December 2003 - cypherpunks-legacy

it could be worse
by Carl Ellison 17 Dec '03

17 Dec '03

``According to the former head of Romania's secret police, Ion Mihai Pacepa, there had been ten million microphones in a country of twenty-three million people. That would mean that nearly everyone had been listened to and then blackmailed into listening and reporting on others. A maze of psychic tunnels led from one person to another.'' [Andrei Codrescu, "The Hole In The Flag", pp. 21-22]

1 0

Re: toolkits?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:41 AM 11/7/95, Stephen Whitaker wrote: >OK folks, nobody seems to have any ideas how to keep our little state of >Vermont from falling prey to mediocrity in the internet. I thought with so >many highly opinionated people I would at least get a few good or at least >entertaining suggestions. You may have gotten no responses because it generally is not up to a state government to ensure that "mediocrity" in the Internet is avoided (though I'm not sure what is meant by "mediocrity." If it is security and anonymity, this is definitely the state government's responsibility, or even area of interest.) >just might have a prayer of doing it right, whatever that is. What would it >look like if secure communications and anonomynity were designed in from the >start? Is this what Sameer is doing in Bezerkeley? > >What machines are considered minimum requirements to use these tools? What >are the essential reference works? "Security and anonymity" are not matters for government to ensure. Imagine two Vermont residents, Bob of Burlington and Rhonda of Rutland. The wish to communicate securely, and perhaps anonymously. Alas, the state legislature in Montpelier is oblivious to their concerns, not even answering their e-mail. What, oh what, are they to do? Not to worry, as what Vermont does is irrelevant. Bob of Burlington can encrypt his messages to Rhonda of Rutland and send them in any number of ways. Compuserve, AOL, and (probably) Netcom will have local access points. Happily, Rhonda of Rutland and Bob of Burlington (not their real names) can communicate secretly, securely, and anonymously. I urge you, Stephen, to read up on encryption and the benefits contained therein. Looking to your state capital to secure your communications is a lose. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: censored? corrected [Steve Pizzo cited in The Spotlight]
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 08:06 AM 11/6/95 -0600, Stan Drescher wrote: >shields(a)tembel.org (Michael Shields) said: > >MS> If the InterNIC yanked your domain, this would *not* affect your IP >MS> connectivity -- your ability to be reached by any Internet protocol >MS> via IP address. The InterNIC has nothing at all to do with that. > > I never disputed that subverting the DNS system would affect the >ability to use numeric IP addresses, just IP names.<snip> There has been a thought that's been in the back of my mind while reading this thread. For example, at one time, the telephone companies used "names" such as Klick 5-1234. Later, they went to all numbers, i.e., 555-1234. People balked, but they eventually got used to it. There are other examples not necessary to list here. If, however, the growth continues with people, not only accessing the net, but getting domain names - doesn't it seem likely that, at some point, only IP addresses will be left (or dumb domain names like http://www.stkdlcp.com)? Ergo, what is the problem with having a numerical URL? After all, some people's URL's (in name form) are not the easiest to remember. In the long run, numbers may be easier to remember. Just think of how many numbers (Soc. Sec. #'s; phone #'s; tax #'s, etc.) that we have committed to memory. Plus, one doesn't have to worry about InterNIC yanking your domain - and other related problems. Just my .02 cents worth.... ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

2 1

Java insecurity - long - argumentative - you are warned.
by fc＠all.net 17 Dec '03

