December 2003 - cypherpunks-legacy

Re: Welcome to cypherpunks
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > Why am I getting this when I am already subscribed to the list?????? > Because someone signed the list up to the list...probably inadvertently. They probably sent something to majordomo with a line like: subscribe cypherpunks cypherpunks(a)toad.com thinking it actually made sense for some reason...then again they might have done it on purpose. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

HTTP Request-Header & Server Environment Echoes
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

<HTML> <HEAD> <TITLE>What Your Browser Says Behind Your Back</TITLE> </HEAD> <BODY> <PRE><TT> The what your browser told me about you when you weren't looking echo CGI at UIUC mentioned on cypherpunks (http://www.hks.net/cpunks/ cpunks-9/0095.html) in Nov. 1994 seems to be down for the count (it was http://www.uiuc.edu/cgi-bin/printenv )). It would provide you with a page showing the information your browser had given to the server in the HTTP Request-Header. However, others exist to take up the slack. Here's a directory I compiled today (thanks to WWWW, Lycos, etc.) of current, working HTTP Request-Header and resulting server environment variable echoes. I'm sure I've missed some, if not many. Follow up with additions, if you want. Better yet, add these and the additions to your favorite privacy and security pages. HTTP Request-Header Echoes Machine Information at MIT (http://www.mit.edu:8001/machine) Feeds back your machine name, IP address, and finger info. Not really a request-header echo at all, but useful. Echo at TU-Berlin (http://www.cs.tu-berlin.de/sui/eserte/cgi-rcs/home/ eserte/.public_html/index.html Raw text echo of your HTTP request-header info. Echo by Pierre Omidyar at best.com (http://www.best.com/~pierre/printenv. cgi) and at ebay.com (http://www.ebay.com/printenv.cgi) Two paths for reaching the same CGI script. Produces nicely formatted HTML output showing your HTTP request-header info. Simple perl source for the script is available from Pierre's Web Tips (http://www.best. com/~pierre/web-authoring.html) page. Echo by mjd at cis.upenn.edu (http://www.cis.upenn.edu/cgi-bin/mjd/ printenv) Produces formatted HTML echo of your HTTP request-header info. Echo at hyperreal.com (http://www.hyperreal.com/cgi-bin/printenv) Produces plaintext HTML echo of your HTTP request-header info. Echo at Whithead Institute--MIT (http://www-genome.wi.mit.edu/WWW/ examples/Ch9/printenv.pl Produces formatted HTML echo of your HTTP request-header info. Simple perl source for this script is available in the Chapter 9 script examples (http://www-genome.wi.mit.edu/WWW/examples/Ch9/) from Lincoln Stein (http://www-genome.wi.mit.edu/~lstein/)'s book, How to Set Up And Maintain a World Wide Web Site (http://www-genome.wi.mit. edu/WWW/). Echo by cloos at io.com (http://www.io.com/cgi-user/cloos/environment) Raw text echo of your HTTP request-header info. Also provides a whole bunch more, including the script's runtime environment. And now, again in the original HTML: </TT></PRE> The <CENTER>what your browser told me about you when you weren't looking</CENTER> echo CGI at UIUC <A HREF="http://www.hks.net/cpunks/cpunks-9/0095.html">mentioned on cypherpunks</A> in Nov. 1994 seems to be down for the count (it was http://www.uiuc.edu/cgi-bin/printenv) It would provide you with a page showing the information your browser had given to the server in the HTTP Request-Header. However, others exist to take up the slack. Here's a directory I compiled today (thanks to WWWW, Lycos, etc.) of current, working HTTP Request-Header and resulting server environment variable echoes. I'm sure I've missed some, if not many. Follow up with additions, if you want. Better yet, add these and the additions to your favorite privacy and security pages. <H3>HTTP Request-Header Echoes</H3> <DL> <DT>Machine Information at MIT <DD>Feeds back your machine name, IP address, and finger info. Not really a request-header echo at all, but useful. <DT><A HREF="http://www.cs.tu-berlin.de/sui/eserte/cgi-rcs/home/eserte/.public_html/inde…">Echo at TU-Berlin</A> <DD>Raw text echo of your HTTP request-header info. <DT><A HREF="http://www.best.com/~pierre/printenv.cgi">Echo by Pierre Omidyar at best.com</A> and at ebay.com <DD>Two paths for reaching the same CGI script. Produces nicely formatted HTML output showing your HTTP request-header info. Simple perl source for the script is available from <A HREF="http://www.best.com/~pierre/web-authoring.html">Pierre's Web Tips</A> page. <DT><A HREF="http://www.cis.upenn.edu/cgi-bin/mjd/printenv">Echo by mjd at cis.upenn.edu</A> <DD>Produces formatted HTML echo of your HTTP request-header info. <DT>Echo at hyperreal.com <DD>Produces plaintext HTML echo of your HTTP request-header info. <DT><A HREF="http://www-genome.wi.mit.edu/WWW/examples/Ch9/printenv.pl">Echo at Whithead Institute--MIT</A> <DD>Produces formatted HTML echo of your HTTP request-header info. Simple perl source for this script is available in the <A HREF="http://www-genome.wi.mit.edu/WWW/examples/Ch9/">Chapter 9 script examples</A> from <A HREF="http://www-genome.wi.mit.edu/~lstein/">Lincoln Stein</A>'s book, <CITE><A HREF="http://www-genome.wi.mit.edu/WWW/">How to Set Up And Maintain a World Wide Web Site</A></CITE>. <DT><A HREF="http://www.io.com/cgi-user/cloos/environment">Echo by cloos at io.com</A> <DD>Raw text echo of your HTTP request-header info. Also provides a whole bunch more, including the script's runtime environment. </DL> </BODY> </HTML>

