December 2003 - cypherpunks-legacy

Mailbox soft limit exceeded
by Interserv Operations 17 Dec '03

17 Dec '03

Your mailbox has exceeded the soft size limit of 8MB. Mail will continue to be delivered to your mailbox until it reaches the hard size limit of 15MB. please removed unecessary messages from you mailbox. Additionally, if you're using CompuServe/Spry AirMail you may choose the local inbox option which will download the mail from your remote inbox to your local system inbox before allowing you to read it. PLEASE NOTE: Use of the local inbox option will preclude accessing the downloaded mail messages except from the system on which the messages were downloaded. -- Interserv Network Operations Center Postmaster(a)interserv.com 2001 6th Ave. Suite 3025B noc(a)interserv.net Seattle, WA. 95121 CompuServe/Internet Division

1 0

Re: cyphernomicon FTP site?
by jim bell 17 Dec '03

17 Dec '03

At 04:18 PM 12/19/95 -0500, you wrote: >Anyone know where I can FTP a full copy of the cyphernomicon? > >------------------------------+----------------------------------------------- >Vinod Valloppillil | LibertarianismTelecommunicationsFreeMarketEnvi >Engineering/Wharton | ronmentalismTechnologyCryptographyElectronicCa >University of Pennsylvania | shInteractiveTelevisionEconomicsPhilosophyDigi >vvallopp(a)eniac.seas.upenn.edu | talPrivacyAnarchoCapitalismRuggedIndividualism >------------------------------+----------------------------------------------- I'm interested in this too. I really HATE those silly HTML documents that can't (or, at least, I haven't yet figured out how) be downloaded in one swell foop.

2 1

Bit Commitment Query
by Robbie Gates 17 Dec '03

17 Dec '03

I am confused about bit commitment via one way hashing as described in Schneier (1st ed, p 73) h is a one way hash function. This description from Schneier, except that variables are changed so i don't need subscripts: 1. Alice has a bit b she wants to commit to. She picks random bit strings R and S, and sends Bob h(R,S,b),R 2. To verify commitment, she tells Bob S and b so he can verify the hash. What i don't get is Schneier's claim: ``If Alice didn't send Bob R, then she could change the value of S and then the value of the bit. The fact that Bob already knows R prevents her from doing this.'' Can someone explain exactly how Alice cheats if Bob doesn't know R. I can't see how she can alter R and S and b at all without being able to produce hash collisions. In essence, why doesn't the following work: 1. Alice has a bit b. She picks a random bit string R and sends Bob h(R,b) 2. To verify, she tells Bob R and b. Assuming Bob knows b is a single bit, how does Alice cheat without needing to produce hash collisions for h. thanks in advance for any help, - robbie -- ---------------------------------------------------------------------- robbie gates | it's not a religion, it's just a technique. apprentice algebraist | it's just a way of making you speak. pgp key available | - "destination", the church.

2 1

on web standards: sent to Markoff
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