17 Dec '03

WARNING - THIS MESSAGE CONTAINS INFORMATION THAT MIGHT BE CONSIDERED AS A FLAME BY SOME READERS - IT IS LONG AND TEDIOUS - YOU ARE WARNED! >From the Java Web pages (as combined in Firewalls/BoS): > The language's security features (not just applets): > > (http://java.sun.com/whitePaper/javawhitepaper_6.html#HEADING15) > > 4.2 Security in the Java Environment > > Security commands a high premium in the growing use of the Internet > for products and services ranging from electronic distribution of > software and multimedia content, to "digital cash". The area of > security with which we're concerned here is how the Java compiler and > run-time system restrict application programmers from creating > subversive code. But not non-subversive code? Sounds like a value judgement to me. Subversive code is not otherwise defined in these documents. > The Java language compiler and run-time system implement several > layers of defense against potentially incorrect code. Is incorrect code subversive? Vica versa? Does Java provide defenses against my code not properly calculating numbers? > One of the Java > compiler's primary lines of defense is its memory allocation and > reference model. Simply put, Java does not have "pointers" in the > traditional C and C++ sense--memory cells that contain the addresses > of other memory cells. > > Memory layout decisions are not made by the compiler, as they are in C > and C++. Rather, memory layout is deferred to run-time, and will > potentially differ depending on the characteristics of the hardware > and software platforms on which the Java language system is > executing. The Java interpreter references memory via symbolic > "handles" that are resolved to real memory addresses at run time. Java > programmers can't forge pointers to memory, because the memory > allocation and referencing model is completely opaque to the > programmer and controlled entirely by the underlying run-time system. Just because it is opaque, doesn't mean you can't happen across a valid (but perhaps undesirable) handle. Sounds like a good issue for attack by crypto-types. How do we guess the handle of the disk IO routines? > Very late binding of structures to memory means that programmers can't > infer the physical memory layout of a class by looking at its > declaration. By removing the C/C++ memory layout and pointer models, > the Java language has eliminated the programmer's ability to get > behind the scenes and manufacture pointers to memory. These features > must be viewed as positive benefits rather than a restriction on the > programmer, because they ultimately lead to more reliable and secure > applications. Is the language un-predictable? The same program executes differently each time? A pseudo-random allocation? What is the technique used to implement this, and why should we believe it is in fact secure in some sense. And if so, in what sense? > The Byte Code Verification Process > > What about the concept of a "hostile compiler"? Although the Java > compiler ensures that Java source code doesn't violate the safety > rules, What are these "safety rules"? No reference to them in this document! > when an application such as the HotJava web browser imports a > code fragment from anywhere, it doesn't actually know if code > fragments follow the Java language rules for safety--the code may not > have been produced by a known-to-be trustworthy Java compiler. In such > a case, how is the Java run-time system on your machine to trust the > incoming byte code stream? The answer is simple--it doesn't trust the > incoming code, but subjects it to byte code verification. > > The tests range from simple verification that the format of a code > fragment is correct, to passing through a simple theorem prover to > establish that the code fragment plays by the rules--that it doesn't > forge pointers, it doesn't violate access restrictions, and it > accesses objects as what they are (for example, that "InputStream" > objects are always used as "InputStreams" and never as anything > else). A language that is safe, plus run-time verification of > generated code, establishes a base set of guarantees that interfaces > cannot be violated. Wait a minute. If it's so safe, what code can possibly be sent in that would cause a violation? If the prover is so simple, how can it show things (e.g., program correctness) in real-time on a PC that the rest of the world can't show with supercomputers over extended periods? What EXACTLY are these things doing, and why should we believe they are safe? > The Byte Code Verifier > > The last phase of the byte code loader is the verifier. It traverses > the byte codes, constructs the type state information, and verifies > the types of the parameters to all the byte code instructions. > The illustration [see the HTML] shows the flow of data and control > from Java language source code through the Java compiler, to the byte > code verifier and hence on to the Java interpreter. The important > issue is that the Java class loader and the byte code verifier make no > assumptions about the primary source of the byte code stream--the code > may have come from the local system, or it may have travelled halfway > around the planet. The byte code verifier acts as a sort of > gatekeeper. The byte code verifier ensures that the code passed to the > Java interpreter is in a fit state to be executed and can run without > fear of breaking the Java interpreter. So there are byte code sequences that can break the interpreter! > Imported code is not allowed to > execute by any means until after it has passed the verifier's > tests. Once the verifier is done, a number of important properties are > known: > > There are no operand stack overflows or underflows Not so easily proven, is it? > The types of the parameters of all byte code instructions are > known to always be correct Huh? I thought you couldn't have incorrect types. Do they mean that you can have incorrect types but that they are detected by the verifier at load time? > No illegal data conversions are done, like converting integers > to pointers How about legal ones - like converting integers to pointers via case statements? > Object field accesses are known to be legal--private or public > or protected What exactly does this mean? > While all this checking appears excruciatingly detailed, by the time > the byte code verifier has done its work, the Java interpreter can > proceed knowing that the code will run securely. Knowing these > properties makes the Java interpreter much faster, because it doesn't > have to check anything. There are no operand type checks and no stack > overflow checks. The interpreter can thus function at full speed > without compromising reliability. Can computers actually "know" anything? No runtime checking whatsoever. Get past the supposed verifier, and you have free run of the machine. A single verifier bug or inadequacy, and the world is unsafe for electronic commerce. And has the Java code been verified to prove the claimed properties? Against what criteria? Where's the beef? > Security Checks in the Class Loader > > After incoming code has been vetted and determined clean by the byte > code verifier, the next line of defense is the Java class loader. The > environment seen by a thread of execution running Java byte codes can > be visualized as a set of classes partitioned into separate name > spaces. There is one name space for classes that come from the local > file system, and a separate name space for each network source. > > When a class is imported from across the network it is placed into the > private name space associated with its origin. When a class references > another class, it is first looked for in the name space for the local > system (built-in classes), then in the name space of the referencing > class. There is no way that an imported class can "spoof" a built-in > class. Built-in classes can never accidentally reference classes in > imported name spaces--they can only reference such classes > explicitly. Similarly, classes imported from different places are > separated from each other. But they can explicitly reference each other? I can only explicitly open a file called command.com on your PC? > Security in the Java Networking Package > > Java's networking package provides the interfaces to handle the > various network protocols (FTP, HTTP, Telnet, and so on). This is your > front line of defense at the network interface level. The networking > package can be set up with configurable levels of paranoia. You can: > > Disallow all network accesses > > Allow all network accesses > > Allow network accesses to only the hosts from which the code was > imported > > Allow network accesses only outside the firewall if the code > came from outside Who wants to bet that 99+% of all users configure "Allow all network accesses". Hot Java today is defaulted to this state. > Applet-specific security: (written for the 1.0a3 release of > HotJava(tm)... there will be a rewrite for the 1.0b release when that > occurs. I'm assuming, perhaps incorrectly, that the Netscape > implementation is similar. As I understand it, they licensed the HJ > code from Sun, so I think it's all very close to the truth.) > > (http://java.sun.com/1.0alpha3/doc/security/security.html) > > [ A rehash of the above text, snipped ] > > Security level four: protecting the file system and network access > > HotJava enforces security policies confident that its security > interfaces are secure. In other words, it assumes the other three levels worked properly. If they don't, you're screwed. > The three lower levels of security guarantee > that all local classes, e.g., the file access primitives, are > themselves protected from being supplanted, replaced, or extended by > imported code. You're screwed. > The file access primitives implement an access control list that > controls read and write access to files by imported code (or code > invoked by imported code). The defaults for these access control lists > are very restrictive[*]. If an attempt is made by a piece of imported > code to access a file to which access has not been granted, a dialog > box pops up to allow the user to decide whether or not to allow that > specific access. These security policies err on the conservative side > in order to ensure maximum security. This conservative approach may > make writing some applets more difficult or awkward. By default - ask the user. That's restrictive? Please press the OK button to have our free Lotus update loaded into your computer. > For network security, HotJava provides a variety of mechanisms that > can provide information about the trustworthiness of imported > code. These mechanisms cover a wide range of possibilities. At the > simple end the system can check on the origin of a code fragment to > determine if it came from inside or outside a firewall. At the > sophisticated end of the range a mechanism exists whereby public keys > and cryptographic message digests can be securely attached to code > fragments that not only identify who originated the code, but > guarantee its integrity as well. This latter mechanism will be > implemented in future releases. So today, if the admin specifies the proper IP address ranges when loading Java into each computer in the network, and if no user ever installs Java on their own, "code" downloads from external machines may be stopped - unless the user says OK. > The security policies implemented by the runtime system can be > dynamically adjusted based on the information available concerning the > origin of a code fragment. The Socket class provides such an example. > > The Socket class implements security policies that are adjusted to > reflect the trustworthiness of the code that invoked it, and > transitively, the code that invoked the invoker. The information about > what code began the chain of execution is available to the class in > the form of which namespace contains the invoking code and what > parameters are associated with that class. The class loader puts the > classes it has loaded in a specific namespace, allowing the Socket > class to determine the network host from which a class is loaded. > > Knowing the network host allows the HotJava security mechanism to > determine whether the class originated inside or outside a > firewall. Knowledgable users of HotJava can decide which category of > hosts to trust when loading executable code. How about the more than 99.99% of users who are not knowledgable of HotJava? > For example, the Socket > class can implement the policy of only allowing new connections to be > created that terminate at the host from whence the code was > loaded. This restriction means that code loaded from outside a > firewall cannot connect to other machines on the net behind the > firewall. Unless that machine acts as a gateway for further processing. > Code that comes from more trusted sources can be allowed > more freedom to make connections to other machines. As an additional > defense against untrusted sources HotJava's security can be set to > prevent any code from being loaded. The level of security is > configurable by HotJava users. The user dictates the security policy. Any user in your site can potentially, through error or omission or intent, open up a hole to your entire network by accidentally pressing the OK button one time or by setting a configuration parameter incorrectly. And your firewall will not save you. ASBESTOS SUITS MAY NOW BE REMOVED - FLAME OFF. P.S. When: Tuesday, November 7, 8AM Where: The Hilton, Washington D.C. (the CSI conference) The talk: 50 Ways to Attack Your World Wide Web Systems If you want a chance to heckle - be there. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 2

