sleeping on the front porch for the time being. This without even *touching* the other problem with digital cash in general, Nathaniel Borenstein's favorite anti-digital-cash 2-by-4 -- which threatens *all* digital cash systems on- or off- line -- the prospect of someone *inside* a certificate issuer stealing the private key for an entire issue, and printing all the money she wants. To that I say, use multiple issues, and distribute keys, but I see that big red dog's waking up, so we'll move on... So, you can see we're talking about the alleged inability of cryptography to deal with the repudiation of digital cash trades. It cannot currently keep transactions either the way cypherpunks want, utterly anonymous, and the way I want them, off-line. In fact, at the moment, I'm very close to holding the strong form of this argument, that is, the concept of non-repudiation is the *only* reason we're being forced into true-name trades right now. It's not the long arm of the law, it's the market, which makes sense. If it was just a legal obstacle, and really contrary to market forces, it should have collapsed under a barrage regulatory arbitrage attempts. No threat of legal force would have prevented people from trying to make money issuing digital cash. The War on Some Drugs is a good example of this. If we could get digital cash trades, or trades of any kind of financial instrument for that matter, to trade on public networks without the ability to repudiate them, it probably won't matter whether they're illegal, which is interesting, to say the least, but it's no different from what happens with paper certificates. Now, as usual, all this is no brilliant insight on my part. A few days ago, I didn't know what "non-repudiation" meant. On Wednesday, I had a very interesting over-coffee conversation with Yet Another Professional Who Wants To Remain Anonymous. I must be a magnet to these people for some reason, at least until they figure out I'm not *that* useful. Or maybe because it's because I need so much help. Anyway, people who were on cypherpunks last summer remember my previous anonymous legal informant, the esteemed councellor Vinnie "The Pro" Bono, not to be confused with his second cousin, the Honorable Sonny. "Vinnie" wanted to remain anonymous because he was afraid of being deluged with requests for free legal advice, among other things. I still won't tell you who he was, but he has since "come out", and, of course, we *aren't* choking his POP server with requests to get our various relations out of the slammer, or anything else for that matter, even though he talks freely here under his True Name. I expect my new friend will figure this out soon enough. The other reason he gave is that he's so damn busy he doesn't have time to do much but lurk. Unfortunately, this guy lurks not here, but on www-buyinfo, having signed on to cypherpunks and deciding *not* to drink from a firehose, thank you very much, and since I've been spamming it lately with the aforementioned cypherpunks e$ cheezy bits, he seems to prefer it there. I have to admit myself that as much as *I* like it here, it is an acquired taste... Now, our friend Vinnie has very some serious credentials, but this new guy is just plain scary because he's so focused on the commercial law of EDI and electronic commerce. This hypercredentialed gentleman shows up on the program committee of various "suit" conferences on electronic commerce, sponsored by various international legal entities and TLAs, and seems to be up to his elbows in the Current Fantasy according to the Powers that Be, in particular, its legal armature: legal sanction, non-repudiation, True Names, and all. Which leads me to *his* moniker. I thought I was going to be civil about this, and just refer to him in the third person singular, but I had this amazing brainstorm. Remember the comedian "Professor" Edwin Corey, who died recently? His schtick was a variant on the nutty professor, obfiscatory language, lab coat, Converse high-tops and all, and he called himself the "The World's Foremost Authority". Didn't say on what, which was the point. As a philosophy major at Mizzou who really loved his informal fallacies, one of which was the Appeal to Authority, this particular example always made me laugh. So, I've dubbed this particular informant "Edwin Corey", or "Mr. Corey" in true Oxfordian fashion, not to be at all uncharitable, but because, in truth, this guy is probably the world's foremost authority on this stuff, if anyone is... He's going to give me pointers to some of this proposed "legal armature" from time to time, the first of which is a report by one Michael Baum entitled, deep breath, "Federal Certification Authority Liability and Policy: Law and Policy of Certificate-Based Public Key and Digital Signatures". This 500+ page monster can be obtained from, who else, The Feds, in particular, another big breath, the United States Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA, 22161; (703) 487-4650. The cost is $61, plus $6 for shipping and handling, plus $2 for orders sent outside the U.S., Canada or Mexico, plus rush charges if you call 1-800-553-NTIS, and if you *don't* jump up and down three times *before* you write the check or read them your credit card over the phone, the trade will be repudiated. ;-). Oh. It says something here about being able to get it through a web-site called FedWorld, http://www.fedworld.gov . So, it's very important to work on financial objects and agents. However, I should really try to concentrate on the issue of non-repudiation, because it is a necessary, and maybe (strong form) necessary and sufficient, criteria for the development of digital commerce on public networks. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Cypherpunks Press release
by Dave Del Torto 17 Dec '03