here's a quickie rant about software standards sent to Markoff, precipitated by his recent column on Berners Lee & the Web. please help kill the urban legend I refer to in this letter. ------- Forwarded Message Subject: tim berners lee etc. Date: Wed, 20 Dec 95 00:39:44 -0800 From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> I read your recent article on Tim Berners Lee. there is a misconception in the article that annoys me and that I have seen you/others repeat elsewhere. the following myth is: COMPANIES SET STANDARDS. this is not really true. in the short term, companies can set whatever "standards" they like. but in the long term, the *market* decides what standards are acceptable. an example of this was IBM: they set various standards until the market decided that the "standards" they were setting were not acceptable. they became their own worst enemy. no amount of shovelling their ideas down consumer's throats via million dollar ad campaigns or sales pressure changed the basic reality of what the market wanted. even though "microchannel" may have been technically superior, consumers consistently decided the proprietary price of the architecture was not worth the extra economic burden to obtain it. you and others are continually reiterating and reinforcing this myth in regards to web software in your writing. you talk about various companies as if they could somehow seize various standards for their own and exclude other companies (Netscape's supposed proprietary web "standards" are an example). this is fallacious for the reason I outlined above. the market may not tolerate this exclusivity, and particularly in the area of computer software and hardware this has been shown emphatically so. furthermore, the idea that companies can legislate their own web standards is particularly ludicrous. it is true that netscape has added their own "extensions" that their own browser understands and other browsers initially do not. but nothing prevents other companies from immediately incorporating these "enhancements" so that they are recognized by their own software. in fact this is trivial to do so in many cases (e.g. one of these so-called "enhancements" is blinking text in web pages). so the idea that a single web company can somehow monkeywrench the standards process by introducing new ideas is absurd and completely ignorant of reality. in fact this rapid "standard" fluctation is the heart of innovation. it is true that the web standard is fluctuating very rapidly right now, but that is not evidence of companies trying to seize the standard for their own: instead it is the chief sign of dynamic and rapid innovation. I urge you to read Bill Gate's recent book. he addresses this continual myth that people yammer about, namely the idea that individual companies can set exclusive or proprietary standards. a company standard is in fact a sort of temporary whirlpool in time: it will exist only so long as the forces surrounding it support it. a single company can temporarily create an illusion that their standards are the only ones available, but the market may eventually decide that their standard is not appropriate. Microsoft would crumble in a short amount of time if they failed to deliver what the market demands, and Gates reiterates this theme. it is tempting to think of Microsoft or Netscape as large behemoths that "drive the market". this is true in the short term but in truth over the long term the market drives these companies, and they lose market share if they become irrelevant. it is useful to look at one company as a focus of market forces, not the determinant of them. in my opinion the idea that various companies are in control of the market is not only erroneous but highly dangerous. it leads to the view that the government has to step in to promote "fair competition" or "legislate standards". these approaches are usually total failures because they completely neglect the true nature of the innovation of ideas, something that is expressed quite tangibly and viscerally in software development, but this simple point various people still utterly fail to grasp. its quite dramatic to write about single companies such as Microsoft or Netscape as if they have tremendous power and influence over the industry. various companies have found however that this influence is highly fleeting if they are not in tune with market currents. companies are subservient to the market, not vice versa. please strive to recognize this basic fact in your future writing. p.s. I am willing to work this into a letter to the editor if you are willing to publish it.

4 6

Re: FH radios
by jim bell 17 Dec '03

17 Dec '03

At 05:06 PM 12/25/95 -0500, you wrote: > There is certainly little additional cost to building a >trully secure digital cordless phone given the dense ASIC technology >that is standard in this kind of product - but someone has to >persuade the manufacturers that there is a real need and find a way >to allow them to export the product. > > Dave Emery N1PRE Is there actually a restriction on the export of really-fast frequency-hopping radios, even those (like cordless phones) which have no clear military value?