"The Policeman Inside"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:35 PM 11/5/95, Mats Bergstrom wrote: >Well, also in Sweden, but this is merely against tax money transfered to >the 'less fortunate' (or 'lazy', as you sometimes call them) and is very >little, if at all, connected to anti-surveillance. Cross-referencing >various databases would actually be good for catching those who receive, >for example, unemploment money while actually working full time (especially >common amongst Mediterranian and Middle East 'political' refugees - many >of whom like to come here and work for a handful of years, sometimes adding >a decade to their actual age so they can go home to a warm climate at 55 >to live as kings on their Swedish pensions). Isn't this a dilemma, also at >your home turf? FINCEN efficiency might save some of your tax dollars. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Mats' point is an important issue to think about. The "conservative" who wants to get the bums off welfare and keep his hard-earned kroners or francs may embrace a FinCEN-type computerized police state. In a system of extensive transfer payments, such "person number" tracking is needed to ensure that Citizen Units do not make double claims, do not retire before they have made their full productive contribution to the welfare of the herd, and so on. A "libertarian" would argue that when economic interactions are uncoerced, when there are few if any lay-abouts collecting food stamps, welfare, AFDC, WICC, generous pensions paid by taxpayers, etc., then the "need" for Citizen Unit identification vanishes. This actually has some crypto relevance, besides the obvious crypto anarchy connections. Nameley, parallels with "offline" and "online" clearing. A system in which pieces of paper and various promissory notes are transferred around as money, with later (offline) clearing, tends to require True Names. This so that defaulting parties can be tracked down and collected from. (And of course there are also tax issues, and regulatory issues, but I'm concentrating on the offline or deferred clearing issues that tend to make True Names and physical identities more important.) By contrast, a cash economy--online or immediate clearing--tends to not require identification. "Cash and carry," which has worked for millenia in diverse cultures which have no forms of identification. One pays in corn, or beads, or gold, and that's that. (There are, as Futplex noted I like to say, "lots of issues." We could discuss exceptions to this, such as contracts, age credentials, etc. But, generally, cash transactions tend to produce no compelling need for identification. This is the norm in most retail transactions, unless "checks" or other forms of deferred clearing payment are tendered.) The modern "identity state" is becoming consumed with the notion that everyone needs an index number. Not necessarily because the police want to compile dossiers on them (though this is a factor), but because of the focus on rules and regulations which affect _monetary flows based on identity_. In the U.S. for example, one used to just be able to pay someone to cut one's lawn in cash (or check, if he trusted you, blah blah) or babysit one's children. Now, under new crackdowns on social security laws, income tax estimated payment laws, hiring of undocumented workers laws, etc., this is technically no longer possible. One must, above some tiny threshold of payments, file various tax and social security forms, and take steps to ensure the worker is properly documented (*) (* Most white people in America have little "proof" that they are proper Citizen Units. This leads to uncomfortable situations where only brown- and yellow-skinned persons are asked to prove their identities and their Citizen Unit or Resident Unit status.) There is strong pressure on several fronts to establish a "National Identification Card." Others are opposed. My point, originally, to Rich Graves' mention of Chris Hibbert's excellent FAQ on Social Security Numbers and person numbers, is that it is no longer relevant to fight against a "single index number." Modern data base methods are so well-suited to cross-indexing that it hardly matters whether there's a single point of entry to the data base or not. THE KEY POINT IS THIS: Are voluntary economic transactions between persons to be subject to approval and regulation by the State? If babysitting and lawnmowing, not to mention hiring someone to write some C code, requires submitting tax and Social Security forms, requires checking the J-1 vs. Permanent Resident vs. Approved Citizen Unit status, then the die is cast. Ordinarily, or in earlier years, these rules might have been dismissed as trivial or as mostly ignorable. After all, so long as one is not planning to become Attorney General, who cares whether a housekeeper was "legal" or not? Who cares whether the detailed Social Security, IRS, and Immigration Control forms were filled out properly, or at all? Well, the State is becoming more efficient in tracking such things, and tax penalties are increasing. Further, bounties are being paid to those who inform on "tax cheats." Computerized records are being used to spot those with "apparent incomes" (= lifestyles) inconsistent with their tax filing status. Sure, part of this is to catch "double dippers," such as those collecting unemployment, welfare, AFDC, disability benefits while also doing work on the side. (There's a whole issue here of the laws about welfare recipients not being allowed to work, which I won't get into.) But the danger, and something that should inform our Cypherpunks discussions, is that these laws which are tied to one's status as a Person Unit in the system, inevitably require an extensive "identity tracking" regimen. The libertarian and anarcho-capitalist solution is not to increase the power of the surveillance state to detect fraud and non-compliance, but to roll things back to a more even keel. Even if one believes taxes are "the price paid for civilization," there are superior alternatives to the current system. (My current favorite is: mandatory slavery for X days per year, regardless of age or ability. Instead of taxes, everyone works one day in five, or 2 months out of the year, etc., for the herd. Building roads, picking up trash, administering computers, etc. There are "lots of issues," but even I agree this list is not the best place to discuss it; I mention it in passing.) In closing, we must beware "the policeman inside," to use the William Burroughs term. A surveillance state that arises because modern computers and data bases allow all economic transactions to be monitored, taxed, and approved or disapproved is a horror we should fight with all of our resources. Whether right-, left-, or libertarian-leaning, the implications of this state power to control our lives are horrible. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

