December 2003 - cypherpunks-legacy

Re: Yes, indeed the PA law is for real!
by Rich Salz 17 Dec '03

17 Dec '03

>Historic comment: ... "You read it here first." Nostradamus said it way before you. This kind of dredging up old posts in order to claim certain foresight intellectual properties is kinda silly. Watcha gonna do, patent it? It's gonna rain tomorrow. You heard it here first. Of course, I don't plan on doing anything about it other than tell you all...

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>I want to see Netscape succeed, but when you hear about things like product >being released on the net without warning those people responsible for >supporting it, bug reports being ignored so a ship date can be made, and the >like, it makes you really wonder. I am finding problems with 2.0b1 that >could have been found just by using the product for a couple of days! Most >of the problems I have seen with Netscape could be solved with better >communications between departments within the company and some strong >testing procedures. > I totally agree with this. There are an awful lot of GPFs I've been experiencing with 2.0 that I never experienced with 1.2, and I am still trying to figure out that cause. The first one happened like 5 minutes after I ran the program whilst it was loading the Netscape homepage! Another irritating one that should have been caught is the download time indicator. When I download a file, the estimated time taken is shown in hours! These trivial problems are really quite inexcusable, and should've been caught with good quality assurance before it even went out the door.

1 0

ORW_lea
by John Young 17 Dec '03

17 Dec '03

10-15-95. NYPaper: "Law Enforcement and Privacy Interests Clash on Technology." The legality of mobil data terminals, which put records at the fingertips of officers in their cars, is in question. Some other machines could well be props in a James Bond movie: long-range eavesdropping devices that, placed in a briefcase, pick up conversations a football field away, or infrared radar monitors that, mounted on a car, can detect weapons on a person a half-mile away. For law enforcement officials, they are new-generation weapons in the war on crime that enable the police to better protect the public, even at the expense of a little privacy. But for civil libertarians, they conjure Orwellian images of Big Brother armed with technologies that are subject to abuse and prone to error. ORW_lea (8 kb)

