December 2003 - cypherpunks-legacy

unsuscribe
by charles＠europages.com 17 Dec '03

17 Dec '03

'unsuscribe'

1 0

primality code
by pjnesser＠asgaard.rocket.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can someone point me in the right direction for any archives of code to do primality testing? I would rather not have to right something from scratch. - ---> Phil pjnesser(a)rocket.com (206)885-5010x5477 (voice) (206)882-5750 (fax) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKuBCjeDb3D8TcGFAQGHyAQAg8SXnZrIpQuWznlLxFS0uU0YM5mhwtXj aG1qtts2vpOzbcNsIyV2zfx01yniOL5E7JycbQWUXJPmN0hRNxCovLWBL2rRJyrQ KqdVUmaOa7RQqtW/Zx7qyCF3jPG0UZJe4KAJg6InwK6Ts3MS9e57Ft0T5iQG6Ygd pb1f7+aiEE0= =NYh0 -----END PGP SIGNATURE-----

2 1

Re: Hardware-random-bits interface
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Tue, 14 Nov 1995 14:31:46 -0800 >From: Peter Monta <pmonta(a)qualcomm.com> >A rate of 300 kB/s will make a 600 MB one-time pad in an hour >(assuming software is similarly fast). I'm wondering if any >of the mail systems have convenient hooks to use pads (though >it would not be difficult to write up). > >Suggestions welcome. I'll put the design on the Web >once it's finished; replicating it should be pretty easy. >People can also grab the device driver if they wish. I'd be nervous about using a radio receiver which can be fed with a signal by the adversary. A noisy resistor or diode should be less subject to bias by an active opponent. Whatever you use for a source of bits, it should be carefully measured to determine how much real entropy is in the source. Don't assume all the bits you get are independent, flat distribution bits. You might need to hash bits down until you get independence. You also might want to provide some further ranno conditioning. cf. http://www.clark.net/pub/cme/P1363/ranno.html (on ranno theory) and http://www.clark.net/pub/cme/html/ranno.html (on conditioning) - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+

1 0

Re: credit card conventional wisdom
by John Pettitt 17 Dec '03

17 Dec '03

At 10:48 AM 11/16/95 -0800, Vladimir Z. Nuri wrote: > ... about credit card liability Hmmm, a few words about credit card liabilty. The situation now is that in a "card not present" transaction the merchant is liable for the fraud. This means that *a lot* of internet based stores are getting eaten alive by fraud. The big issue right now is not cards being stolen from the telco switch (yes it's a risk but can anybody cite it happening?). The issue is authentication of the card user. We have a significant investment in AI / credit scoring code to defeat the wannabe crackers. This goes way beyond mod 10 checks and address verification. [ as an aside I've put two people in jail this year for card fraud ] John John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065

3 2

Java & Netscape security (reply to misc. postings)
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hi Harry & Perry & Jeff & Dr Cohen & "Alice" - 1. Netscape security: Like Jeff said, Netscape 2.0beta has all the same security features as JDK beta. (JDK = Java Developer's Kit, the name for our current product.) Netscape and Sun have been cooperating closely to implement, and test, and document the applet security model. The applet security manager and the applet class loader are implemented at the Java layer, for which source code is available from Sun. Granted, some elements of the the applet security model are implemented at the Java<-->runtime level, and that's why we have tests that we run on the appletviewer and on Netscape Navigator. 2. Corporate security class: Harry asks: | My question is, can a corporate user replace the security class in | Netscape. I understand that all the class libs are in an external | file. While a virus might exploit this... my reason for asking is for | corporate developers who are building "intra"net systems.. making some | tweaks to the security class would give them the flexibility they need. | Otherwise we have taken much of the fun out of Java. (for good | reasons). The best thing to do if you want to implement your own intra-corporation security model in the short run is to get a copy of the beta source code, and take a look at AppletSecurity.java and AppletClassLoader.java. You can substitute your own versions of those for your inhouse use. This is relatively easy to do with the appletviewer, and although it's possible to do some binary hack on moz2_0.car and replace certain files with your own, it's probably not everyone's cup of tea. I mean, there's a difference between what you can do, and what you want to do ... I understand that! For the next release, we are working on how to enable people to accomplish what you want to accomplish, in a standard way and in a usable way, which preserves the applet security model. The goal is to design the APIs so that applets can have access to more system functionality in a secure way. Presumably what you really want to do is write applets that have access to file i/o (or what have you), not re-implement the security manager. 3. Postscript considered dangerous: (insert-smiley) As for the question of someone invoking a postscript interpreter via a browser and thus opening up their system to some rogue postscript file: I think it would be great if either of these two things were to magically happen: 1) people would stop putting postscript docs on web pages because it's the wrong technology for WWW - it wastes bandwidth - it's hard to view & hence often ugly - everyone just prints it out anyway and then complains because there is no one "standard" implementation of postscript printing worldwide and there are dozens of minor problems 2) someone could implement a secure postscript previewer (whatever that means!) I doubt either of those two things will happen. The average Jo on the internet needs to understand that when s/he downloads binary files over the internet and run them from insecure programs on their local computer, well, s/he runs some risk. This risk might be tiny, but it's impossible to quantify loss. If I lose a poem that I'm writing, to me that's priceless, so I do not intend to imply that loss of data isn't tragic for the person who loses it. If you have data you can't bear to lose, be sure to practice safe computing. Perform backups regularly, and use judgement about which interpreters and executable programs you allow to run on your PC. Marianne -- internet fan, mrm(a)netcom.com Java Products Group, mrm(a)eng.sun.com