17 Dec '03

At 9:09 am 9/20/95, David J. Bianco wrote: >On Sep 20, 10:28, Dietrich J. Kappe sent the following to the NSA's mail >archives: >> Subject: Cypherpunks Press release >|| -----BEGIN PGP SIGNED MESSAGE----- >|| >|| We've seen the word "hacker" kicked around rather arbitrarily in the >press. >|| Are we to conclude that the cypherpunks are a bunch of hackers? I think >its >|| time for some cypherpunks spin. How about a logo *and* a press release? >The >|| press release would give contacts (email, phone, etc.) so that someone >on >|| this list would be contacted by journalists when a crypto story breaks. >|| >|| If we get enough volunteers, we can fax blanket every newspaper, >station, >|| and network in the world. >|| > >I think it's a great idea, personally. I think many journalists would like >to find third party opinions about network security and other cryptography >issues, but just don't know who to talk to about them. By making it easy >for them to find us, we'd be more likely to be consulted for opinions. [elided] I think a media contact group is a good idea too, but I think we should handle it by having a special address <cypherpunks-press(a)toad.com> that media people can send to to request information and that it should split the incoming mail and route it to a group of volunteers who could then respond. Question from media people are usually NOT going to be heavily tech-oriented, and this sort of press list would give the lesser cryptologists among us, who nevertheless have a significant amount of knowledge about public policy issues concerning crypto, a chance to be useful. BTW, <pgp-help-humans(a)hks.net> is still operating, and the small group of knowledgeable cypherpunks there all see the mail that comes in and cc the list when someone asks a PGP question and gets it answered by one or more of the volunteers. This would be a good model to expand on, imho. Everyone learns something, people go away impressed by the quality answers, etc. :) dave

2 1

Re: in defense of Lon Horiuchi
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/11/97 12:16 PM, Zooko Journeyman (zooko(a)xs4all.nl) passed this wisdom: >Lest any naive readers who aren't familiar with the details of >the event buy this kind of spin-doctoring, please be aware that >the woman in question was probably not visible to the sniper, >and it is almost certain that he was aiming at her armed >husband who was shooting back. The bullet travelled through a >door or some such obstruction I think (I forget the details) >before hitting the victim. >You could more reasonably blame the husband for having the >stupidity or carelessness to get in a firefight with his wife >and child in the building. This doesn't sound like any accounts I have read of what happened at Ruby Ridge ... Zooko I think you are the one off base here. Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Lord, what fools these mortals be!" -- Puck, A Midsummer Night's Dream