2 1

Reputation capital: FIBS case study
by lwp＠conch.aa.msen.com 17 Dec '03

17 Dec '03

I am currently engaging in a reputation adjustment of a certain player on FIBS, the First Internet Backgammon Server (see my homepage). Reputation is important on FIBS, and I thought it might be informative to examine the ways it can work in the [more-or-less] real world. FIBS allows various levels of nymity, and various modes of reputation. Each player picks a pseudonym as his FIBS name. These can range from the crypticly anonymous nym, to some variant of the player's real name. The server will also disclose the FQDN from which the nym is connected, or was most recently connected. If she wants, the player may include any information, typically such as an email address, in an "address" field in her player profile. Or something cute, or nothing. Players may also choose to have a web page listed under their nym, on a page full of such listings. Players may participate in the newsgroup (rec.games.backgammon), identifying themselves in their posts by any or all or none of {their FIBS nym, their real name, their email address}. Reputation has several components on FIBS. Of course, personal experience with another nym is hugely significant, when it exists. When that is absent, or not conclusive, there are other sources of reputation which may be consulted. The server reports two numbers for each player, representing distinct reputation criteria: the "rating" is a weighted score representing the won/less record; the "experience" is a count representing how many games this player has played. Before I mention other reputation indices, I want to amplify on these two. When negotiating with another player about possibly starting a new match, and about the length in points of the potential match, most players will think about various aspects of the reputation of the prospective opponent. Depending on the circumstances, the difference in ratings may be decisive, in straightforward ways, for evaluating an invitation. Of particular relevance to past discussion on cypherpunks, the experience number is usually very important also. Those with a high experience level, and perhaps a name that you recall having seen before, are trusted more than nyms with little investment in their reputations. Experience matters a lot, because one of the key strategies is to avoid becoming involved with unpleasant or dishonest players. If someone has a huge experience number, you can be fairly sure that you would have heard about it if they are somehow undesirable. As FIBS is an open server, operating without charge to the users, we get a wide variety of newcomers every day. Some persist, and become better known, and others lose interest and don't return. Most are [more-or-less] agreeable and [more-or-less] ethical; however some nyms will exhibit certain recurring problem behaviors, and quickly begin to accrue negative reputation. On common problem is the use of profanity or the advocacy of various forms of bigotry, in "shout"ed comments or private messages, and the closely related hounding of players with female-sounding nyms by unwanted come-ons. This behavior is generally countered with "shout"ed and "tell"ed replies, and with the "gag <name>" command which kills your copy of any further remarks from that user. The negative reputation resulting from this behavior is pretty much instantaneous and self-documenting, with reinforcement from anyone who is enraged enough to remember and to heckle the offender at a later login. Some of us are more sensitive about this than others, so the offensiveness is just another variable in reputation, not always the decisive one. The thorniest problem in our reputation economy continues to be the case of the player who drops out of a match when clearly losing, to avoid the decrement of his rating number (based on match results only, not on individual games). Such players follow a strategy of playing winning matches to completion, which increases their rating, but bailing out of losing matches before they end. When a match is interrupted, the server remembers it, and the two players can resume later, by mutual agreement. Almost all players are ethical enough to resume even losing matches, and eventually to complete them. The problem folks are the ones who ignore or refuse requests to resume. Avoiding such players is a key strategy for serious FIBS regulars. One indicator here can be a complex function of the rating and experience numbers: a player with fairly low experience but an unexpectedly high rating is one of two things -- either a very strong player, or else a match dropper. (Or else very lucky, but we prefer to think of that as strength of play.) The best defense we have found against the match dropper is complaining in the newsgroup. I just posted a warning in the newsgroup about a new match dropper which I had the misfortune of playing against. I accepted an invitation from him last Saturday, to play a 3 point match. I looked over his info before I accepted, and decided to give him a chance: no email address, experience = 57, and rating showing slightly more wins than losses, from a site at a college in Britain. I won the first game for 2 points, and was pretty clearly winning the next game, which would make me win the match. When "dorion" rolled a game-losing double five, he immediately dropped his connection to FIBS. The server saved the match, and I waited around for awhile to see if he would come back. He didn't. Now at this point, I'm not yet ready to start in on his reputation. After all, we all have host problems, and phone problems, and personal problems. It's still possible that he and I will meet later, and finish the match. (I'm skeptical, because the timing of it is just too convenient, but I hold my tongue). Finally Tuesday, I was hanging on FIBS when dorion returned. I asked politely if we could finish, but dorion immediately logged out without replying. I stayed connected to FIBS, while I did some other work on other VC-s. Before long, dorion was back, my little watchdog macro beeped for me, and I again politely asked him to resume. Instead of replying, he started a fresh match vs. a brand new player, experience equal zero. I started watching their match, where I asked again if we could resume sometime. While I wasn't getting an answer, I looked into the new player's information: connected from exactly the same site as dorion! This of course, is a warning sign of the other common form of ratings cheating -- creating two nyms for one person, and playing against oneself, with one nym always winning and the other always losing. Well, again I got no reply to my requests, and both nyms suddenly disconnected without finishing their match. At this point, I set about trashing dorion's reputation. I posted a (PGP signed) article to the newsgroup setting forth the facts. When I came back on today, there was one followup from another player who had a similar experience with dorion. When I signed onto FIBS, I got a "tell" from a trusted, veteran nym saying that dorion and his alter-ego nym BatesMotel had just been on, and played a couple of one-sided and not at all credible matches vs. each other. I checked their ratings/experience and followed up to my own article with a definite advisory against playing against either nym. Now, despite many elaborate proposals over the years, discussed at length in the newsgroup, there is no automated mechanism for dealing with this sort of negative reputation. I have a personal "don't-play" list I keep up to date, as do many others. My complaint surely got dorion and BatesMotel into many such personal lists, and neither nym is likely to last on FIBS. I'm not really asking for suggestions here or anything. It's likely that most of them have already been debated to death on r.g.b. I just wanted to show you a case of reputation markets in action. :::::::::::::::::::::::::::::::::::::: Thank you VERY much! You'll be :: Lou Poppler <lwp(a)mail.msen.com> :: getting a Handsome Simulfax Copy :: http://www.msen.com/~lwp/ :: of your OWN words in the mail :::::::::::::::::::::::::::::::::::::: soon (and My Reply).

