December 2003 - cypherpunks-legacy

Re: Netscape question transformed
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:12 PM 10/13/95 -0700, jsw wrote: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so >> hackers have time to find bugs before the full version is released. Don't >> take me wrong I have only been on the net fer a little over a year and Love >> Netscape. And If I knew what I was Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the >company, it is virtually impossible to get complete testing coverage. >Given the incredible variety of machines, OS's, peripherals, etc. >that are available in the real world, there is no way we could >re-create every possible configuration in the lab. I think that the main reason people have problems with the testing offer on the beta is the lack of responses to bugs in the past. I have seen many complaints from people on the net complaining that bugs they had reported in .90 had continued on into new and continued versions. That if they recieved a message back from Netscape it was just an infobot, and a rather hostilly worded one at that. (The infobot has been lightened up a great deal.) Netscape has never had the staff to properly respond to the mail volume they have recieved. They have been trying to improve this but it is difficult to man such a project with people who are able to sort through the piles of dreck to find those people reporting serious problems. (Also, the bug rewards are only for "serious bugs". Who defines what is serious and what is not. I know of a couple that have been hanging around for a couple of versions now. Maybe I should test if they got fixed with 2.0b1. Probibly not. They only hit a handful of people.) Netscape is still a pretty new company. Some seem to forget that .90 was only released about a year ago. How long does it take to get a proper QC department in place? (After the shakeup in February(?) when the new President was hired, I would have thought it would have been done then. Now I am not so sure...) I know of at least one product that went out the door in recient months that was not properly tested. (The stack and dialer used with Netscape PE comes to mind.) I realize that sales sometimes forces things to be released before its time, but there has to be some basic controls for quality control. (I will not mention some of the bigger gaffes with 1.0 and 1.1 since not all of those were publicized. A few simple things could have caught them before they went out the door.) I want to see Netscape succeed, but when you hear about things like product being released on the net without warning those people responsible for supporting it, bug reports being ignored so a ship date can be made, and the like, it makes you really wonder. I am finding problems with 2.0b1 that could have been found just by using the product for a couple of days! Most of the problems I have seen with Netscape could be solved with better communications between departments within the company and some strong testing procedures. > We also can't visit every web page, or think of every combination >of features that clever people in the real world come up with every >day. Somethings are real simple. Things like giving it to a handful of people and letting them use it for a couple of days before you release it to the rest of the world. 90% of the bugs will be pointed out through having someone beat on it as they would any other peice of software. And those people should be someone other than the programmers. (Sometimes you get too close to the code to really stress it properly.) I agree that you need to have a beta program. Not everything can be tested. But QC is important. This is not Uncle Jim's pet project anymore... All of this has been brought up on the net before. Sometimes it seems like the responses are more defensive than trying to find out the real problems and fix them. So far, you have been one of the few who has pushed for getting some of these things fixed in a timely manner. (I can name a few others as well. They seem to get burned out after a while though...) I think my biggest questions right now are: "Is there a formal testing procedure for product that is about to go out the door? Is there a real QC department and do they have the power to stop releases if significant problems are found?" | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

[URGENT] Where are we meeting today?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, I spaced the announcement and I can't find it in the archive. Somewhere at Sun... Would someone please forward me the original post? TIA, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMH/+ACoZzwIn1bdtAQGkrgF+JqKcgWrM4VFYaQGbmR6gCg5SBzQe5Php Qv9OxqnfcFFgbs6ZzzMkf+IietdzliuI =SZst -----END PGP SIGNATURE-----