10 13

Evil Mail
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

WSJ, November 15, 1995 America Online to Warn Users About Bad E-Mail Vienna, Va. -- It's a case of myth becoming reality in the digital age. America Online Inc. plans to warn subscribers of a damaging piece of electronic mail that could corrupt their computers' hard drives. The existence of the destructive file follows a long-term hoax that has been dogging AOL for months. Last year, a user began circulating a warning about a "Good Times" virus that would crash users' PCs if they so much as read the piece of electronic mail. AOL, the Federal Communications Commission and the Pentagon repeatedly had to label the alleged virus a hoax. But the new file is all too real. The destructive file, attached to electronic mail, has been circulated through the on-line service and the Internet. Receiving the e-mail wouldn't harm a user's computer, but trying to run the attached file, known as AOL Gold or "install.exe," could render a hard drive inoperable, an AOL spokeswoman said. The company said it has notified various computer-security agencies about the program. AOL also plans to post a letter for its four million users strongly urging them to forgo "downloading attached files from people you don't know." Security experts fear that such Trojan Horses will proliferate as programs become easier to attach to electronic mail and the use of networks grows. -----

1 0

Re: e$: Come aaaannnndddd Get it!
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Incidentally, I would like to apologize if I am going over (and not contributing anything new to) discussion that has already taken place. If anyone has or knows of an archive of the earlier list messages on the subject (before I subscribed), I would like to read over them. From: tcmay(a)got.net at 16-NOV-1995 13:00:29.05: At 12:18 PM 11/16/95, Robert Hettinga wrote: > >Ahhh. Next year in Jeresalem... ----------- Although I am unfortunately not completely familiar with this phrase, I believe that your meaning here may be that I may be too much of an idealist. My position is that I will not use a digital cash system with the significant deficits in privacy that the ecash system has. The only exception to this stance would be if it becomes plain that it is the only alternative to a credit card system. Admittedly, as has been pointed out to me in private email, some degree of increased privacy in the ecash system can be gotten via changing currencies using ecash. An example would be dollars to yen through one changer and back again through another. However, I will not regard a digital cash system as truly good until it has the following traits: A. Private to any combination except all three of bank, sender, and receiver. B. The bank does not know the amount transacted or owned, unless it is the sender or receiver. (Obviously, it will know the total amount of digital cash of its issuance in existence, and how much it has received from or sent to each person, but it should not need to know anything more). C. Double spending is detectable, but does not reveal the identity of the individual. Thus, the bank does not need to know the identity of the individual when issuing the digital cash. The following are desirable but not strictly neccessary characteristics: A. Offline transactions are possible. To detect double spending, a transaction with the bank will probably be necessary, but this should ideally be postponable until the goods purchased are shipped. B. Mathematical as opposed to computational authentication and privacy. Since I am neither a mathematician nor a programmer, I am uncertain about whether this last is possible. I have my doubts. -------------- >Tell me, are you actually selling something on the net yet? How many >customers do you have? -------------- If A. such a system as the above were set up and B. I had available any computer programs, etcetera necessary to use it, then I would at least _try_ selling something on the net. This something would be not data itself, but true information- data with interpretations. I am qualified to produce such a service in some areas in biology and medicine. I am currently in a Ph.D. program in Molecular Genetics and Microbiology, and my chief area of interest is gene therapy- I have thus learned some things about human physiology. Perhaps more importantly than my own knowledge and experience, I know who to ask and have such individuals available. Admittedly, I would have to fit it into the time between exams, or more likely between semesters. -------------- Bob, let me do a minor vent here. You are critical of E. Allen Smith's viewpoint, and essentially question whether he has anything to sell. Not much of an argument. --------------- Thank you. (I would say "Thank you for your support," but my name is neither Bartles (sp?) or James.) --------------- Especially when folks are urging that "people put their money where their mouth is" and get MTB accounts. Me, I don't plan to sign up for various reasons: 1. I'm not selling anything, and won't sign up just for "moral support." (I tried this once before, getting an AMIX account early on, and that system offered more of a chance for a 2-way market. Still, a waste of my time.) --------------- I tried signing up for AMIX also, but unfortunately came in too late (after it closed down). I might consider signing up for a system with the characteristics described above for "moral support," but I will not do so for a system that I hope is replaced by a better one. --------------- 2. I wish Mark Twain Bank well, but the success of the kinds of digital cash we hope to see will not likely hinge on the success of one particular operations, such as MTB. 3. The success of BankAmericard (later renamed Visa) came when real customers and real shops started to use it, not when early pioneers set themselves up as clearinghouses and whatnot. --------------- Online commerce systems can be divided into four types, of increasing level of desirability (and decreasing level of governmental approval): A. Credit-card based systems such as credit card number encryption and First Virtual. B. Partially privacy-protecting systems such as ecash. C. Fully privacy-protecting systems with the characteristics described above, based on a governmental currency. D. Fully privacy-protecting systems with the characteristics described above, based on a privately-produced currency and backed by the issuer. I suspect that the first and second will have the most aboveground chance of succeeding, given likely governmental interference in the third and fourth; lack of public comprehension of all of the digital cash systems and of privately-produced currency will impede some of them also. However, the fourth may be a possibility for an "underground" currency system, to be used among computer-literate individuals with an aversion to government. I am currently creating an idea for a system of the fourth type, and will put it on the exi-essay list when it is complete. Incidentally, I suspect a privately-produced currency system may be harder to regulate than a governmentally-produced currency system, especially if the former is set up properly. I will explain further about this idea in the aforementioned exi-essay system. --------------- I have more interesting things to do, personally, than to be a pioneer so I can then have nothing to sell, and little to buy....when "interesting markets" start to appear, I'll look at it again. In any case, I wish all the pioneers well, and am happy to see Lucky Green's involvement. --------------- I also agree in wishing the "pioneers" well. The ecash system is definitely preferable to one based on means such as credit cards. -Allen

