December 2003 - cypherpunks-legacy

NOD_out
by John Young 17 Dec '03

17 Dec '03

10-10-95. W$Japer: A long front page lead nodder on the burgeoning "space race" to build global satellite telecommuncations systems, for video, phone, data and other transactional bile. A related gagger on "media processors," a new generation of chips -- for video, graphics, on-line services, wireless data, telephone and audio -- being developed by MicroUnity, Chromatic Research, IBM and TriMedia. This is a more comprehensive pack-o-lies of the NYPaper spitter today on MicroUnity. NOD_out (28 kb in 2 parts)

1 0

Myth of the Powerless State
by Duncan Frissell 17 Dec '03

17 Dec '03

Gentlemen: Your leader entitled "The myth of the powerless state" (October 7th) made some valuable points about the continuing significance of state power in our lives but missed some very significant numbers. You state that public spending in the "big economies" has expanded from 36% to 40% of GDP since 1980. But, if you take the world's economy as a whole, can you doubt that the percentage of Gross World Product (GWP) controlled by the world's states has declined since 1980. Note the following significant changes. 1) In both developed and underdeveloped countries, the "informal sector" has continued to grow. You, yourself have reported that the poorest households in America spend twice their official income. 2) The Soviet Union has gone from an almost 100% government-controlled economy to one which has a much smaller state sector. Meanwhile informal and formal privatization in China, India, Britain, etc. have transferred vast assets to private control. 3) The continued accumulation of offshore funds are effectively outside of the game and under no flag. The amount of these funds is hard to estimate but has surely grown quite large. The convergence of all of these factors suggests that, at some point in the late '80s or early '90s, the percentage of the GWP controlled by governments peaked and began to decline. As technology makes it easier for the financial services industry to carve its niches in the corridors of cyberspace, stateless financial assets seem sure to grow. Since anyone can use powerful mathematics to create virtual spaces which even the largest government is powerless to enter, the percentage of GWP that the state even knows about much less controls will shrink. Duncan Frissell

1 0

Re: PC disk wipe software - SUPERWIPE 1.04R
by Herb Sutter 17 Dec '03

17 Dec '03

At 04:45 1995.10.10 -0500, Gary Jeffers wrote: > As for the problem of getting rid of old buffer data writes to the end >of last file cluster writes, my program doesn't handle that. However, if >there is no disk compressor, I don't think it would be that hard to write >a function to handle it. In reality, I don't think that this problem is >much of a problem anyway. It would only occur at the end of small files. Thanks for the post. Just a thought: there is dead space at the end of virtually all files, not just small ones. On average, half a cluster is wasted at the end of any given file. Only files that happen to be an exact multiple of the cluster size won't have wasted bytes (on my main drive, with a cluster size of 16K, on average about one file out of 16,000+ wouldn't have any wasted space). Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Re: Certificate proposal
by jbaber＠mi.leeds.ac.uk 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> writes: >The POV I am really arguing against is the one that defines identity to >be a key, that states that in communicating with a key you are by >definition communicating with the person you have in mind. The man in >the middle attack does not exist because from your point of view the >entity at the other end of the communication channel is just the MITM >plus the person you think you are talking to. This idea has been >expressed many times by other people in this discussion, and it is this >which I think is fundamentally flawed and even dangerous because it >encourages the use of untested keys. In fact it seems to define away >the question of whether a key is real or fake. It defines away the question of whether a key is real or fake because the key itself can not be fake. Assuming strong encryption anything that you send to the key can only be read by the key and anyone that he/she choses to pass it on to (something that can not be stopped). The only thing that can be fake about the key is the attributes associated with it - whether the attributes concerned are true names or the ability to use a bank account. Having a man in the middle when no attributes are concerned is simply the same as talking to someone who passes all of your messages on to a friend and then expresses the friends opinion rather than his/her own back to you... something that I can think of no possible way to stop. So although you are talking talking to A the opinions expressed are those of B, and there is no way of telling - in the same way as a man in the middle attack (B may not even know that his/her arguments are being used by A against you). This argument reduces the problem to 'how do you validate key attributes' as you can be sure that you are communicating securely with the key (key's owner) but nothing else. With PGP currently the only attribute that a key (X) may have is a name (true/pseudo) and this attribute can be signed as valid by another key (Z). If you accept the signature all you are doing is saying that you accept the signing key's certification - ie an attribute signed by this key (Z) is true. Eventually you have to just trust a key to have taken reasonable care to ensure that any attribute that it has signed is true - whether you are using a Web of Trust model or a more centralised model such as accepting VeriSign certificates (or your own - knowing exactly how much care you have taken to ensure that the attribute that you have certified (signed) is true). I believe that this is more removing a special case (treating the true name differently from any other attribute) than defining away the problem - even though the (MITM) problem does cease to exist. Jon jbaber(a)mi.leeds.ac.uk http://www.chem.surrey.ac.uk/~ch02jb/

