December 2003 - cypherpunks-legacy

Net Papa: Global Internet Taxes Inevitable
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

(09/09/97; 12:00 p.m. EDT) By Douglas Hayward, TechWire GENEVA -- Internet taxes are inevitable, according to the man dubbed the "Father of the Net." The only way to avoid global chaos is to create an international agreement on how to do it, added Vint Cerf at a meeting of the Internet Society here. Cerf co-developed the TCP/IP[LINK] protocol on which all Web and Net transaction depend. ...Taxation of the Internet, also called "bit taxes," must be well planned, Cerf said. "And it must also be thought through on a global scale -- not parochially," he said. In the United States. alone, there are 30,000 taxing authorities that might be interested in taxing transactions on the Internet, said Cerf, adding that right now, there is no way to determine which of those authorities should have jurisdiction over a particular transaction. ..."If something is becoming an infrastructure that is important for people's daily lives, then governments will have the right to be concerned about the public's safety and well-being," Cerf said. "When you build roads, you make rules about how people are to behave on these roads, in order to protect people." TW http://192.215.107.71/wire/news/1997/09/0909tax.html

1 0

Re: netscape's response (source code review)
by John Gilmore 17 Dec '03

17 Dec '03

> > "Netscape has also begun to engage an external group of world-class > > security experts who will review our solution to this problem before > > it is sent to customers." > > A group which offered to review the first version, but > > Netscape refused. > Do you mean that cypherpunks offered to review the netscape code > if only we made all the source available on the net? I think "the group" was RSADSI, based on a remark of Jim Bidzos. However, I do think that, like the S1 cipher, your code would get examined for interesting features and flaws by the cypherpunks if you released it. > We will be having at least some of our code reviewed by a > wider audience, but I don't yet know which code, or how wide a review > group. If anyone has specific suggestions for pieces of code that > you would like to see widely reviewed (such as RNG and seed generation) > let me know. It is becoming gradually clearer in cryptanalysis that you can't test security of pieces in isolation. Their interaction with the surrounding code and protocols is key to their security. Ross Anderson's paper at Crypto last month was all about this (``Robustness Principles for Public Key Protocols''). There were also several papers there that showed how you couldn't just treat hash functions like MD5 as black boxes, since embedding them naively into signature protocols made it possible to do things like turn a signed short message into a signed longer (modified!) message. So far the c'punks haven't done anything clever to your protocols; they've exploited basic weaknesses in key length and key generation. There's still a lot of potential in active attacks, three-cornered attacks, replays, etc, that is unexplored. > I realize that some cypherpunks think that we should make all of > our code publicly available. In an ideal world that would be great, > but we live in a world with politicians, crooks, lawyers, stockholders, > etc... Don't expect to see us posting our entire security > library source code to cypherpunks. Naah. I think NCSA should've made Mosaic publicly available, because they wrote it with our tax dollars. And I hold it against them that they started the trend of "zero-cost personal-use binaries but no commercial use" that many Net users still confuse with Real Free Software (free as in freedom). But Netscape owns its code, it can do whatever it wants with it. I'd still encourage you to err on the side of release. The strongest tendency in the security industry is for "security by obscurity", i.e. if we just keep this quiet, nobody will figure it out. Customers, even less sophisticated than vendors, often let the vendors get away with it. But it doesn't stop the crooks, and stopping the crooks is what your customers are paying you to do. Code that gets public scrutiny, like published scientific papers, gets debunked and honed and made to really work. Much faster than code and ideas that only circulate in small, closed groups. The reason Kerberos V5 is a lot more secure than V4 is because its security features and flaws could be publicly discussed. Steve Bellovin wrote a whole paper about what was wrong in V4, and lots of people got to chew on that and think about how to fix it. The question that only Netscape management can estimate is: what damage would it risk to your business, if you released *this much* crypto code instead of *that much*. Particularly if you copyright it and prevent commercial re-use without licensing, I doubt it will help your competitors much. There is the risk of revealing a flaw that makes it easy to crack. That has to be balanced against the risk of having such a flaw and not noticing it for years. And finally, I thought a marketing goal was to make your security scheme (SSL) a standard throughout the industry? In that case, publishing it *and allowing* commercial use would encourage people to adopt it -- which is what I think you want. [We all realize that "publishing" crypto code is unconstitutionally regulated by the State Department. So there are logistics to the release process. But you are presumably solving them for the 128-bit domestic version; you can use the same procedures to let people download whatever crypto source code you release.] John Gilmore