FWD:Religious Right Threatens to Shut Down Net: Call NOW
by Lynne L. Harrison 17 Dec '03

17 Dec '03

>Return-Path: <ACLUNATL(a)aol.com> >Date: Mon, 6 Nov 1995 13:43:13 -0500 >From: ACLUNATL(a)aol.com >To: beeson(a)aclu.org >Subject: Religious Right Threatens to Shut Down Net: Call NOW >Content-Length: 27519 > >Here are the advocacy instructions for individuals opposed to the Federal >Online Indecency Legislation that we promised last week. > >======================================================================== > CAMPAIGN TO STOP THE EXON/COATS COMMUNICATIONS DECENCY ACT > (SEE THE LIST OF CAMPAIGN COALITION MEMBERS AT THE END) > > Update: -Latest News: > The Christian Coalition is pushing Congress to censor > the net more heavily than even Sen. J.J. Exon ever imagined. > There is the very real possibility that they may succeed. > > You should be very worried. We are. > > -What You Can Do Now: > Follow the directions below and call House Speaker > Gingrich and Senate Leader Dole. Implore them > to allow parents to make choices for their children, instead > of government censors. > > Volunteer to join the fight by helping organize in your > home town. > > CAMPAIGN TO STOP THE UNCONSTITUTIONAL COMMUNICATIONS DECENCY ACT > Nov 2, 1995 > > PLEASE WIDELY REDISTRIBUTE THIS DOCUMENT WITH THIS BANNER INTACT > REDISTRIBUTE ONLY UNTIL December 1, 1995 > REPRODUCE THIS ALERT ONLY IN RELEVANT FORUMS > >________________________________________________________________________ >CONTENTS > The Latest News > What You Can Do Now > The letter from Ed Meese and the Christian Right > Chronology of the CDA > For More Information > List Of Participating Organizations > >________________________________________________________________________ >THE LATEST NEWS > >Since the very first day that Senator J.J. Exon (D-NE) proposed censorship >legislation for the Internet, the Christian Right has pushed for the most >restrictive regulations they could think of. > >The Religious Right (which does not necessarily speak for all religious >people concerned with this issue) recently tipped their hand in a letter >to Sen. Larry Pressler (R-SD) and Rep. Thomas Bliley (R-VA) requesting >a new and more restrictive net censorship proposal. > >There are essentially three new dangerous elements of their campaign >to shut down cyberspace: > > >INTERNET PROVIDERS, ONLINE SERVICES, AND LIBRARIES CRIMINALLY LIABLE FOR > EXPRESSION ONLINE >The Religious Right has proposed to hold anyone who provides access to the >Internet or other interactive media, including online services providers, >ISP's, BBS's, Libraries, and Schools, criminally liable for all speech >carried on the network. > >In order to avoid liability under this provision, service providers would be >forced to monitor user's electronic communications to be assured that >no "indecent" material is transmitted across their networks. > >This proposal is MORE RESTRICTIVE than the Exon Communications Decency Act, >or any other net censorship legislation currently in Congress. > >In their letter to Congress, the Religious Right says: > > [Providers] would simply be required to avoid KNOWING violations of > the law. [emphasis added] > >However, the "knowing" standard is vague enough that the mere knowledge >that such material exists could be sufficient to trigger criminal liability. >A single complaint or even a news report could force a service provider to >take down a web page, remove posts to chat rooms or other discussion >forums, or shut down listservs in order to avoid going to jail and facing >huge fines. > > >A STANDARD FOR INDECENCY >The proposals pushed by the Christian Coalition relies on the >unconstitutional "indecency standard". Like the Exon Communications >Decency Act, the Christian Coalition seeks to regulate all indecent >speech online. > >Indecency is a broad category that includes everything from George Carlin's >"seven dirty words" to such classic novels and "The Catcher in the Rye" and >"Lady Chatterly's Lover". > >The Supreme Court has ruled that restrictions on indecent speech are >Constitutional only if they rely on the "least restrictive means". Broad >indecency restrictions on interactive media do not satisfy the "least >restrictive means" test, because interactive media allows users and >parents tremendous control over the information they receive. > >Any legislation which attempts to apply an indecency restriction to the >Internet is unconstitutional on its face. > >The Christian Coalition's proposal that relies on an indecency >restriction contemplates dumbing down every conversation, web page, >newsgroup, and mailing list on the Internet to the level of what is >not offensive to children. > >What kind of discussions between adults are possible in an arena >where everything has been reduced to the level of the Lion King? > > >UNPRECEDENTED CONTROL OVER ONLINE SPEECH FOR THE FCC >The Christian Coalition would give the FCC broad jurisdiction over >cyberspace. It would allow the FCC jurisdiction over your online >speech, and over the design Internet software, such as web browsers and >filtering programs that parents can use to control their children's >access to the Internet. > >The Internet has developed from a government project to a market-driven >economic boom for thousands of businesses. Giving the FCC authority over >this medium would significantly hinder the growth of this new industry. > >________________________________________________________________________ >WHAT YOU CAN DO NOW > >1. The proposals from the Religious Right will literally destroy online > speech as we know it. The odds of stopping this are not certain. > > There is a very real chance that this legislation will pass, and > we will experience a period of uncertainty and chilling of speech > while an appropriate test case attempts to reach the Supreme Court > (should it even get there!) > > The Religious Right has a strong grass-roots network. We need to > counter their energy and ensure cyberspace is not lost due to them. > > IMMEDIATELY CALL House Speaker Gingrich (R-GA) and Senate Leader > Dole (R-KS) and urge them to oppose the Christian Coalition's > proposal. > > Name, Address, and Party Phone Fax > ======================== ============== ============== > R GA Gingrich, Newt 1-202-225-4501 1-202-225-4656 > R KS Dole, Robert 1-202-224-6521 1-202-224-8952 > > If you're at a loss for words, try one of the following: > > Please oppose the recent proposal from the Religious Right to > censor the Internet. The only effective way to address children's > access to the Internet is through parental control tools outlined > by the Cox/White/Wyden approach. > or > As a religious person and a parent, I oppose the Religious Right's > attempts to censor the Internet. I am the best person to monitor > my child's access to the Internet using parental control