December 2003 - cypherpunks-legacy

Re: Tales from Tech Support
by blob＠apple.com 17 Dec '03

17 Dec '03

At 12:24 PM 10/18/95, Chris Claborne wrote: >This is just one of the incredible "Tales from Tech Support" you can find on >web page: >http://128.218.7.140/auricular/homepage/tstales/tstales7.html [...] >Some poor SuperMac TechSport got a call from some middle level >official...from the legitimate government of Trinidad. [long story deleted] Nice story, but the Republic of Trinidad and Tobago haven't had a coup since 1990, and that coup attempt was unsuccessful. There was some tension in Trinidad and Tobago last summer due to the speaker of the house refusing to step down over some parlimentary issues, but it hasn't escalated into a coup (yet). If this happened, it happened in 1990. But even then, the legitimate government didn't fall. Several key buildings were occupied by rebels for a couple of weeks, and then the rebels surrendered and were pardoned to great public outrage. --Brian Bechtel, who shouldn't know so much about the Caribbean...

1 0

Motherload of Crypto Site...
by frenchie＠magus.dgsys.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hope that I'm providing some useful info here. I came accross this site in DDJ (Oct 95). A comprehensive amount of crypto stuff available. Crypto Stuff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Admiration, n.: Our polite recognition of another's resemblance to ourselves. -- Ambrose Bierce, iQCVAgUBMIVvH7bmxeO+s+1xAQHS+AP+ImrrqcHfBi6OGOyu5tSAhNHrpkvPE9E5 qh3e8TsFfbyxq1UXgz73FEFfalhs3GeZOgye5DKp0/vsTQ+ZwQyizKX0XhM/MsNT zFnv7B2uOACljwqjiMCc6ZiNA25nXveA+TMIa1sZkhTMtwHzVFogE7X4S91F2gBg Til3urgFAWU= =C/CT -----END PGP SIGNATURE----- =====================PGP Encrypted Mail Preferred======================== PGP Public Keys: 1024/BEB3ED71 & 2047/D9E1F2E9 on request. As soon as any man says of the affairs of the state " What does it matter to me? " the state may be given up for lost. J.J.Rousseau - The Social Contract GAT/E/O d++@>- H--- s: a29 C+++$ UL++++($) P+>+++ L++>++++ E W+++ N++ K- w---- O- M- V-- PS+ PE++ Y+ PGP+++ t 5+ X R* tv b++ DI++ D++ G++ e h+ r y++ [Geek Code v3.0] a.k.a [ root(a)magus.dgsys.com / vamagus(a)delphi.com] ==========================================================================

2 1

perl-RSA CJ request sent today
by Raph Levien 17 Dec '03

17 Dec '03

A number of people have been asking me whether I've gotten any response from the CJR yet. Well, I only sent it off today, because I've been so busy. I sent the main one priority mail, so I suppose the clock can be considered to have started ticking on the 20th, just in case anybody is keeping track. Raph

1 0

Re: 50 attacks on Netscape - please send the check
by chip＠communities.com 17 Dec '03

17 Dec '03

fc(a)all.net (Dr. Frederick B. Cohen) writes: >50 Attacks: a.k.a. Why Not to Run Hot Java in your netscape (or other) browser: > ... (drivel elided) This fellow seems to be systematically (if not deliberately) ignorant about these things. One of my co-workers reviewed his book on computer viruses in IEEE Multimedia and noted that it manifests many of the same fallacies. You can read it (the review, not the book) at http://www.communities.com/paper/itsalive.html -- ------------------------------------------------------------------------------- | Chip Morningstar | | | Electric Communities | "I'm old enough to be living in | | 280 2nd Street, Los Altos, CA 94022 | the future I was warned about." | | 415-917-5640 | -- Myron Krueger | | chip(a)communities.com | | -------------------------------------------------------------------------------

1 0

Re: 50 attacks... [NOISE]
by fc＠all.net 17 Dec '03

17 Dec '03

Boy, you people just don't appreciate anything that has a little bit of humor mixed with a little bit of reality. 1 - I can't believe that you failed to see any humor in the fifty ways to leave your Netscape posting. I would have thought some of you would have noticed that a substantial number of these methods would work with current W3 browsers! Do I really have to set up a URL to prove it to you? If I do, what good will it do me? 2 - I can't believe that you all think that aplets (a.k.a. downloadable programs at the push of a button) will make you safe. The "we will only run trusted applets and they will all be secure" attitude is 180 degrees off base from my view. 3 - I would have figured at least one of you would have looked up the chosen plaintext attack and told me why Netscape keys can't be gotten at this way. I think there's an off change I could win a grand! 4 - If you just keep quiet, I may be able to get $50K out of Netscape for a few minutes of typing. If they can make a billion on hype, why can't I make $50K? 5 - How much do you want to bet that within 12 months of my posting, at least 10 of the 50 listed items will have happened in one form or another? I got the same flaming 8 months ago when I mentioned that I thought syslog could be gotten at because of the way it was designed. I got piles of flames telling me to show code or stop smearing syslog. Three months later, a syslog attack appeared, and three months later, another one showed up. 6 - I think that it is the responsibility of the people who claim "security" to tell us what they mean by it and to demonstrate why we should believe them. You may disagree, but I didn't see any flames when I asked what they meant by secure only a few days ago. I also didn't see any answers. 7 - I got one assertion that the reason my earlier message was perceived as malicious was because I started with the word WRONG!!! It's probably correct that that's why I got flamed for it, so from now on, I want you all to design your mail filters to replace WRONG!!! in my postings with I respectfully disagree. 8 - The first 50 flamers responding to this message get a free 1 Gigabyte email message every day for the next week. Anonymous remailers included. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