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> But don't they have to put something on the patent application? Can they > claim trade secret status for something that was on a patent application, > but rejected? That seems like they're getting it both ways. At this point, in this country, a patent is secret until it is issued. It is interesting to note that the process of issuing a patent can take an indefinite period, and to some extent it is in the control of the person seeking the patent. The typical slimy thing to do is to file for a patent, and keep it a trade secret too. Delay the issuance until somebody discovers your secret, then allow the patent to be issued. This is called a "submarine" patent. It allows the best of both worlds, and extends the patent as far in to the future as possible (17 years from issue date, in this country, regardless of filing date). You can delay the patent's issuance by continuing to file amendments to it. Gilbert Hyatt's recent patent on microprocessors is the classic example. Now, this is all expected to change, to become more harmonious with the rest of the world. The changes that I've heard are 1) Go to first-to-file instead of first-to-invent 2) Life is 20 years from filing date, instead of 17 years from issue date 3) Publicize patents some fixed time from filing date, say 1 year As you can imagine there are armies of lawyers on both sides of the issue, so I don't think that you'll see any changes in the law any time soon, but you never know. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

2 1

FREE BUSINESS INCLUDING OVER $600.00 IN SOFTWARE!
by freebiz＠yourhouse.com 17 Dec '03

17 Dec '03

Please pardon the intrusion...... >>>If you find mail such as this offensive I sincerely apoligize. Please type REMOVE in the subject heading, if you do not type REMOVE, there is no way for you to be REMOVED. Thank You.<<< FREE/_/_FREE/_/_FREE/_/_FREE/_/_FREE/_/_FREE/_/_FREE NO CATCHES!! NO GIMMICKS!! I'd like to offer you this UNBELEIVABLE FREE BUSINESS PACKAGE. This package includes, the Easiest, Most Rewarding, and Certainly Most Profitable, Home Based Business Opportunity available today. This package also includes the World Famous"Freedom", Bulk Email Software, which sells for $400.00 or more and I will provide it to you for "ABSOLUTELY FREE"! I am also including "CHECKER" another great software provided to you for FREE! A $200.00 value! Checker allows you to receive checks by fax, email, or phone!!! BIG, BIG BUSINESS BOOST! HOW IS THIS POSSIBLE? I am a member of TEL3, which provides low cost long distance service and will soon provide other VERY "CUTTING EDGE" SERVICES AT THE LOWEST OF RATES! To receive THE FREE "NETBIZ" MARKETING PACKAGE, INCLUDING THE "FREE' $400 FREEDOM SOFTWARE, and the $200.00 CHECKER Software all you need to do is become a member of my organization. AGAIN, RELAX, IT'S FREE! TEL3 will cost you nothing to join. Your phone bills go way down and disappear. Your earnings go up. All at 0 cost to you and your group. Even if your business is some kind of phone card program. Every one HAS TO HAVE a 1 plus dialed long distance carrier. Why not TEL3? After all, they are on track to become this Nations 4th largest telecommunications company. 9.9 Cents Per Min.Long Distance, FLAT RATE! 24 HRS PER DAY NO CATCHES!! NO REQUIREMENT TO REFER OTHERS!! With TEL3, not only do you get no-nonsense flat rates as low as 9.9 cents per minute, you also get a free 800/888 number with the same low rate, a no-surcharge, flat-rate calling card, billing with your local phone bill, and great international rates!, EVEN MORE! A Wonderful, Powerful Income Opportunity, PLUS A Wonderful, powerful income opportunity. "IF YOU DESIRE IT" Welcome to your very own "FREE INTERNET BUSINESS". Please take a look at something that cost you nothing, now or ever to join. I will not ask you for money to "SAVE MONEY", or to work! This is NOT the IRS! I do offer a great income, If you "CHOOSE" to share with those, {That Ask you to!