tools > as outlined in the Cox/White/Wyden approach. > >2. Join the online fight by becoming a volunteer for your district! > > Check to see if you're legislator is in the list below. If they are > not, consult the free ZIPPER service that matches Zip Codes to > Congressional districts with about 85% accuracy at: > > URL:http://www.stardot.com/~lukeseem/zip.html > > The conference committee legislators are: > House: Barr (R-GA), Barton (R-TX), Berman (R-CA), Bliley (R-VA), > Boucher (D-VA), Brown (D-OH), Bryant (D-TX), Buyer (R-IN), > Conyers (D-MI), Dingell (D-MI), Eshoo (D-CA), Fields (R-TX), > Flanagan (R-IL), Frisa (R-NY), Gallegly (R-CA), Goodlatte (R-VA), > Gordon (D-TN), Hastert (R-IL), Hoke (R-OH), Hyde (R-IL), > Jackson-Lee (D-TX), Klug (R-WI), Lincoln (D-AR), Markey (D-MA), > Moorhead (R-CA), Oxley (R-OH), Paxon (R-NY), Rush (D-IL), > Schaefer (R-CO), Schroeder (D-CO), Scott (D-VA), Stearns (R-FL), > White (R-WA) > Senate: Burns (R-MT), Exon (D-NE), Ford (D-KY), Gorton (R-WA), > Hollings (D-SC), Inouye (D-HI), Lott (R-MS), McCain (R-AZ), > Pressler (R-SD), Rockefeller (D-WV), Stevens (R-AK) > > If your legislator is on the conference committee, you have a chance > to influence their vote on this issue with your power as a constituent. > Volunteer to help educate your legislator by sending mail to > volunteer(a)vtw.org. A coalition volunteer will be in touch with you. > > You can starting working to help spread the word in your district by > sending this letter to five friends. Ask them to call Dole and Gingrich > as well. > >3. The People for the American Way (PFAW) and the American Civil Liberties > Union are organizing a letter from ORGANIZATIONS to the Conference > Committee to oppose the censorship provisions. > > If you are a representative of an organization that would like to > signon to this letter, you should contact jlesser(a)pfaw.org IMMEDIATELY. > >4. We can't suggest relaxing at this point. The stakes are too high, and > the risk is too great. Everything now hangs in the balance. > >________________________________________________________________________ >THE LETTER FROM ED MEESE AND THE CHRISTIAN RIGHT > >October 16, 1995 > >The Honorable Thomas J. Bliley, Jr. Chairman >Committee on Commerce >United States House of Representatives >Washington, DC 20515 > >The Honorable Larry Pressler, Chairman >Committee on Commerce, Science, and Transportation >United States Senate >Washington, DC 20510 > >Re: Computer Pornography Provisions in Telecommunications Bill > >Dear Mr. Chairmen: > >We are writing to urge the conference committee seeking to reconcile the >telecommunications bills passed by the House and Senate include in the >final bill the strongest possible criminal law provisions to address the >growing and immediate problem of computer pornography without any >exemptions, defenses, or political favors of any kind accorded to those >who knowingly participate in the distribution of obscenity to anyone or >indecency to children. While there is no perfect solution to the problem >of computer pornography, Congress could not hope to solve this problem by >holding liable only some who are responsible for the problem. > >The recent Justice Department prosecution project targeting those who >violated federal child pornography law using America On-Line is >instructive in this regard. More than ninety individuals were targeted for >prosecution although many others, perhaps as many as 3,000 according to >one press report, were originally targeted by the Department of Justice as >potential violators of child pornography laws. Apparently due to a >shortage of investigative and prosecutorial resources, the project was >limited. Since there are insufficient resources to investigate and >prosecute but a fraction of those that are trafficking in child >pornography by computer, then there will likely be even fewer resources >available to investigate and prosecute those involved in obscenity and >indecency. > >Thousands of individuals both in this country and abroad are regularly >placing obscenity and indecency on the Internet. It is not possible to >make anything more than a dent in the serious problem of computer >pornography if Congress is willing to hold liable only those who place >such material on the Internet while at the same time giving legal >exemptions or defenses to service or access providers who profit from and >are instrumental to the distribution of such material. The Justice >Department normally targest the major offenders of laws. In obscenity >cases prosecuted to date, it has targeted large companies which have been >responsible for the nationwide distribution of obscenity and who have made >large profits by violating federal laws. Prosecution of such companies has >made a substantial impact in curbing the distribution of obscenity, with >many such offenders going out of business altogether. So too will >prosecution of access providers which _knowingly_ traffic in obscenity >have a substantial impact, a far greater impact than just the prosecution >of a person who places one or a few prohibited images on the Internet. >Such a person could not traffic in pornography without the aid or >facilitation of the service or access providers. Indeed, if Congress >includes provisions protecting access or service providers in whatever >bill is finally passed, it is likely that most in this country who are >trafficking in indecency to children or obscenity would continue to do so >since the threat of prosecution would be minuscule, given the numbers of >those currently involved in this activity. It is also likely that those >outside our country who are engaged in these activities would continue to >do so since it would be nearly impossible to extradite them to the United >States for prosecution. Thus, unless all who knowingly participate in such >matters are subject to the law, the Internet will remain the same and >Congress will have failed in its responsibilities to the children and >families of America. > >Federal law has traditionally assigned equal liability both for those who >commit a crime and those who aid and abet a crime. See Title 18 U.S.C. >Code Section 2: "(a) whoever [sic] commits an offense against the United >States or aids, abets, councils [sic], commands, induces, or procures its >commission, is punishable as a principle [sic]." Service or access >providers who knowingly participate in the distribution of indecency to >children or in obscenity to anyone are aiders and abettors in the >commission of those crimes and thus should have liability under any law >Congress passes. Current federal law on child pornography provides no no >exemption or defense for access providers. Thus, the child pornography law >provides a strong deterrent against trafficking in child pornography for >those who would otherwise knowingly participate in