1 0

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 13 Oct 1995, Rob L wrote: > Actually, it is not jeapordy that they get from doing so, but some of the > best bug finders and security experts on the planet.. for close to free. Actually, this is a very dangerous game to play, because realistically Netscape gets both, foe and friend. And they risk not only the entire company by taking this action, but they also pose risk to the public They might get someone who responsibly tries to point out an incredibly poor design methodology within ALL of Netscape's code -- the existing installed code base as well as the new beta code. Someone who points out this fatal design flaw to the public and not only to Netscape. Or they might confront someone who announces that numerous pointers have been placed in roulette programs making the Web under Netscape a little more like playing Russian Roulette, rather than safe, fun entertainment. Netscape clients might face a customized plexus, one that delivers dynamic documents. One time in six (if you're running CURRENT Netscape release software) it deletes your WIN.INI. Some machine in Bucharest reaches right out, and wipes you clean. Or maybe it just downloads all of your Quicken files. Netscape is clearly not thinking clearly, here. The issue here isn't "Bugs" and Netscape's so-called Bugs Bounty program. It's a broader question of design methodology and of design process. Does Netscape have a product that has any worth and utility?? Does Netscape have a product which can go through a "Product Evaluation" and then a "Certification Evaluation" as set out in the US Department of Defence's Orange Book?? Or does Netscape's product fail the giggle test. > If hackers can find 10 bugs before final release, it means there is a > good chance that they will fix those bugs before final release. > > Think of it this way.. you practice a new task until you are competent at > it.. beta code is the same.. it is the practice or scratch code that may > be refined into the final product. I'll beg to differ on this one. This is not about hackers, nor is this about crackers. We are not talking about some shareware game program here. Nor are we talking about a word processor, spreadsheet, or draw program. We are talking about a program that has a different mission profile. The standard here is different. A bug in code that makes your system freeze is different than a sloppy design methodology that allows someone to literally take complete control of your machine from any other machine in the world, whether that machine is foreign or domestic. Code which seeks to secure a public network connection, calls for a different programming altitude, than writing common PC code. The tolerances are different, the expectations are different, and the challenge (which was summarized most cogently by a UK friend) distills to a single basic issue. How do you invite a few billion people into your home without having one of them nick the silver?? Evaluation of technical computer security effectiveness is not accomplished by the release of "practice code". It has to start from the ground up. And it is certainly not assisted by having a corporate communications policy that is geared to NOT opening a communications pipe with someone who has attempted to offer constructive technical criticism. Let me make this absolutely clear. It should not be up to non-US citizens like myself to safe-guard US economic security, and protect vital national interests. It is not my job and certainly not my responsibility to protect the international public and Fortune 500 companies from poor security. When that attempt is made however, the effort should not be stymied by Netscape's thinly veiled attempt at information free-loading through public-relations puffery. From this vantage point, Netscape's press releases have the stench of some two-bit penny stock hustler -- something I'd expect from some Vancouver Stock Exchange promoter, rather than the standard expected of a company with a Two Billion USD ($2,000,000,000) market capitalization. After emailing the company more than two days ago, I would hope that a communications channel would have been opened, or alternatively I would have held out a hope that someone from Sun or Netscape might have made an official comment here or publically. I would have expected something other than a stone-walling silence. My Friday the Thirteenth post obviously has people shaken. Clearly, Friday was not the day to comment about this serious problem. There was no utility in causing panic and disrupting trading in Netscape stock, especially in a market that can only be characterized as frothy. But now here we stand, many hours and days later, with the questions raised remaining unaddressed, and with my copyright restriction on my Friday post hereby, and herein explicitly waived. The question is no longer simply a question of whether Netscape can produce quality code, but a new question rises on the horizon. Does Netscape have the management depth and experience to meet daily corporate requirements?? And is the promise of Internet commerce whether put forward by Netscape, Microsoft or AT&T simply a pipe dream. A very risky game, they like to play ... Or since I had already spoken of Dominick Dunne on Friday, perhaps a turn this Sunday to Johnnie Cochrane and his fine choice of words: "Whom will I trust as I will adders fang'd They bear the mandate; they must sweep my way, And marshall me to knavery. Let it work; For tis the sport to have the engineer Hoist with his own petar: and 't shall go hard ..." Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

National Insitute of Justice
by John Young 17 Dec '03

17 Dec '03

For more on the NIJ, oft-cited by The NYT as the sponsor of wizard crime fighting devices, see: URL: http://ncjrs.aspensys.com:81/aboutnij.html There are helpful links there to the ever-expanding universe of the terrifying trust-me evangelists.

1 0

I am looking for a way to create a zombie process
by fc＠all.net 17 Dec '03

17 Dec '03

I am writing a paper that, among other things, talks about detecting zombie processes. I find that, due to my systematic hunting down and eliminating of these processes, I no longer have any hanging around for demonstration purposes. How embarassing - I don't know how to create one! Is there anyone who can give me a simple program or set of commands that creates a zombie process? Thanks in advance. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 2

Re: Int'l Money Laundering, Part the Second
by James A. Donald 17 Dec '03

17 Dec '03

At 07:31 PM 10/10/95 -0800, Douglas Barnes wrote: > When you combine these elements, you get a strategy that > permits the US government to confiscate worldwide correspondent > accounts of banks, even if they don't have a US presence. This is doubtless one of the reasons why the US$ is rapidly losing its place as the preferred currency for international transactions. > acceptance of US-dollar negotiable instruments by a bank anywhere > in the world outside of the US renders the bank susceptible > to US criminal jurisdiction in the money laundering field. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: WWW> One If By Congress, Two If By White House
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