1 0

Let sleeping dogs lay
by Tim May 17 Dec '03

17 Dec '03

"Nothing good can come out of crypto legislation." --said by several of us over the past year The big mistake was ever introducing the SAFE and Pro-CODE bills, as it brought the NSA and FBI out of their warrens and into the warrens of Congress. Without any crypto bills at all, it is possible (though by no means certain) that no legislation at all would have been introduced this year. But once SAFE and Pro-CODE were out there, on the table, the forces in favor of a surveillance state began their lobbying in earnest, giving the infamous "if you only knew what we knew" scare tactic pitches. Last minute amendments and even complete bill replacements are easier to slip in than a Big Brother bill from the gitgo. Sure enough, the tide is now moving swiftly toward a future far, far, far worse than the mere annoyance of export controls. Several committees are now competing to see which can "protect us" from the Four Horsemen the best. The archives say this many times. For a change, and to forestall criticism, I'll find a quote from someone other than me. For example, Mike Duvos said this, last June, 1997-06-19: "You really can't fight Congress. Ten minutes after you defeat a bill and spend all your resources, it will be back on the floor under another name and the whole thing will start over again. After you defeat that one, you will discover that the text of the measure got passed late one night as an ammendment to something completely unrelated. "The government has infinite resources to harp incessantly on anything until they engineer consent for it and get what they want. Resistance is Futile. You will be Assimilated." Recall that several of us were involved in a serious battle with Rotenberg over the basic wisdom of the CDT and EPIC types pushing for export legislation, with (even then) unacceptable language about "use a cipher, go to prison." The current language is of course a full-blown disaster. Pandora's box was opened by SAFE and Pro-CODE. And so here we are. Multiple committees in both houses jockeying to see who can clamp down the hardest on crypto. CDT, EPIC, and all the other Beltway insiders ought to think about this mess. Sometimes it's better just to let sleeping dogs lay. Or lie. Or whatever. Time to just pull out of D.C. It is corruption on Earth. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: in defense of Lon Horiuchi
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/11/97 3:43 PM, Chip Mefford (cmefford(a)avwashington.com) passed this wisdom: >Even dumb ole me, who ain't no crack shot, with one of those nifty >(off theshelf) Styer-Mannlicher countersniper rifles with the neato >Zeiss autoranging scope was able to punch a coke can 5 for 5 after >one ranging(cheater) shot at 600 meters. I'm told that the FBI has >much nicer rifles than that. And I ain't trained. > >(couldn't hit the Mountain Dew can, couldn't see it) Horiuchi shot Mrs Weaver at slightly over 200 meters .... not much o of a chnace he didn't hit what he was aiming at ... which begs the question of *wha* was he aiming at? The rules of engagement promulgated by Louis Freehs buddy Potts (I think) were nothing more than a death warrant and I have heard that most of the FBI marksmen balked at them ... but not good ole 'doin what I'm told to do' Lon ... yeah right! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNBiGFcdZgC62U/gIEQJyPgCgu0oNx/mVZ9fjtI6d7AYfXAT4nfcAoLX3 0nQZslJNDD1x8EG+YfCeqY9x =Rqj8 -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Do not go where the path may lead, go instead where there is no path, and leave a trail" - Ralph Waldo Emerson