its distribution by >computer whether pedophile or access provider. > >The changes in law which we support would not hold an access provider >criminally liable for all illegal pornography on the Internet which their >services may be used to obtain. Nor would it require that access providers >check all communications to ensure that no violations of the law are >occurring. They would simply be required to avoid knowing violations of >the law. This is an obligation imposed on all citizens. Technology exists >today for access providers, through a simple process, to target or flag >and remove files containing objectionable material. > >We support the House-passed language insofar as it addresses obscenity by >amendment Title 18, Sections 1462, 1465, and 1467 of the United States >Code. The provision restricting transmission of indecency in the House-passed >bill, an amendment to Section 1465, is inadequate, and we urge that it be >substantially revised. > >Attached is the specific language we support which includes the House >passed language on obscenity and includes revisions on both the House >passed language on indecency, which would amend Title 18 and the >Senate-passed language on indecency, which would amend Title 47. The >combination of these provisions, we believe, would provide effective laws >to curb obscenity and indecency on the Internet by establishing that all >who knowingly participate in the distribution or facilitation of obscenity >to anyone or indecency to children would be subject to the law. > >Thank you for your concern and attention to this matter. > > >[signed] > >Edwin Meese III > >Ralph Reed >Christian Coalition > >Donald E. Wildmon >American Family Association > >Alan Sears, Former Executive Director >Atty General's Commission on Pornography > >Phyllis Shafly >Eagle Forum > >Beverly LaHaye >Concerned Women for America > >Reverend Louis P. Sheldon >Traditional Values Coalition > >Jay Sekulow >American Center for Law and Justice > >Paul Weyrich >Free Congress Foundation > >Paul McGeady >Morality in Media > >Len Munsil >National Family Legal Foundation > >Robert Peters >Morality in Media > >Kenneth Sukhia >Former United States Attorney, N.D., FL >Former Chairman, Atty General's Advisory Committee >Subcommittee on Child Exploitation and Obscenity > > >-------------------------- > > >Section 1465 of Title 18, United States Code, is amended to punish >distribution by computer of indecent material to minors by adding at the >end the following: > >Whoever knowingly communicates, transmits, or makes available for >communication or transmission, in or effecting interstate or foreign >commerce an indecent communication by computer to any person the >communicator or transmitter believes has not attained the age of 18 years >of age, knowing that such communication will be obtained by a person >believed to be under 18 years of age, shall be fined under this title or >imprisoned not more than five years, or both. > >TITLE IV -- OBSCENE, HARASSING, AND WRONGFUL UTILIZATION OF >TELECOMMUNICATIONS FACILITY > >SEC. 401. SHORT TITLE > This title may be cited as the "Communications Decency Act of >1995". > >Sec. 402. OBSCENE OR HARASSING USE OF TELECOMMUNICATIONS FACILITIES UNDER >THE COMMUNICATIONS ACT OF 1934 > >Section 223 (47 U.S.C. 223) is amended -- > (1) by striking subsection (a) and inserting in lieu of [sic]: > ``(a) Whoever-- > ``(1) in the District of Columbia or in interstate or foreign >communications -- > ``(A) by means of telecommunications device knowingly-- > ``(i) makes, creates, or solicits, and > ``(ii) initiates the transmission of, > any comment, request, suggestion, proposal, image, or other > communication which is obscene, lewd, lascivious, filthy, or > indecent, with intent to annoy, abuse, threaten, or harass > another person; > ``(B) makes a telephone call or utilizes a > telecommunications device, whether or not conversation or > communication ensues, without disclosing his identity and > with intent to annoy, abuse, threaten, or harass any person > at the called number or who receives the communication; > ``(C) makes or causes the telephone of another repeatedly > or continuously to ring, with intent to harass any person at > the called number; or > ``(D) makes repeated telephone calls or repeatedly > initiates communication with a telecommunications device, > during which conversation or communication ensues, solely to > harass any person at the called number or who receives the > communication; > ``(2) knowingly permits any telecommunications facility > under his control to be used for any activity prohibited by > paragraph (1) with the intent that it be used for > such activity, > > shall be fined not more than $100,000 or imprisoned not more > than two years, or both.''; and > > (2) by adding at the end the following new subsections: > > ``(d) Whoever-- > ``(1) knowingly within the United States or in foreign > communications with the United States by means of > telecommunications device makes or makes available any > indecent communication in any form including any comment, > request, suggestion, proposal, or image, to any person under > 18 years of age regardless of whether the > maker of such communication placed the call or initiated the > communication; or > ``(2) knowingly permits any telecommunications facility > under such person's control to be used for an activity > prohibited by paragraph (1) with the intent that it be > used for such activity, > shall be fined not more than $100,000 or imprisoned not more > than two years or both. > ``(e) Defenses to subsections (a) and (d), restrictions on > access, judicial remedies respecting restrictions for > persons providing information services and > access to information services-- > "(1) It is a defense to prosecution that a person has complied > with regulations designed to restrict access to indecent > communications to those 18 years old or older as enacted by the > Federal Communications Commission which shall prepare final > regulations within 120 days of the passage of this bill. Until > such regulations become effective, it is a defense to > prosecution that the person has blocked or restricted access > to indecent communications to any person under 18 years > of age through the use of verified credit card, adult access > code, or adult personal identification number (PIN). > Nothing in this subsection shall be construed to treat > enhanced information services as common carriage." > "(2) No cause of action may be brought in any > court or any administrative agency against any person on account > of any activity which is not in violation of any law punishable > by criminal or civil penalty, which activity the person has taken in > good faith to implement a defense authorized under this section or > otherwise to restrict or prevent the transmission of, or access