4 4

Cypherpunks in Sydney (Australia)
by Greg_Rose＠sibelius.sydney.sterling.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Any interest in a Sydney Australia Cypherpunks meeting, say in mid-november? I'll be happy to provide a venue if there is. Replies by email to me please. Greg. - -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMIWsuaRQkCwJ0+ZNAQHJVQQAiyf154u6OKRoEQQj099RGwdcDJBWCKuO RCVm32OfvDJp00xtfaTfkl6+CTjxk3hu5LO/Q02FhjoCvnm43UPy6KtPuStnnr0h QvsmcV6OMvuGDxCXIcuGWqBRaz6VPFlnHgWcpYSIpU/7QsIkDdxOblUcvoEJMaDo Ab4US4qtJmg= =0BPe -----END PGP SIGNATURE-----

1 0

Re: Anonymity: A Modest Proposal
by kelso＠netcom.com 17 Dec '03

17 Dec '03

Hi, One method to take the heat off of the last remailer in a chain would be to call on our friend the "one time pad". A message is split into two equal parts that only make sense when the two parts are 'xor'ed together. The seperate parts are then sent through different paths to the final recepiant (or newsgroup). The reader would have to 'xor' the parts together in order to read the message. The remailer could not be blamed (as the message was unreadable to him). The drawback is that the message would be unreadable until both pieces showed up. This method could also be expanded with two more equal parts that transform the origional two parts into two different messages unrelated to the origional message.

2 1

Re: Netscape rewards are an insult
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGnrDy.H3G(a)sgi.sgi.com>, anonymous-remailer(a)shell.portal.com writes: > Is your comment about the "Bugs Bounty" program an official comment, that > you have "no idea how valuable" it will be?? Shall I give you a clue, > as to how valuable the discovery of a flawed algorithm might be?? [ ... ] > Alice de 'nonymous ... I've deleted the rest of your content-free rant. Instead of alluding to some "flawed algorithm", why not tell us about the hole you say you've found in netscape? -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: java flaw
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGMpss.5q6(a)sgi.sgi.com>, fc(a)all.net (Dr. Frederick B. Cohen) writes: >> >> At 06:59 AM 10/17/95 UTC, jerry the golden retriever wrote: >> > A security feature in Java scans for viruses before activating the >> > applet. >> >> I hope that this is false. >> >> Even if one had genuine artificial intelligence, it would be impossible >> to detect all viruses, only particular viruses and classes of virus. >> >> If Java is secure, virus scanning should be unnecessary, indeed >> impossible, because there could be no code configuration capable >> of acting as a virus. >> >> If virus scanning occurs, then it is possible to write a virus in Java, >> then Java is inherently insecure. > To be more precise, if there is programming, sharing, and transitive > information flow, viruses can reproduce and spread (as proven > mathematically in the mid-1980s). Sice Java offers sharing of > programs and (for not at least) transitive information flow, viruses > are possible. I'm certainly no expert on viruses, but doesn't that have to be transitive flow of executable information? If I'm just shipping data around, there's no way you can infect me. Does Java allow the client to upload an applet to the server? Can applets persist between netscape sessions? If the answer to both of these questions is no, then the viability of viruses should be substantially degraded. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: Postscript in Netscape
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGn8F6.50y(a)sgi.sgi.com>, fc(a)all.net (Dr. Frederick B. Cohen) writes: > Jeff Weinstein - Electronic Munitions Specialist Wrote: > ... >> If a user configures a postscript viewer that has not had the >> file operations disabled as a helper app to any web browser then >> they are opening themselves up for a world of hurt. The same is >> true if they just download the file and run their viewer on it >> manually. The same is true if they configure /bin/sh as an >> external viewer. >> >> Obviously everyone should heed perry's warnings and emasculate >> their postscript interpreters before using them to view files >> of unknown origin. > WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to > be secure - regardless of the user's use of their product. Otherwise, > the ads should read: > "Netscape can be used securely by sufficiently knowledgeable > users who have emasculated their postscript interpreters before > using them to view files of unknown origin, and who have removed > all other known, unknown, and/or undisclosed security holes from > their systems. Otherwise, Netscape is insecure and should not be > trusted." If the user sets up a postscript viewer as an external viewer for postscript files, it's not Netscape's fault if the viewer does something insecure. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0