3 2

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks cypher(a)infinity.nus.sg Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks cypher(a)infinity.nus.sg Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Re: Anonymity: A Modest Proposal
by loki＠obscura.com 17 Dec '03

17 Dec '03

>Lance Cottrell writes: >> If all nym servers were standardized to run from the same account name >> (nymserve for example) the remailers could be configured to only deliver >> final hops to addresses with that username. > >A detail I missed before: the remailers used in pseudonym reply blocks must >somehow deliver replies to the True Name (verinymous ?) address of the holder >of the pseudonym. I suppose they could all finally be routed to the >pseudonymizer, which would deliver the messages directly to the intended >recipient (holder of the pseudonym). > >-Futplex <futplex(a)pseudonym.com> They could also end up getting dumped in a message pool. Perhaps all (or most) nym servers could operate mailing list message pools. Anyone could subscribe to the pool, and any nym could have its mail directed to that pool. It should not be too difficult to rig a procmail script to try to decrypt all mail from that list, and deliver those that could be decrypted. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Anonymity: A Modest Proposal
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- How open is the protocol? Is there and API for it? Does anyone know how big the coins are? There will have to be room for one per header in Mixmaster. Do they vary in size, or are all coins identical? There is so much stuff to try to keep track of all at once! :/ -Lance (going down in a blaze of questions) Cottrell At 5:20 PM 10/23/95, sameer wrote: > With the release of digicash I hope that we can soon make this >stuff for-pay and much of the spam problem will be fixed. (Not all of >it, of course.) > (I am rather hesitatnt to setup an account with Mark Twain >though.. $2,500 min balance and not FDIC insured?) > > <SNIP> -Lance -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMI8m5fPzr81BVjMVAQFXUAgAxNhdCxBCRJPLfbgIihe3OLjmnlggfjIQ lgNIf50DoGtiighGMCzvFYRChqYCJfhZKLJOp1uTOtqe6v/y7ybNk4tTUFR9DWwV HKO0orhdlUuaxBIm4QXtKBGjHa5effgelWfUuKrwt7Bd4x+SF7fY7MEq549Ujbz1 J+DoRnjadeoHYbZYQ7TlCbiuEofuvVZfTWgkBIx1rbQgYxF7Hr8sHlP+TnVcGSv9 NkHvkwbd7ZQ8hMmIvGQtWAXQjeNmCQpd4ZJO82Fb9pw11RADVL8JfFO9ru6sbyOU /b1lIvB38APSRA4Ova6I9mmiHAjQPegZKuTgtAM7TDy3vJXRxGNS+Q== =7BTM -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

3 2

[Noise] Paranoia in the Comics
by Alan Olsen 17 Dec '03

17 Dec '03

This has no real crypto relevence, but some anarchistic relevence. Sometimes you find anti-government paranoia in the strangest of places... In the Ziggy strip for 10/25/95, Ziggy is in a Psychiatrist's office. The shrink is stating "You're afraid of the government, are you? I'm required to report that sort of thing you know." You can tell the state of distrust of the state when you see such things in a generally bland and spineless strip like Ziggy. What next? Little Billy from Family Circus bringing home a copy of the Anarchists Cookbook? Charlie Brown getting his phone tapped by Louie Freeh? Garfield joining the EFF? The mind boggles... | Visualize a world without lawyers! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Re: CJR returned to sender
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 11:30 PM 10/25/95, Jeff Weinstein wrote: > Should they also reject the same content (RSA-PERL) delivered >in any of the following ways: > > Printed on paper > Printed on paper in OCR font > Printed on paper in barcode > Printed on paper with magnetic ink (like checks) > > The lines being drawn here seem very arbitrary. FWIW, in principle I agree with Michael and Tim: 90% of the point of the lark was the absurdity of a T-shirt being a "munition." OTOH, the arbitrariness of ITAR enforcement--regardless of the form of the CJRs filed--is very troubling. When the USG so selectively enforces federal law, one has to wonder what criterion is informing the selection. And this "little" adventure could (IANAL, etc.) have a bright side: if the CJR were submitted in a verifiable way (courier, certified, etc.) and the agency in question had documentably refused to examine the materials submitted or to take the application seriously, wouldn't this weaken any subsequent effort to prosecute in another, more practical case involving the same code? If so, maybe something halfway between a T-shirt and a book--y'all can figure out what--encoded with machine-readable source for PGP might be in order. In order not for some silly thread but, rather, for a meticulously documented CJR, with an eye toward slowly upping the ante: submit the exact same code in a variety of less and less absurd formats until the USG chooses to deal with it--all the while presuming that their failure to consider a CJR in this or that format constituted a de facto approval for export. ted

1 0

Bill Gates on anonymity
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

BEGIN QUOTE I'm not suggesting we do away with all forms of anonymity. I can imagine electronic communities where anything goes and no one can trace the real origin of information - or verify its authenticity. You would enter such a community - by deciding to read or watch the information posted there - at your own risk, and if people said offensive or untrue things to you, your only recourse would be to set the record straight in the same forum. Consenting adults should be entitled to participate in this kind of community. But kids certainly should not. END QUOTE The full text is at http://nytsyn.com/live/Gates/270_092795_082520_2997.html

1 0

Linux security issues
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

Has anyone heard of any information on the Linux swap partition, for example, if it does me the favor of storing my pgp passphrase? Anyone who's interested in compiling PGP under ELF, add ASMDEF="-DSYSV" to the end of their linux make line. Don

2 1