December 2003 - cypherpunks-legacy

Re: More forged cancels (fwd)
by Michael Froomkin 17 Dec '03

17 Dec '03

why is my mailbox full of stuff from mail.cypherpunks? **** PLEASE NOTE NEW E-MAIL ADDRESS: froomkin(a)law.miami.edu ********* A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | New address, but it's still just as hot here. ---------- Forwarded message ---------- Received: from relay3.UU.NET by law.miami.edu (4.1/3.1.012693-University of Miami Law School); id AA16017 for IFS=' '&&exec /home/faculty/froomkin/proc/procmail -t -f-||exit 75 #froomkin; Mon, 2 Oct 95 01:17:37 EDT Received: from toad.com by relay3.UU.NET with SMTP id QQzjqz13374; Mon, 2 Oct 1995 01:16:43 -0400 Received: by toad.com id AA17355; Sun, 1 Oct 95 22:13:04 PDT Received: from hudson.lm.com by toad.com id AA17346; Sun, 1 Oct 95 22:12:56 PDT Received: (from news@localhost) by hudson.lm.com (8.6.11/8.6.9) id BAA09549 for cypherpunks(a)toad.com; Mon, 2 Oct 1995 01:15:28 -0400 Path: hudson.lm.com!news.math.psu.edu!news.cac.psu.edu!newsserver.jvnc.net!newsse… >From: orbit(a)ix.netcom.com (Michael R. Grabois) Newsgroups: news.admin.net-abuse.misc,soc.culture.german,soc.culture.jewish,rec.radio.shortwave,alt.2600,mail.cypherpunks,alt.privacy.anon-server,alt.stop.spamming,alt.stop-spamming Subject: Re: More forged cancels Date: Mon, 02 Oct 1995 03:31:03 GMT Organization: Netcom Lines: 40 Message-Id: <44nmd0$q13(a)ixnews6.ix.netcom.com> References: <44n926$2dj(a)sundog.tiac.net> Reply-To: orbit(a)ix.netcom.com Nntp-Posting-Host: ix-hou6-03.ix.netcom.com X-Netcom-Date: Sun Oct 01 8:30:40 PM PDT 1995 X-Newsreader: Forte Free Agent 1.0.82 Xref: hudson.lm.com news.admin.net-abuse.misc:16173 soc.culture.german:76152 soc.culture.jewish:188004 rec.radio.shortwave:63171 alt.2600:125976 mail.cypherpunks:18586 alt.privacy.anon-server:4465 Apparently-To: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk On Sun, 01 Oct 1995 23:45:24 GMT, jbyrd(a)tiac.net (Jim Byrd) wrote: [snip] >-----------------begin control message >Path: >sundog.tiac.net!news.sprintlink.net!in2.uu.net!sunic!mn6.swip.net!seunet!news2..swip..net!plug..ne >ws.pipex.net!pipex!tank.news.pipex.net!pipex!usenet.eel.ufl.edu!news.gmi..edu!msunews!netnew >s.upenn.edu!ts7-28.upenn.edu!user >From: 73323.603(a)compuserve.com >Newsgroups: soc.culture.german,soc.culture.jewish >Subject: cmsg cancel <73323.603-3009951517290001(a)ts7-28.upenn.edu> >Date: Sun, 1 Oct 1995 17:56 GMT >Organization: The National Alliance >Message-ID: <cancel.73323.603-3009951517290001(a)ts7-28.upenn.edu> >NNTP-Posting-Host: ts7-28.upenn.edu >Approved: 73323.603(a)compuserve.com >Control: cancel <73323.603-3009951517290001(a)ts7-28.upenn.edu> >X-Cancelled-By: 73323.603(a)compuserve.com >Lines: 1 >CANCELLED. >----end control message Does this mean that the cancel came from the Compuserve account? Forging cancel notices is definitely against CIS rules, as is unsolicited e-mail. I've already talked to a sysop there about it, and he said he'd pass it along to the CIS Security folks. If nothing else, that may get his account revoked. Hey, small victories. Michael R. Grabois | orbit(a)ix.netcom.com Houston, TX | CI$: 74737,2600 ------------------------------------------------------- Gravity. It's not just a good idea, it's the law.

1 0

Re: Yet Another "(Fwd) Internet Euro-Clipper"
by Peter Trei 17 Dec '03

17 Dec '03

> At 5:12 PM 9/29/95, Peter Trei wrote: > >Subject: European Governments Agree to Ban Strong Crypto > The biggest problem I have with this is that this is the third, fourth, or > fifth posting of Ross Anderson's piece to this list [...] > I urge people to read what's on the list and not repost things which have > already appeared. If they don't have time to read all of the messages on > the list, which is understandable, then they need to be even more careful > in posting things. Reading the list does not neccesarily help - I experience a several hour lag between when I post something, and when it comes back from the list server. Thus, even if I'm all caught up on my reading the list (as I was when I posted that article), articles may be 'in the pipe' which duplicate ones I'm thinking of posting. For those curious about the latency, I'm posting this at 12:08, on the US east coast. How long did it take to reach you? > > Not to pick on Peter Trei, as this happens all the time, whenever a hot > issue appears. Short of implementing some content-sensitive form of CSMA/CD, I don't see what we can do (but lowering the list latency would help a lot). > --Tim May Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

`Hack Microsoft' challenge is NYT Computer News Daily's top story
by Rick Busdiecker 17 Dec '03

17 Dec '03

See http://nytsyn.com/live/Lead/275_100295_074418_19095.html MICROSOFT BECOMES NEW TARGET OF HACKING CHALLENGE (10/2) By HEATHER GREEN c.1995 Bloomberg Business News BERKELEY, Calif. -- Microsoft Corp. has been chosen as a new target for computer hackers. Community Connexion, an Internet service provider that last week promised a free T-shirt to anyone who found a flaw in Netscape Communications Corp.'s software, extended the challenge Friday to include holes in Microsoft products. . . . The article quotes Sameer and includes the URL http://www.c2.org/hackmsoft/ -- Rick Busdiecker Please do not send electronic junk mail! net: rfb(a)lehman.com or rfb(a)cmu.edu PGP Public Key: 0xDBD9994D www: http://www.cs.cmu.edu/afs/cs.cmu.edu/user/rfb/http/home.html send mail, subject "send index" for mailbot info, "send pgp key" gets my key A `hacker' is one who writes code. Breaking into systems is `cracking'.