to, > a communication specified in this section. > (f) Nothing in this subsection shall preclude any State or > local government from enacting and enforcing laws and regulations > which do not result in the imposition of inconsistent obligations on > the provision of interstate services. Nothing in this subsection > shall preclude any State or local government from governing conduct > not covered by subsection (d)(2)." > (g) Nothing in subsection (a), (d), or (e) or in the > defenses to prosecution under (e) shall be construed > to affect or limit the application or enforcement of any other > Federal law. > (h) The use of the term 'telecommunications device' in this > section shall not impose new obligations on (one-way) broadcast > radio or (one-way) broadcast television operators licensed by the > Commission or (one-way) cable services registered with the > Federal Communications Commission and covered by obscenity and > indecency provisions elsewhere in this Act. > >Sec. 403. OBSCENE PROGRAMMING ON CABLE TELEVISION. > > Section 639 (47 U.S.C. 559) is amended by striking "10,000" and >inserting "$100,000" > >Sec. 404. BROADCASTING OBSCENE LANGUAGE ON THE RADIO. > > Section 1466 of Title 18, United States Code, is amended by >striking out "$10,000" and inserting "$100,000". > >Sec. 405 SEPARABILITY > > "(a) If any provision of this Title, including amendments to this >Title of [sic] the application thereof to any person or circumstance is >held invalid, the remainder of this Title and the application of such >provision to other persons or circumstances shall not be affected >thereby." > >________________________________________________________________________ >CHRONOLOGY OF THE COMMUNICATIONS DECENCY ACT > >Sep 26, '95 Sen. Russ Feingold urges committee members to drop > Managers Amendment and the CDA from the Telecommunications > Deregulation bill >Aug 4, '95 House passes HR1555 which goes into conference with S652. >Aug 4, '95 House votes to attach Managers Amendment (which contains > new criminal penalties for speech online) to > Telecommunications Reform bill (HR1555). >Aug 4, '95 House votes 421-4 to attach HR1978 to Telecommunications > Reform bill (HR1555). >Jun 30, '95 Cox and Wyden introduce the "Internet Freedom and Family > Empowerment Act" (HR 1978) as an alternative to the CDA. >Jun 21, '95 Several prominent House members publicly announce their > opposition to the CDA, including Rep. Newt Gingrich (R-GA), > Rep. Chris Cox (R-CA), and Rep. Ron Wyden (D-OR). >Jun 14, '95 The Senate passes the CDA as attached to the Telecomm > reform bill (S 652) by a vote of 84-16. The Leahy bill > (S 714) is not passed. >May 24, '95 The House Telecomm Reform bill (HR 1555) leaves committee > in the House with the Leahy alternative attached to it, > thanks to Rep. Ron Klink of (D-PA). The Communications > Decency Act is not attached to it. >Apr 7, '95 Sen. Leahy (D-VT) introduces S.714, an alternative to > the Exon/Gorton bill, which commissions the Dept. of > Justice to study the problem to see if additional legislation > (such as the CDA) is necessary. >Mar 23, '95 S314 amended and attached to the telecommunications reform > bill by Sen. Gorton (R-WA). Language provides some provider > protection, but continues to infringe upon email privacy > and free speech. >Feb 21, '95 HR1004 referred to the House Commerce and Judiciary >committees >Feb 21, '95 HR1004 introduced by Rep. Johnson (D-SD) >Feb 1, '95 S314 referred to the Senate Commerce committee >Feb 1, '95 S314 introduced by Sen. Exon (D-NE) and Gorton (R-WA). > >________________________________________________________________________ >FOR MORE INFORMATION > >Web Sites > URL:http://www.vtw.org/exon/ > URL:http://epic.org/ > URL:http://www.eff.org/pub/Alerts/ > URL:http://www.cdt.org/cda.html > URL:http://outpost.callnet.com/outpost.html > >FTP Archives > URL:ftp://ftp.cdt.org/pub/cdt/policy/freespeech/00-INDEX.FREESPEECH > URL:ftp://ftp.eff.org/pub/Alerts/ > >Gopher Archives: > URL:gopher://gopher.panix.com/11/vtw/exon > URL:gopher://gopher.eff.org/11/Alerts > >Email: > vtw(a)vtw.org (put "send alert" in the subject line for the latest > alert, or "send cdafaq" for the CDA FAQ) > cda-info(a)cdt.org (General CDA information) > cda-stat(a)cdt.org (Current status of the CDA) > >________________________________________________________________________ >LIST OF PARTICIPATING ORGANIZATIONS > >In order to use the net more effectively, several organizations have >joined forces on a single Congressional net campaign to stop the >Communications Decency Act. > >American Civil Liberties Union * American Communication Association * >American Council for the Arts * Arts & Technology Society * Association >of Alternative Newsweeklies * biancaTroll productions * Boston >Coalition for Freedom of Expression * Californians Against Censorship >Together * Center For Democracy And Technology * Centre for Democratic >Communications * Center for Public Representation * Citizen's Voice - >New Zealand * Cloud 9 Internet *Computer Communicators Association * >Computel Network Services * Computer Professionals for Social >Responsibility * Cross Connection * Cyber-Rights Campaign * CyberQueer >Lounge * Dutch Digital Citizens' Movement * ECHO Communications Group, >Inc. * Electronic Frontier Canada * Electronic Frontier Foundation * >Electronic Frontier Foundation - Austin * Electronic Frontiers >Australia * Electronic Frontiers Houston * Electronic Frontiers New >Hampshire * Electronic Privacy Information Center * Feminists For Free >Expression * First Amendment Teach-In * Florida Coalition Against >Censorship * FranceCom, Inc. Web Advertising Services * Friendly >Anti-Censorship Taskforce for Students * Hands Off! The Net * Inland >Book Company * Inner Circle Technologies, Inc. * Inst. for Global >Communications * Internet On-Ramp, Inc. * Internet Users Consortium * >Joint Artists' and Music Promotions Political Action Committee * The >Libertarian Party * Marijuana Policy Project * Metropolitan Data >Networks Ltd. * MindVox * MN Grassroots Party * National Bicycle >Greenway * National Campaign for Freedom of Expression * National >Coalition Against Censorship * National Gay and Lesbian Task Force * >National Public Telecomputing Network * National Writers Union * Oregon >Coast RISC * Panix Public Access Internet * People for the American Way >* Republican Liberty Caucus * Rock Out Censorship * Society for >Electronic Access * The Thing International BBS Network * The WELL * >Voters Telecommunications Watch > >(Note: All 'Electronic Frontier' organizations are independent entities, > not EFF chapters or divisions.) > >________________________________________________________________________ > End Alert >======================================================================== > > ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