} savings on long distance. Again, you or the people you refer never pay anything, at anytime to market or use TEL3 services. BUT you DO RECEIVE INCOME, if you CHOOSE to refer others, WHETHER THEY REFER OTHERS OR NOT! I have looked at and worked with many phone plans over the years. This is by far the best. You are about to become a part of the "ONLY GROUP IN THE ENTIRE WORLD" THAT HAS THE CAPABILITY TO GIVE THIS SUPER "$400" Bulk Mail SOFTWARE "ABSOLUTELY FREE" TO YOUR CURRENT AND FUTURE BUSINESS ASSOCIATES! PLUS NOW YOU RECEIVE THE NEW CHECKER SOFTWARE ALSO "FREE" A $200.00 VALUE! "Netbiz" was created by Dale Yancy to Provide marketing techniques and materials to guarantee anyone success in "Online Marketing". Included in the Netbiz Package among many things Is the Freedom Software, and the Checker software created by Bob Stratton, My Sponsor, who has authorized me to include the complete and fully operational Freedom Software and Checker Software Within My "NETBIZ" Package, EXCLUSIVELY for Members of my organization. We are a SUPER LOW COST Long distance provider you will have that Not only provides you with WONDERFUL LOW COST LONG DISTANCE, but also Provides you with your OWN BUSINESS FOR FREE! RELAX, IT'S FREE! You now have the opportunity to be a part of the only group "IN THE WORLD" to have such a complete and completely "FREE" INTERNET BUSINESS! YOUR BUSINESS IS ABOUT TO "EXPLODE"! I DO NOT ASK YOU FOR EVEN ONE THIN DIME! Not for "NETBIZ", Not for Freedom, not for Checker and Not for joining TEL3! Use Freedom and Checker in the business I provide for you, use Freedom and Checker in your current business. Use Freedom and Checker in a future business. It's Free! It is Yours. You earn constant income with TEL, just sharing the savings with others. There is No Cost to anyone to have these great rates. You Earn 2% of the paid phone bill through 8 levels of your organization. Plus, once your Level 1 billing is $2,500 or more, you receive 5% on Level 1. Levels 2 through 8 continue to pay out 2%. Plus much much more! "NETBIZ" provides you and your group with a complete business completely FREE! "NETBIZ" provides you with a $200.00 Software "Checker" for "FREE" that you can use in your other businesses to take checks by fax, email, and phone. Never miss another impulse sale for lack of a credit card or time lost in snail mail. "NETBIZ" provides you and your group a $400 software for "FREE" that allows you to retrieve email addresses from the internet. Then you can mail these people a "TEASER" letter that "NETBIZ" provides for free. "NETBIZ" provides you with the response letter to send back to your inquires after they respond to your ad. "NETBIZ" provides you with a free web page. "NETBIZ" provides you with the copy to place on your free web page. "NETBIZ" provides you with Thousands of places on the internet to place ads and Links for FREE. "NETBIZ" provides you with the ads to place on these thousands of locations. "NETBIZ" provides you with the response letter for all ad inquires. "NETBIZ" provides you with thousands of places to link with your web page. "NETBIZ" provides you with a great response letter to send to people that send you unsolicited email. This will get you great people that are already interested in marketing on the internet, and already are. They will bring large numbers of people with them. Best of all, Netbiz directs you to the "Autopilots" program, should you choose even faster and more automated business building at a very moderate price. START TODAY, FREE! All you need do now, is call TEL3 at 1-888-333-TEL3, Tell customer service you want to join TEL3 under Daniel Hait, ID# DH728893 and switch your long distance service. Then "Email me" with your Name, Address, Phone Number, E-mail address, and Your New ID# and request the Netbiz package and unlock code. I will send you your Netbiz package and your Freedom unlock code. A "Very Bright Future" Starts For You "TODAY"! YOU ARE "NOW" IN BUSINESS! That quick, that simple, that easy! I look forward to your success, Daniel B. Hait Integrity Enterprises, Ltd. Phone: (414) 669-3722 E-mail: freebiznis(a)juno.com Netel ID# DH728893 PS: A PERSONAL TESTIMONIALS I have signed up 16 people in as many days using this program! I have belonged to another telecom program and only 1 signup after 2 months. Giving away Free software that benifits the buisness is GREAT! Charles Blaisdell Within 1 hour of me mailing the above letter out to recepients, I had 3 people sign up for this business. Within 4 days I had 8 people sign up. By the end of the week I had 14 people on my 1st level and 3 on my second. I didn't have to have any personal contact with them whatsoever. I'm at the end of my second week and I have over 25 people. TEL3 Did it all! Daniel Hait PSS: I am providing a secret site to all in my downline that has links to over 1,600 places to advertise for FREE! PPSS: As a final added bonus, you will receive the URL address containing over 50 MILLION email addresses!! HOW CAN ANYONE PASS UP AN OPPORTUNITY LIKE THIS????