3 2

Re: NetScape's dependence upon RSA down for the count!
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

Don wrote: >I haven't read the SSL spec for a while but my understanding was that >the server passed it's public key to the client via a certificate >signed by a mutually trusted certificate authority (i.e., Verisign). > >How would the filter be able to forge such a certificate ? Why forge it? Why not simply buy a netsite server with a valid certificate. Let's say you paid full list for it $5000. It is the classic MITM attack but the protection against that attack was generally that the parties communicating "knew" each other. This is a fundamental weakness of putting the security at the SSL level as opposed to a possibly higher level. With the netscape attack since your client never cares "how" (or to whom) the SSL connection is made, it never shows you the information about where the source key came from. Only that it is valid. --Chuck

1 0

Re: Yet Another "(Fwd) Internet Euro-Clipper"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:20 PM 10/2/95, Peter Trei wrote: >For those curious about the latency, I'm posting this at 12:08, on the US >east coast. >How long did it take to reach you? I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. I've generally found that lags are on my end, that my system (got.net currently) is delaying mail from _all_ or _most_ mailing lists. (This was particularly the case last week, when Cypherpunks mail stopped for many hours at a time, then arrived out of sequence when my ISP was (presumably) able to receive the resent mail.) >> Not to pick on Peter Trei, as this happens all the time, whenever a hot >> issue appears. > >Short of implementing some content-sensitive form of CSMA/CD, I don't see >what we >can do (but lowering the list latency would help a lot). Well, the main issue with the "Europe to Ban Crypto" reposts was that several people reposted the same press release over a period of several days, and the case I cited here was where it was posted a week later. I can't see how a latency, even a serious latency of several hours, could cause this to happen. Mostly I think people should try to first of all, _write original stuff_. That is, write their own analyses of things. Their own essays, reactions, etc. Then, secondarily, post pointers to longer stuff. Thirdly, and less to be desired, forward articles. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

My goof on toad.com lags...
by tcmay＠got.net 17 Dec '03

17 Dec '03

A few minutes ago I wrote: --- At 12:20 PM 10/2/95, Peter Trei wrote: >For those curious about the latency, I'm posting this at 12:08, on the US >east coast. >How long did it take to reach you? I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. --- Well, before you all correct me, yes, I now realize it was my copy, sent directly to me, that I received. As of 09:35 I haven't received the toad.com-delivered copy. But my point remains that many times the lags are on local ISP systems, not necessarily on toad. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

SSH random numbers
by Lance Cottrell 17 Dec '03

17 Dec '03

I have finaly been goaded into using SSH. I seems like a great tool, but I have one major worry. When I install SSH, it generates the host key right away. When I run ssh-keygen, it generates my user key right away. Where is it getting the random numbers. Before I dive into the source I was wondering if anyone else had looked into this? -Lance no PGP sig because I am on a remote machine. ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: CJR for perl-RSA t-shirt
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:58 10/1/95, Robert Hettinga wrote: >>Subject: Mass Market Software with Encryption - 15 Day Expedited Review >> Requested >> >>Subject: Commodity Jurisdiction Request for >> perl-RSA t-shirt, an encryption program > >ROTFL! > I agree. I especially laughed at the part that stated "... also as a bar code, making the t-shirt machine readable as well as machine washable."

1 0

Re: List latency.
by Joel McNamara 17 Dec '03

17 Dec '03

As a non-crypto, latency-related, aside. The USENET newsfeed coming out of uunet to my ISP was non-existent last week. It's improved somewhat, but is still lagging behind by 2 or 3 days (never did this in the past). uunet has not provided my ISP with an explanation as to what is happening. Perhaps it's related to the delay in list messages appearing. Unfounded speculation has been the .edu sites are active again after the summer and are swamping things. Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you? >It looks like there's a considerable delay entering and leaving uunet. I'm not sure which >machine gets the blame, but it's either toad&uunet, or uunet&alcor.

1 0

Time Lag (was Re: Yet Another "(Fwd) Internet Euro-Clipper")
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > At 12:20 PM 10/2/95, Peter Trei wrote: > > >For those curious about the latency, I'm posting this at 12:08, on the US > >east coast. > >How long did it take to reach you? > > I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. I got it at 11:53 PDT. I just checked the headers and the delay was split in a couple of places. (Correcting all times for PDT) thunk -> 9:10 -> alcor.process.com. (And they're off and running!) alcor.process.com. -> 9:10 -> toad.com. (delivered in 0 time:) toad.com. -> 11:29 -> relay3.uu.net. (Sat on toad 2hrs, 19 min) relay3.uu.net. -> 11:54 -> mail2.pilot.net. (Sat on relay3 25 mins ) mail2.pilot.net. -> 11:53 -> verity.com. (delivered into the past!) Of course these delays can vary a few minutes either way because of inaccuracies of time clocks on various machines. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0