1 0

Re: Another Netscape Bug (and possible security hole)
by Peter Trei 17 Dec '03

17 Dec '03

> Received: from relay3.UU.NET [192.48.96.8] by alcor.process.com > with SMTP-OpenVMS via TCP/IP; Fri, 22 Sep 1995 03:36 -0400 > Received: from toad.com by relay3.UU.NET with SMTP > id QQzigj22616; Fri, 22 Sep 1995 03:27:16 -0400 > Received: by toad.com id AA02740; Fri, 22 Sep 95 00:24:28 PDT > Received: from quilla.tezcat.com by toad.com id AA02734; Fri, 22 Sep 95 00:24:24 PDT > Received: from [206.1.161.4] (clubred.redweb.com [206.1.161.4]) by quilla.tezcat.com (8.6.12/8.6.12) with SMTP id CAA23469 for <cypherpunks(a)toad.com>; Fri, 22 Sep 1995 02:24:21 -0500 > X-Sender: goedel(a)204.128.247.5 > Message-Id: <v01510100ac8821ac2b23(a)[206.1.161.4]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 22 Sep 1995 02:25:21 -0600 > To: cypherpunks(a)toad.com (Cypherpunks Mailing List) > From: goedel(a)tezcat.com (Dietrich J. Kappe) > Subject: Re: Another Netscape Bug (and possible security hole) > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > -----BEGIN PGP SIGNED MESSAGE----- > > >Ray Cromwell writes: > >> I've found a Netscape bug which I suspect is a buffer overflow and > >> may have the potential for serious damage. If it is an overflow bug, > >> then it may be possible to infect every computer which accesses a web > >> page with Netscape. To see the bug, create an html file containing > >> the following: > > > >Oh brother, this is unbelievable ! > > > >I'm using Netscape 1.1N under SunOS 4.1.2. I can crash Netscape 1.1N under NT by entering a URL with a very long domain name in the 'Location:' window. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: in defense of Lon Horiuchi (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: in defense of Lon Horiuchi > Date: Thu, 11 Sep 97 20:07:27 -0400 > >Even dumb ole me, who ain't no crack shot, with one of those nifty > >(off theshelf) Styer-Mannlicher countersniper rifles with the neato > >Zeiss autoranging scope was able to punch a coke can 5 for 5 after > >one ranging(cheater) shot at 600 meters. I'm told that the FBI has > >much nicer rifles than that. And I ain't trained. > > > >(couldn't hit the Mountain Dew can, couldn't see it) > > Horiuchi shot Mrs Weaver at slightly over 200 meters .... not much o > of a chnace he didn't hit what he was aiming at ... which begs the > question of *wha* was he aiming at? The rules of engagement > promulgated by Louis Freehs buddy Potts (I think) were nothing more > than a death warrant and I have heard that most of the FBI marksmen > balked at them ... but not good ole 'doin what I'm told to do' Lon ... > yeah right! Whether what he did was right or wrong needs to be decided in a court of criminal law. He killed an individual in the name of the people using our tax dollars, the people are deserving of an accounting. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

[fwd][news] Netscape meets gov't security standard
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Netscape meets gov't security standard Netscape Communications Corporation announced Monday the National Institute of Standards and Technology and the Canadian Security Establishment validated the security code in Netscape Communicator client software and Netscape SuiteSpot server software as meeting Federal Information Processing Standards Publications 140-1, "Security Requirements For Cryptographic Modules." Netscape is the only Internet software vendor to comply with the FIPS 140-1 security standard, the company said. (PR Newswire) See full story at http://www.infobeat.com/stories/cgi/story.cgi?id=4840046-429 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

3 4

No Subject
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

I just received the following email message: I just concluded a small number of trades whereby I purchased cb$ with US$ at the rate of US$8 per cb$100. An obvious concern with ticker tapes is the loss of privacy. The truly paranoid should avoid even posting exchange rates, but even regular folks might want to avoid the details of each of their transactions. I still think a ticker tape to ecm with concluded transactions and bids taking place on the electronic cash market web pages is useful. I don't want to spend time polling various exchanges. The ticker tape could also be used to do arbitrage between exchanges. The names of the participants can be omitted to protect anonymity of traders. Besides, if the traders really want to protect anonymity they'll be working through remailers or TCP tunnels. The exchange SHOULD be listed on the ticker tape, so that people wanting to trade can find the spot where they can make the trade. This then serves as an advertising means for the exchanges which are offering the best prices and volume, etc. In any transaction one of the two parties will have wished they'd known the market price, if the price of the transaction is not at the market price. This ignores the value of the reputation of the parties involved, etc. So I propose that transactions and offers be sent to ecm in the following form: E=<number> US=<number> BUY-OFFER|SELL-OFFER|CONCLUDED DATE TIME serial# EUID=<exchange-uid> which is more or less the original syntax for ecm, substituting the exhange UID for the email address of the person making the offer. As usual the syntax is optional, so you should feel free to append other information as you'd like (expiration date, method of concluding transaction, etc.) --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972 (To subscribe to ecm, send email to ecm-request(a)ai.mit.edu with the word subscribe in the body. A digest version is available at ecm-digest-request.)

1 0