1 0

Re: toolkits?
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

Timothy C. May wrote: > > At 12:41 AM 11/7/95, Stephen Whitaker wrote: > > >just might have a prayer of doing it right, whatever that is. What would it > >look like if secure communications and anonomynity were designed in from the > >start? Is this what Sameer is doing in Bezerkeley? > > > >What machines are considered minimum requirements to use these tools? What > >are the essential reference works? > > "Security and anonymity" are not matters for government to ensure. > [...] > I urge you, Stephen, to read up on encryption and the benefits contained > therein. Looking to your state capital to secure your communications is a > lose. > Tim - I think your libertarian side is showing here.... Not that this is a bad thing, but I think there are some things that state governments can and/or should do. First off - avoid trying to legislate minute details of any encryption or signature scheme. Bureaucrats trying to understand, much less control technical things is doomed to fail. (take GOSIP as a prime example) Second - push for legal acceptance of digital signatures and acceptance of privacy through encryption. I believe Utah has taken a strong step in this direction. Most people, businesses, and courts won't accept digital contracts and the like until there is more of a sound set of laws behind them. Strong laws against government snooping or against anti-encryption or anti-anonymous laws are a good thing IMO. Besides - laws like that will let the bureaucrats drown themselves in their own paperwork making sure then follow their own rules - and keep them out of our hair. ;-) Third - provide services to the citizenry. For example - provide a public key server. Or how about a digital time-stamping service. If the crap was kept out of these services, and they were free for anyone to use, then it would advance the idea of encouraging people to use crypto in their daily lives. Warning - Although I think there are some good things that governments can do, it is also very important to watch out for "sabotage" by the government. Governments tend to like control too much and by trying to maintain control, reverse a useful service to one that is a dis-service to the people. In general, if governments get out of the way, people will take care of problems themselves. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: idle CPU markets
by srao＠ISI.EDU 17 Dec '03

17 Dec '03

> Date: Fri, 27 Oct 1995 06:25:34 -0700 > To: cypherpunks(a)toad.com > From: Jay Campbell <edge(a)got.net> > Subject: Re: idle CPU markets > Sender: owner-cypherpunks(a)toad.com > A graphic-arts chum of mine is really hyper about cycle sales - it will > allow him to produce broadcast-quality commercials on a project-by-project > basis without a huge initial hardware upgrade investment. Is anyone working > on a Java libarary/demo/whatnot that allows plug-in algorithms, work > completion 'fetch next batch' code, and some rudimentary authentication > scheme? If not, I may tinker with this - if so, I'd like to chat :) At USC/Information Sciences Institute, we are developing a system that will enable computer owners to sell or barter processor-cycles on the Internet. This is in some ways similar to what you talk about, in that it allows the execution of plug-in applications, and the policies for allocation and deallocation of remote resources are decided by the owners and are transparent to the end user. However, unlike Java, our applications are compiled C programs that execute on *compute servers* rather than on client machines. The application could in turn be an interpreter for some other language (e.g. Java). We also support parallel applications that use the Parallel Virtual Machine (PVM) libraries for interprocess communication. We have implemented a prototype known as the Prospero Resource Manager (PRM); a parallel version of POVRAY raytracing program is one of the applications we've run using PRM. We are currently working on integrating PRM with authentication and payment products (including kerberos, netcheque and netcash) developed as part of our other projects on security and electronic commerce. If you are interested in further information about any of these products, or are interested in participating in any aspect PRM's development we'd be happy to talk to you. More information is also available on our web pages: http://nii-server.isi.edu/info/prm and http://nii-server.isi.edu/gost-group. We also believe that one of the parallel applications for which PRM is useful is showing the weakness of certain encryption methods with limited key size. If anyone has suggestions for algorithms or software that might be included as a demo application in the next release of PRM, please contact me. Santosh Rao.

1 0

toolkits?
by Stephen Whitaker 17 Dec '03

17 Dec '03

OK folks, nobody seems to have any ideas how to keep our little state of Vermont from falling prey to mediocrity in the internet. I thought with so many highly opinionated people I would at least get a few good or at least entertaining suggestions. How about a different angle. Can anyone aid in building capacity among a few sincere watchdog types to really learn how to map, trace and test the net here as it grows? What constitutes a basic toolkit for trace route, sniff for promiscuous mode, all the other tools to map whats happening to net traffic in a little state of 1/2 million people? What are the sources of traffic information? With there not even a single DS-3 in the state yet carrying IP it seems we just might have a prayer of doing it right, whatever that is. What would it look like if secure communications and anonomynity were designed in from the start? Is this what Sameer is doing in Bezerkeley? What machines are considered minimum requirements to use these tools? What are the essential reference works? -sw

2 1

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Rich Salz 17 Dec '03

17 Dec '03

> Strangely >enough this would seem to hurt, not help, the NSA in the most important >part of their current mission, which is to help protect US industry >against industrial espionage and virtual terrorism, which is a far more >pressing threat. Matt's NATO adventures, for example, are an interesting example of what happens when the two missions -- "protect our secrets" and "read theirs" -- come into conflict. (Not unlike the US Dept of Agriculture.) Their open involvement in places like W3C, where Agency staff talk about getting Fortezza cards in COTS products provide another datapoint. Budgets cuts may turn out to be strong crypto's best friend. /r$

1 0