1 0

Re: Entropy vs Random Bits
by David Van Wie 17 Dec '03

17 Dec '03

>Your use of the word random is incorrect: The throw of a dice is >random, but only contains 2.6 bits of entropy. The throw isn't random, the data read from the die after it is thrown is random. The use of the term in many of the postings I have read indicate the need for an "unpredictable" quantity in most cases. This quantity may be drawn from a source that has entropy, but it is random. >> why invent new terms? Why use them to mean at least two different things? >This is old term of the art, a term of information theory: We use >the same word because entropy in information theory has the same >measure as entropy in thermodynamics. > >In both cases the entropy, measured in bits, of an ensemble of >possible states is sum of - P(i) * lg[P(i)] over all the possible states. In thermodynamics, counting states in this fashion is a dicey proposition, but I appreciate the clarification. Still, it seems to me that the property "bits of entropy" is often substituted for the actual "bits of random data" and is just as puzzling as gathering the "entropy of cool steam"! One can't _do_ anything with a dimensionless measurement. By which I mean, the measure of a property of data is not the data itself, so it still seems like the usage is odd, at times. However, your explanation does address some of the phrases I have seen. Does this mean that entropy is conserved in information theory? dvw

1 0

Net Papa: Global Internet Taxes Inevitable
by Robert Hettinga 17 Dec '03

17 Dec '03

The other shoe just stepped on a banana peel... Cheers, Bob Hettinga --- begin forwarded text Date: Tue, 9 Sep 1997 19:57:48 +0200 (MET DST) To: dcsb(a)ai.mit.edu, cypherpunks(a)cyberpass.net Subject: Net Papa: Global Internet Taxes Inevitable From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited X-001: Replay may or may not approve of the content of this posting X-002: Report misuse of this automated service to <abuse(a)replay.com> X-URL: http://www.replay.com/remailer/ Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: nobody(a)REPLAY.COM (Anonymous) (09/09/97; 12:00 p.m. EDT) By Douglas Hayward, TechWire GENEVA -- Internet taxes are inevitable, according to the man dubbed the "Father of the Net." The only way to avoid global chaos is to create an international agreement on how to do it, added Vint Cerf at a meeting of the Internet Society here. Cerf co-developed the TCP/IP[LINK] protocol on which all Web and Net transaction depend. ...Taxation of the Internet, also called "bit taxes," must be well planned, Cerf said. "And it must also be thought through on a global scale -- not parochially," he said. In the United States. alone, there are 30,000 taxing authorities that might be interested in taxing transactions on the Internet, said Cerf, adding that right now, there is no way to determine which of those authorities should have jurisdiction over a particular transaction. ..."If something is becoming an infrastructure that is important for people's daily lives, then governments will have the right to be concerned about the public's safety and well-being," Cerf said. "When you build roads, you make rules about how people are to behave on these roads, in order to protect people." TW http://192.215.107.71/wire/news/1997/09/0909tax.html For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