1 0

Re: Java & Netscape security (reply to misc. postings)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

After reading http://java.sun.com/1.0alpha3/doc/security/security.html my (possibly faulty) understanding of Java security is that it will not allow an applet to speak to IP addresses other than the one it was loaded from. I have a question: Doesn't restriction this prevent an applet from checking some ecash it has just received for validity with a bank computer? Thanks - Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

e$: Mandarins, Lifers, and Talents
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Bob, let me do a minor vent here. Fine, Tim. Vent away. In a minor key, even. >You are critical of E. Allen Smith's viewpoint, and essentially question >whether he has anything to sell. Not much of an argument. It's a damn good argument, which I'll get to in a minute. It was just done rudely, and for that I apologise to the list. What I got was a reactionary flame which had nothing to do with the (admittedly flag-waving) post I put up, which I should have ignored, but instead I responded with a reactionary flame of my own, which got me a reactionary flame from a Senior Member of the List, one with Maximum Reputation... It has been ever thus, for those of you who've been around here since I showed up a year ago last April. I just can't seem to color inside the lines, as far as Dr. May is concerned. >1. I'm not selling anything, and won't sign up just for "moral support." I believe that was my point, Tim. You're *not* selling anything. I was sending a message to people out there who *are*. People who are, or are going to, use non-certificate payment methods, like credit cards, and who, if they're subscribed to this list, should be clueful enough to do this and know why they should do it. Besides that, it's free. Until Friday. ;-). >2. I wish Mark Twain Bank well, but the success of the kinds of digital >cash we hope to see will not likely hinge on the success of one particular >operations, such as MTB. Nope. But if people completely ignored the Wright Brothers, would Curtiss have entered the market? (An interesting example, as the Wrights sued Curtiss for patent enfringement and lost, I think.) >3. The success of BankAmericard (later renamed Visa) came when real >customers and real shops started to use it, not when early pioneers set >themselves up as clearinghouses and whatnot. I am talking about real shops. With real customers. I bet you haven't even looked at the list of shops yet. What I'm planning to do is to offer subscriptions and sponsorships of the e$ lists we're putting up on an ecash server. Putting my money where my mouth is. Literally. >I have more interesting things to do, personally, than to be a pioneer so I >can then have nothing to sell, and little to buy....when "interesting >markets" start to appear, I'll look at it again. This is a straw man, Tim. Actually, it's post hoc. "If we had some ham, we could have some ham and eggs, if we had some eggs." or, "If we lived here, we'd be home now." Feh. You can do better than that. I've seen you do it. But, to answer your nonexistant point, yes, people *are* starting to sell things on the net. We know that the best way to do that in the long run is with cash, and with other digital bearer certificate technologies. Not just because these methods are secure. Not because they allow anonymity. They're just starting to, and when they've been accepted in the market, they will be nothing else but. All we need is a scenario where the digital cash underwriter relies upon the ATM system for validation of identity, and the second an anonymous bank account uses the underwriter, we have totally anonymous digital cash. We're very close here. >But when you urge people to be pioneers, and they express reservations or >doubts about the system, attacking their motives or implying they have >nothing to sell anyway is not too helpful. Yes. it was rude. I apologise both to the list, to Dr. May, and to (soon to be Dr.) Mr. Smith. Mostly for stopping discussion with a thinly veiled insult. >Just my views, but, then, I don't have any customers either. Which brings me to my real point, here. Why I used an informal fallacy of my own, and lashed out with an ad hominem attack against someone with an .edu domain on their e-mail address, after they dissed something I think is a good idea, at least for a start. So, why did I do this? I didn't