1 0

Re: Conference Summary, Part the First
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:23 PM 10/8/95 -0800, Douglas Barnes wrote: > o Regulators are not amused by attempts to run unlicensed online > banks. They are aware such things are starting to pop up, and > they are very interested in shutting them down when they do. The jurisdictional problems are going to be very interesting. As with gambling. Nations are reluctant to extradite their nationals for acts that are not crimes at home. The US follows this practice just like everyone else. Witness the lack of success of the German government in extraditing neo-nazis from the US. They had to grab one in Europe. > o The same goes for NBFIs (Non-bank financial institutions) -- > these appear to be regulated primarily at the state level, with > some IRS and FinCEN involvement. These include everyone from > stock brokers to Casas de Cambio. This is the real problem for the Feds. When everyone is a non-bank financial institution... > o The attendees displayed an understanding of the situation wrt > electronic payment systems that ran from dim to non-existent. Hard to control what you don't know. > o Fewer formal, specific or deterministic rules for reporting > suspicious transactions. > > o More vague, subjective, and privacy-invading rules for > reporting suspicious transactions, coupled with more severe > penalties for banks and NBFIs. But unlicensed NBFIs don't have licenses to pull so regulation is tricky. An unlicensed NBFI includes any institution in another jurisdiction (no *US* license) and any person running Quicken version 9.0 that will no doubt support exotic electronic payment systems. > o Banks are now considered "deputies" of the federal government > in the War On Money Laundering. Generals are always fighting the last war. Banks are history particularly if they are unable to offer competitive services because of regulatory restrictions. > o Banks must implement strict "Know Your Customer" policies. Which are trivial to defeat particularly under an EPS system when the customer hands his keys over to his actual principal. Note: I've often wondered why the rulers place so much faith in their ability to identify people when those who have studied the Is A Person problem have thrown their hands up. "Homeless? Want to make a few bucks? You have a brilliant future in the identity sales business. Remember, you can sell your identity as many times as you like. It never wears out." DCF

1 0

rise and fall...
by Black Unicorn 17 Dec '03

17 Dec '03

Some time ago on the list someone mentioned a book "Rise and Fall of the Nation State." Can someone confirm author/title information for me? --- "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Java
by Perry E. Metzger 17 Dec '03

17 Dec '03

As long as people are mentioning Java, I just want to make the prediction, one more time, that at some point someone is going to find some devistating security holes in HotJava. In order for HotJava to be completely safe, the Java security model needs to be perfect (and it is way too complex to prove correct), you need a perfect implementation of this perfect security model, no code in the Java implementation outside the security code can adversely impact the function of the security code, and there has to be no way that a bug in the code outside the Java implementation can screw with the internals of the Java implementation in such a way as to get it to drop its security. I don't believe that humans can produce something that satisfies all four criteria given our current state of technology. Java is just too complex a language for me to believe that it can have been perfectly specified and implemented. Enormous risk -- I really mean ENORMOUS risk -- is being taken in order to add a little convenience in making web applications pretty. Someday, there is going to be big trouble from this. *BIG* trouble. You heard it from me first. You might ask "Perry, what could possibly satisfy your perfectionistic criteria?" Well, a language that didn't have any I/O or similar "dangerous" capabilities in it at all, rather than one in which such capabilities were selectively "restricted", would be one I would feel much more comfortable trusting. If written in a fairly safe language where it is hard to pull buffer overflow tricks, the interpreter for such a language would be very hard to pervert into doing untoward things. Java isn't like that, though. Its got the full power and glory of any other language, and the only thing sitting between a HotJava app and some really nasty viral effect is a paper thin shield -- the security model. A couple of bits twiddled in the right place and the shield is gone. The best things about Java could probably have been achieved without giving it so much power. Its too late now, though. The bandwagon is too far along. As a security consultant, I'm of course in a position to profit from the wreckage, but frankly I don't like that any more than an aircraft disaster expert wants to see more aircraft accidents. Perry

5 6

Re: PC disk wipe software
by Bill Stewart 17 Dec '03

17 Dec '03

>There has been considerable discussion on the MCIP list about how most >*Mac* programs that purport to do this, like Burn, for example, leave stuff >over in disk blocks. My understanding is that this is not a trivial >problem, and it occurs in MUSH-DOS as well.... Doing it _right_ is not a trivial job. Consider disk controllers that map out bad blocks so the OS never needs to see them - if you're trying to remove highly classified data, the fact that Diskwipe won't ever see them might be a serious problem, even if it is close enough for government work. For a more realistic scenario, consider Stacker and other disk-compression software; you don't know what physical blocks the file was written on, or whether overwriting the logical blocks of the file will actually write to the same physical blocks. In some cases you can assume that it probably won't. You also can't expect to write large blocks of 1s or 0s over the disk, because disk compression will turn them into small blocks with run-lengths or equivalent. (Writing PRNG random noise will do, or you can generate counter-based patterns that may work, or do something cryptographically strong if you want to take the time.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Re: Basic Flaws in Internet Security and Commerce
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

A fine piece of work. The ideas expressed in this paper should scare the hell out of everyone who uses NFS for any serious applications, which for a fact includes most banks and all investment banks and brokage houses. In this particular area I KNOW what is at risk. Again, I congratulate the authors on a first-class effort. cheers, paul > From owner-cypherpunks(a)toad.com Tue Oct 10 03:15:15 1995 > From: gauthier(a)espresso.CS.Berkeley.EDU (Paul_A Gauthier) > To: cypherpunks(a)toad.com, bugtraq(a)crimelab.com > Cc: gauthier(a)cs.Berkeley.EDU, brewer(a)cs.Berkeley.EDU, iang(a)cs.Berkeley.EDU, > daw(a)cs.Berkeley.EDU, fur(a)netscape.com > Subject: Basic Flaws in Internet Security and Commerce > Date: Mon, 09 Oct 1995 14:26:06 -0700 > Sender: owner-cypherpunks(a)toad.com > Content-Length: 10235 >

1 0

Java=?
by Daniel Miskell 17 Dec '03

17 Dec '03

Being a newcomer to this list, and having read a lot of java-related messages without understanding them fully, could comeone explain to me exactly what java *is*? Thanks for your time, ahead of time. DMiskell(a)envirolink.org --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________ "Oh $HI+, here comes a flock of pushers - 'Jungle Edition.'" -Mortifer Nex, playing peek-a-boo in the trees "If you've got the coordinance, we've got the ordinance to blow up the loved ones who blow you off!" -Uncle Dan's Thermonuclear Explosives, Unlimited

1 0