4 3

Re: Please send me SSL problems...
by Erik E. Fair 17 Dec '03

17 Dec '03

> I'd just like to let all cypherpunks know that I'm really interested in >getting any feedback you might have about security problems with Netscape >products. I'm particularly interested in bugs in the our implementation >of SSL, and problems in the protocol that are not addressed in SSL 3.0. > > We have been collecting comments on SSL 3.0, and have started incorporating >that feedback into our spec. Please don't assume that our lack of response >means that we are ignoring your comments. Between Navigator 2.0 and >things like the SSL challenge and the RNG fire drill, we just have not had >the time to get a new rev of the spec out. Hopefully soon... Jeff, the SSL specification has a severe *architectural* problem - it assumes that Internet Protocols are APIs - interface standards, and that you can just slide a "layer" underneath without anyone noticing. Such is not the case - all the Internet Protocols are real protocol standards, in that they specify the syntax, order, and semantics of the actual bits on the wire. The IETF quite explicitly doesn't care about APIs - that's a host software issue, and it doesn't matter what the host software looks like (or even what the machine looks like), so long as it gets the bits on the wire right, according to the protocol spec. This is how the Internet can make very strong guarantees about interoperability. You can't fiddle with a communication protocol without getting agreement from everyone about the change, or extend it in a way that is compatible with the protocol you're modifying, on a per-protocol basis (e.g. adding a TELNET negotiation option to TELNET for encryption, an FTP command to FTP, etc). Otherwise, all you've done is made a private, non-interoperable change to an existing protocol that guarantees interoperability *failures* between systems that implement the existing specification, versus your own version of HTTP, or TELNET, or whatever. In short, the SSL specification, as written, proposes to change all Internet application protocols, globally - "slide in a layer." That's not how it's done, and it's not the right place to do it, even if it appears to work in an enclave of systems. About the SSL protocol, encryption algorithms, or the SQA that went into 'em, I think other people have expounded on those issues eloquently, and so I have nothing to add to that. Erik Fair

4 4

Re: Please send me SSL problems...
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <9509210118.ZM154@tofuhut>, jsw(a)netscape.com (Jeff Weinstein) writes: > I don't think that the API that SSLRef export is not particularly interesting. Yikes!! I can't believe I wrote that. What I meant was: I don't think that the API that SSLRef exports is particularly interesting. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

USACM APPLAUDS CALIFORNIA LEGISLATURE
by ACM US Public Policy Office 17 Dec '03

17 Dec '03

PRESS RELEASE Association for Computing U.S. Public Policy Office September 8, 1997 USACM APPLAUDS CALIFORNIA LEGISLATURE FOR UNANIMOUSLY ENDORSING RELAXED EXPORT CONTROLS ON ENCRYPTION As the Congress prepares to address the issue of computer security and privacy, the California legislature has sent a clear message that relaxing controls on cryptography is a critical first step. On September 5, the California legislature passed a resolution that calls on the California members in Congress to support legislation that would make it easier for US companies to develop and market strong cryptography products. The resolution was sponsored by Representative Vasconcellos (D. San Jose) and passed without opposition. Dr. Barbara Simons, chair of the policy committee for the Association for Computing (USACM), said that the California resolution makes clear that industry and users are united in support of good cryptography. "We believe that Congress should support the Security and Freedom Act, sponsored by Representative Goodlatte. The legislation will help protect security and privacy on the internet. It will be a serious mistake for the administration to oppose the development of this technology," said Dr. Simons. On August 26, USACM Chair Barbara Simons spoke in support of the Vasconcellos resolution before a California Senate committee. Also participating at the Committee hearing were Dr. Whit Diffie from Sun, Kelly Blough from PGP, Jack Wilson of ACL Datacom, Chuck Marson representing the California Internet Industry Alliance (Netscape, Microsoft, AOL, CompuServe and Netcom), and a representative of the Software Publishers Association. Undersecretary of Commerce Reinsch wrote a letter opposing the resolution. The Association for Computing (ACM) is an international non-profit educational and scientific society with 76,000 members worldwide, 60,000 of whom reside in the U.S. USACM, the Association for Computing's U.S. Public Policy Office, serves as the focal point for ACM's interaction with U.S. government organizations, the computing community and the U.S. public in all matters of U.S. public policy related to information technology. The USACM web site is located at http://www.acm.org/usacm/ For more information, please contact USACM Chair Barbara Simons at 408/256-3661 or USACM Associate Director Lauren Gelman at 202/544-4859. /\ /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Association for Computing, + http://www.acm.org/usacm/ Office of U.S. Public Policy * +1 202 544 4859 (tel) 666 Pennsylvania Ave., SE Suite 302 B * +1 202 547 5482 (fax) Washington, DC 20003 USA + gelman(a)acm.org To subscribe to the ACM Washington Update, send e-mail to: listserv(a)acm.org with "subscribe WASHINGTON-UPDATE name" (no quotes) in the body of the message.

1 0

What's with the list? (Ol
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

DM|Anyone else get old c'punks postings remailed to them from August? Yup. Blech. furi(a)the-matrix.com pgp-public-key(a)demon.co.uk C1225CE1 RADical 1 Systems - Multi-Platform Custom Programming, Service, & Support

1 0