1 0

mental cryptography
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As we know, security is always relative to a threat model. For example, most cryptographic protocols today will not protect their users against the cloning attack I described earlier, nor more mundanely, against video surveilence of your computing space. What can you do if you ARE worried about such attacks? The answer is doing cryptography in your head. Well not quite, since many cryptographic operations are very computing intensive, and not everyone can do 1000 bit mental modular exponention in a reasonable amount of time. But if you have a piece of secure hardware that you can trust to do some of these operations for you, then all you need is a secure communications channel to this piece of hardware. There may be other ways, but I suggest that you establish a common key with your crypto server ahead of time, and then simply encrypt all your communications using a symmetric algorithm. RC4 may be a reasonable choice, since the operations are simple and easy to remember, but you need to keep track of a 255-byte state. WAKE is probably better. Although it uses a large key table, you only have to memorize it once, after which the only state that is changing is four 32-bit registers. I am sure better algorithms can be found for this purpose if mental cryptography is made explicit as a design goal. Perhaps it should be? - the Mad Scientist in the Middle -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMH7l+9IjPOsOWLIJAQEwDwP7BB6ZlEoYVoOFYtzNDcF4XpCKs71GyASC TiwCf+donWycN9SiJHApyXXbnuppGiEyAQYMBGkSLMyIwPMcE4v6CSt2DkpbPjkF XauZy4rqDNljV2pk7PldbPOHDow9wOeoSF2S/luKAoHx5aJWVQrE5SKIgwY2xWfx DYhjte2v9Jc= =88be -----END PGP SIGNATURE-----

5 8

Re: Netscape rewards are an insult
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

Dr. Frederick B. Cohen writes in part: >The idea that Netscape (like Microsoft) thinks they can >get free testing services from all over the net by real >experts just by offerring a tee shirt is down right >offensive. > Ditto. The next major hack of Netscape will likely be used to bring that company to its knees. Unless one assumes that obvious backdoors will still be unprotected by their new code, a lot of computing time for brute force attacks and algorithm development will have to be spent to properly crack Netscape again. I seriously doubt the successful individuals will merely settle for fame and not fortune this time around. OTOH I would much rather see MS get hacked next. If the rumors of MS being a Hard Drive Peeping Tom are true, then I wonder if there might be a way to send a byte bomb to their bit bucket??....... Be Well

1 0

Re: [URGENT] Where are we meeting today?
by cman＠communities.com 17 Dec '03

17 Dec '03

Place: Sparcy's cafeteria, building 21, Sun Microsystems Mountain View, California Directions: Take 101 to Amphitheater Parkway. Turn left onto Garcia, and drive about 1/2 mile and turn onto the first genuine side street which is named Marina Way. Drive about 1/4 mile and look for a right hand turn onto Coast. Building 21 will be on your left. It's on the corner of Coast and Marina Way. There's plenty of parking there.

1 0

DSS patent license
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>>> RSA Data Security, Inc. >>> today announced that it is now licensing patents for the Digital Signature >>> Standard (DSS), the U.S. government standard for digital signatures. >> >> I believe someone was suing the U.S. government on the grounds that the >> public signature standard wasn't supposed to require proprietary >> technology. Has this gone anywhere yet? >> >> -- >> Eli Brandt >> eli+(a)cs.cmu.edu Yes, I had such a lawsuit. No, it didn't go anywhere in the courts, but the feds did eventually cave in to the principal demand of my suit: That the DSA patent be made available to anyone on a royalty-free basis. So how is it that RSADSI and Cylink/CKC claim you need licenses to their patents to use DSS? Because they have other patents. I have another lawsuit directed at those patents. Stay tuned. Roger Schlafly rschlafly(a)attmail.com

1 0

Netscape question transformed
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

I would like to rephrase the question I had yesterday was completely misunderstood. The point I was meaning to make was soppuse to be as follows: Why would a compony like Netscape jeapordise themselves by even letting out a beta version so hackers have time to find bugs before the full version is released. Don't take me wrong I have only been on the net fer a little over a year and Love Netscape. And If I knew what I was Doing I would love to help them..... Anyway I don't mean to waste your time, but arent these kinda things for stating your opinion? And to clarify any questions on my age I am 13 and was born in 1982.ok? thanks.....And I would again like to thank perry for understanding what level Im on. I will try my best not to annoy you or cause you any inconvenience. And to sameer I am sorry for what I said but you have to understyand Why I said it...... Sincerely, CyberPunc X

5 4

Top Math & Physics Sites (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Yes, indeed the PA law is for real!
by Tom Edwards 17 Dec '03

17 Dec '03

Well folks, you can go view the new PA law yourselves at URL http://moose.erie.net/~italo/rssb655.html PA Senate Bill 655 was signed into law on June 13, 1995, and it does appear to make non-logged anonymous remailers illegal. -Thomas

3 2

ESP_ion
by John Young 17 Dec '03

17 Dec '03

Simone has provided a copy of the LA Times July 23 report on the CIA's economic espionage. ESP_ion (10 kb)

1 0