4 3

Re: [Rant] Flame threads and factual accuracy
by jim bell 17 Dec '03

17 Dec '03

At 07:30 AM 12/25/95 -0500, you (Fred Cohen) wrote: >With rights come responsibilities. If you want the right of free speech, you >have to use it responsibly - otherwise, you will lose the right - and quite >possible lose it for me as well. This commentary is pure bullshit. If it were possible to quantify it throughout history, I strongly suspect that the vast majority of instances where "free speech" was LOST (or was never had in the first place) occurred NOT because of some objectively agreed-upon ABUSE (irresponsible use) of that free speech, but in fact merely because those in power WANTED there to be no free speech. In short, "losing the right" had NOTHING to to with abuse. (Though admittedly, that might be a common excuse given...in lieu of the truth!) Fred, you richly deserve your bad reputation.

1 0

Re: Misconfigured Web Servers
by David Klur 17 Dec '03

17 Dec '03

Re: the "trick" below... an even more effective search is the following... http://www.altavista.digital.com/cgi-bin/query?pg=aq&what=web&q=url%3A etc%2Fpasswd&r=&d0=&d1=&Submit.x=51&Submit.y=14 which searches all URLs that contain etc/passwd See for yourself! David Klur _____________________________ Reply Separator _________________________________ Subject: BoS: Misconfigured Web Servers Author: nobody(a)mail.uu.net at Internet-USA Date: 12/26/95 3:57 PM Everyone, A friend of mine showed me a nasty little "trick" over the weekend. He went to a Web Search server (http://www.altavista.digital.com/) and did a search on the following keywords - root: 0:0 sync: bin: daemon: You get the idea. He copied out several encrypted root passwords from passwd files, launched CrackerJack and a 1/2 MB word file and had a root password in under 30 minutes. All without accessing the site's server, just the index on a web search server! Well, the first thing I did was check my site and it's ok. The second thing I did was check my ISP for my home account, and it's okay. But by trying various combinations of common accounts on web searches, dozens of passwd files were found. It seems that a large number of locations who use httpd and ftpd on the same server often copy the regular passwd file to ftp/etc or ftp-users/etc for ftp user access. A few sites have left the root password in the file, and many contain user accounts' passwords. The problems I see here are as follows: 1. You can get the passwd file in some cases by simply pointing your URL to http://target.com/ftp/etc/passwd or http://target.com/ftp-users/etc/passwd. Not good. Anon ftp can't get it but a web browser can. Many passwd files are shadowed but you can see some legit account names. Yes, I realize that this may be a dummy file but hey, not always the case. 2. Some sites do not have the passwd file world readable, but the entire passwd file stills exists indexed on the web search server. I don't know about you, but I don't think I'd want my passwd file indexed and searchable on a world accessible web server. 3. A ton of etc/group files turned up as well. The guy that showed me this found it funny, but I find it disturbing. Are there that many sites that are that poorly configured? Mark_W_Loveless(a)smtp.bnr.com

3 2

Mix Ported to DOS Yet?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

[Please respond netmail, as I have but periodic contact w/list.] Subject says it all: Has anyone ported Mixmaster to DOS yet? It has been impending for about a year, it seems, but no one had actually done it last time I asked. Thanks for any new info... JE -- : Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

DOS - MD5 - Thanks
by P.J. Ponder 17 Dec '03

17 Dec '03

Thanks to everyone who offered help on the MD5 for DOS. Greg Broiles pointed me to the pgp source, which may do the trick. (There is MD5 module in pgp[?]) I will investigate. For everyone's info, didn't find a freestanding dos implementation, tho. My copy of Schneier didn't have the disk, so I don't know if it's there, either. -- PJP

3 2