understand it at the time, but it's probably class warfare. :-). I just heard something on an NPR(!) talkshow with a guy talking about his book about the three power group of american culture. It used to be what he called the "episcopacy", the Groton-Harvard-State Department types who ruled both government and the guts of American business until say, the depression and World War II. These people were there primarily there because their families were there. They were "the nice people of Boston" that Rose Kennedy had so many problems with. In 1953, say, it may interest you to know, that the standardized test scores for Harvard were the same as those for the population at large. George Bush was one of these, but so was FDR. Nowadays, this guy says, (I can't remember who he is, but he wrote a book about it, so we'll find out soon enough), we have *three* power elites in this country. The first class is the class he called the "mandarins". These people have inherited most of the trappings, and titles, of the old episcopacy. These are people who tested well, who were typically plucked from obscurity to go to the best schools, and go on to places like Harvard, where the scores are now way above average, and is now pretty much pure meritocracy as far as admission is concerned, political correctness aside. Mandarins go on to get advanced degrees. Camille Paglia, Milton Friedman, Carl Sagan, Billary Clinton are all mandarins. This is good. The best and the brightest get the best educations. They're also the people who start things like the Viet Nam war, and the welfare state. The second class are the "lifers". These people who go to state schools, get uninspired grades, and spend their working lives in the same institution. Colin Powell, most Fortune 500 CEOS circa 1983, Lyndon Johnson and Bob Dole are lifers. The third class are "talents". Newt, and Edison, and most computer or internet entrepreneurs are talents, especially if they have no formal computer science training except what they taught themselves. Like any set of categories, nobody is exclusively one class or another, except that credentialism has allowed mandarins to capture the cultural flag for the time being. Einstein and Whit Diffie are talents who got mandarin credentials. Richard Stallman is a talent who will probably get mandarin credentials posthumously.;-). Bill Gates is a proto-mandarin who figured out he was a talent. Sloan was a talent with mandarin credentials who created a whole industry full of lifers. Pioneers tend to be talents, Tim. They tend to talk in generalities, and not color between the lines. They tend to make up rules as they go along, and sometimes, like Mr. Bill, they create rules the rest of us have to follow whether we want to or not. One of my messier theories about the internet is that it was invented by mandarins. Now the talents, the people you call pioneers, have moved in, and they're much more pragmatic, and have little patience for crystalline perfection, because inefficiency and chaos is where they find beauty, joy, and all those other nasty imprecise concepts. When thing settle down a bit, the lifers will come. They're trying to do it now, by building sites like www.time.com, or buying into sites like www.wired.com. Even though you're an iconoclast, Tim, I couldn't help but think of you and the proto-Dr. Smith as mandarins when I got you're response to my post. I was trying to shout over your heads to all the talents out there trying to make money on the net. Even though you may think of yourself as a mountain man -- or maybe a cowboy -- watching the settlers come, I feel more like I've upset the decorum by hollering in the faculty tea room. Having embarrassed myself that way, I'll try not to do it again. Because, oddly enough, we need each other. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rich Salz 17 Dec '03

17 Dec '03

Status: R >as a compression program, but there's a key difference: the text >compressor *doesn't* need a key. Sure, 12 14 16, etc., bits as in the classic unix compress program. >The encryption tool would have an interface like > Boolean (*)( DataSource, DataSink, void*); > >A compressor written to the same interface would never need to touch >that third argument. Therefore, the second argument is "specifically >designed" to permit an encryption tool to be used. Not at all. coyping inbuf to output is a common practice, it's quite rare that you often compress in-place. /r$

1 0