Path: left!hypnos!ragnarok.oar.net!malgudi.oar.net!kira.cc.uakron.edu!neoucom.edu!news.ysu.edu!news.ecn.uoknor.edu!paladin.american.edu!gatech!newsxfer.itd.umich.edu!tank.news.pipex.net!pipex!news.mathworks.com!newsfeed.internetmci.com!news.mid.net!news.mid.net!not-for-mail From: Gleason Sackman <sackman(a)plains.nodak.edu> Newsgroups: comp.internet.net-happenings Subject: WWW> One If By Congress, Two If By White House Message-ID: <45lt48$db4(a)shocker.mid.net> Date: 13 Oct 1995 09:29:28 -0500 Sender: infoserv(a)news.mid.net Organization: MIDnet, the Midwest's Gateway to the Global Internet. Lines: 14 Approved: ralphie NNTP-Posting-Host: shocker.mid.net *** From Net-Happenings Moderator *** Date: Fri, 6 Oct 1995 07:51:13 -0500 From: jrw(a)ix.netcom.com http://www.geopages.com/CapitolHill/1783 A website dedicated to Jeffersonian Conservatism, the underlying principle of which is a strong faith in the American people -- the individual citizen -- rather than in an overgrown, cumbersome, impersonal and too powerful bureaucracy. Good links to the entire political spectrum, government, books, etc. The goal is to provoke thoughtful discussion and informed political action.

1 0

Re: Netscape rewards are an insult
by John Young 17 Dec '03

17 Dec '03

Responding to msg by stripes(a)va.pubnix.com ("Josh M. Osborne") on Sun, 15 Oct 12:0 AM The PR of Bugs Bounty is the aim, as the quick-market-adapter Netscape Chair speechified in FR. Promoting the notion that hackers are earnestly attacking Netscape and reporting its bugs increases its credibility to the stock market porkers. Is that not why dear all-too-attentive Jeff has been assigned duty on this list, feeding peanuts to chimp hackers and champ newshacks?

6 5

Re: Netscape rewards are an insult
by Brad Shantz 17 Dec '03

17 Dec '03

Josh Osborne writes: > Note well: Netscape is offering this reward for finding bugs in *beta* > release code. In other words the code that they *know* crashes, code > that they susspect has security releated bugs, code that they don't think > is (yet) good enough to charge a mesely $40 for! Whoops, wrong. BETA does not mean code "they know crashes." In fact it is quite the opposite. This is pre-release code that they are bug fixing. most of the catastrophic bugs, they probably know about. A BETA program is to increase the testing and quality assurance staff to find all of the bugs they DON'T know about. Then, they will have a reasonable amount of time to fix those bugs before release. It makes for a much more stable product. Now, look at companies like SPRY/Compuserve or Logos Research Systems. Both companies I have worked for. SPRY didn't really have a BETA program that amounted to much until Internet in a Box version 1.0. Even that was a lame beta program. Mostly internal use and testing. Logos (a Bible software company) never even had a beta program. As much as I like the guys at Logos, they released version 2.0 recently and it's buggy. Simple cosmetic things like not being able to "cancel" out of the options dialog, or "help" buttons taking you to wrong places in the help file, these are all things that would have been caught in a decent testing environment or a beta program. Microsoft, who I don't necessarily like all the time, has a great beta program. Usually it is several months to a year of intense testing, bug fixing, feature cleanup, usability testing, etc. Their software may not be the best, but more often than not it is stable. Anyway, I see Netscape's move to paying for beta testing will result in a more stable browser, and hopefully more secure software. > If they don't get buried in bad press for this, I would guess that they > may have a diffrent program with a diffrent set reward for finding bugs > in their for-sale version. Why would they get bad press? > Besides nobody said you have to report your bugs to Netscape just because > they gave you free software and offered some sort of reward for finding > bugs. If you don't think the "pay" (including the posability of having > the software fixed) is high enough, don't report the bugs. Once again, Josh, I'm afraid I have to disagree with you on this one. Especially in regards to secure software. I see your point, but... Whether or not you have to report the bugs is immaterial. Netscape is doing a service by making their app available for testing before saying "this is secure." As a person who does business over the net, if I found out that my software was NOT secure, I would seek either a secure update or another company's software. If I'm happy with Netscape's software, I'll report the bugs to improve it's quality. In my humble opinion, improving the software is reward enough. Very few companies have paid beta programs. I'd rather see bugs fixed before release than getting the bad press after release for shoddy workmanship. Sorry this was so long. I didn't mean to ramble. I'll get off my soapbox now... Brad

3 2