December 2003 - cypherpunks-legacy

SHU_tup
by John Young 17 Dec '03

17 Dec '03

12-2-95. NYPiper: "Accord Reached For Limiting Smut on Internet." Page One lead. Bowing to a seemingly unstoppable push in Congress to keep sexual material off the Internet, a coalition of commercial on-line services and some civil liberties groups agreed today to accept a number of restrictions they had opposed a few months ago. "Terrorism Bill Plan May Break Deadlock." Tiny article. In a bid to salvage a stalled antiterrorism bill, the chairman of the House Judiciary Committee has agreed to the demands of conservative Republicans to remove proposals expanding the Government's wiretapping authority. SHU_tup (10 kb)

1 0

Re: sooner or later
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: >At 10:45 PM 9/18/97 -0700, Wei Dai wrote: >>Many of us believe that a crypto ban is inevitable. The only >>question for us is whether it'll happen sooner or later. Seen in >>this perspective, all that industry and civil liberties lobbies can >>do is delay the ban. But is this necessarily a good thing? >Yes. Later is bad, but sooner is worse. First of all, "Soon" means >"We lost already", while "Later" means "We haven't lost yet, even >though it looks pretty much like we're going to lose later,... Even if we lose a battle legislatively tomorrow, this does not mean we have "lost". In practice, people can still write code and distribute it, the same way people are still making LSD, growing mushrooms, or growing marijuana. Code propagates easily which means that so long as there is any place in the world where it can be safely used, it will be. Even if it is illegal throughout the world, there are going to be places where the local administrators are too corrupt or incompetent to really enforce the law. (The law is more or less impossible to enforce anyway because you have to charge people with possession of random data.) This means that somebody will be using the stuff, and the New Renaissance will still happen, but the benefits will have to propagate back into the United States for a change. The greatest risk is of a major government going "ape" over this issue and randomly persecuting those they suspect of doing illegal arithmetic without real evidence or real trials. The passing of a law may mitigate this because they will feel as if they are doing something, even if the "problem" was not entirely solved. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCKgi5aWtjSmRH/5AQF5Bgf/UWVTAU8Mk4g8QMX7ya1OnMPbbQvH14wE Lq2Lr+FKYYjQLRTH3UYMPjl+mxXJWhnIxGrK6SNSE3kh+InRpzX1jPtGBpYVXq/9 fr1YgkzjUilcN5dHRxwAO4ciwFmTu0ZCHORhk90DcnwQOBdckXN5ykjGZ3CTGEQA IXrhnV6sK3Ovuxe73WSuaZ+lOUPCMs4SVvnKIeWb4JWy0L3j4YwsmYu0aVVqNAeg Kd2sXYqaBxnitXFg+KTppcW16k9AqSMbFK5+Go3dIM1wZOI8kJKBTE9+Iw6u/zff tvZGXJWGRHB4e4VRf+OAttaP7Aalqx83AHMXe6WhhDUFqXJ7WmhkQw== =UOyl -----END PGP SIGNATURE-----

1 0

Gibson Warfare
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://www.ndu.edu/ndu/inss/strforum/forum28.html Forum, Number 28, May 1995 WHAT IS INFORMATION WARFARE? Martin C. Libicki, National Defense University Is Information War (IW) a nascent, perhaps embryonic art, or simply the newest version of a time-honored feature of warfare? Is it a new form of conflict that owes its existence to the burgeoning global information infrastructure, or an old one whose origin lies in the wetware of the human brain but has been given new life by the information age? Is it a unified field or opportunistic assemblage? Since March 1993, Chairman of the Joint Chiefs of Staff Memorandum of Policy Number 30 (MOP 30) has set forth definitions and relationships that have guided the joint community in its thinking about the related concepts of information warfare and command and control warfare. As these seminal ideas have evolved, their definitions and relationships have changed as well. MOP 30 is under revision, and both higher level policy documents for the Department of Defense and doctrinal publications of the Joint Staff and Services are either in draft form or under revision. In light of the unformed state of these concepts, alternative definitions and taxonomies for twenty-first century warfare are proposed: 1. command-and-control warfare [C2W]; 2. intelligence-based warfare [IBW]; 3. electronic warfare [EW]; 4. psychological operations [PSYOPS]; 5. hackerwar software-based attacks on information systems; 6. information economic warfare [IEW] war via the control of information trade; and 7. cyberwar [combat in the virtual realm]. ... ------------------ URL: http://www.ndu.edu/ndu/inss/actpubs/act003/a003ch07.html Hacker Warfare The hacker attacks discussed here are attacks on civilian targets (military hacker attacks come under the rubric of C2 warfare). Note 41 Although attacks on civilian and military targets share some characteristics of offense and defense, military systems tend to be more secure than civilian systems, because they are not designed for public access. Critical systems are often disconnected from all others -- "air gapped," as it were, by a physical separation between those system and all others. From an operational point of view, civilian systems can be attacked at physical, syntactic, and semantic levels. Here, the focus is on syntactic attacks, which affect bit movement. Concern for physical attacks (see above, on C2W) is relatively low Note 42 (although some big computers on Wall Street can be disabled by going after the little computers that control their air-conditioning). Semantic attacks (which affect the meaning of what computers receive from elsewhere) are covered below, under cyberwarfare. Hacker warfare can be further differentiated into defensive and offensive operations. The debate on defensive hacker warfare concerns the appropriate role for the DoD in safeguarding nonmilitary computers. The debate on offensive hacker warfare concerns whether it should take place at all. In contrast to, say, proponents of tank or submarine warfare, only a few hackers argue that the best defense against a hacker attack is a hacker attack. Whether hacker warfare is a useful instrument of policy is a question that defense analysts and science fiction writers may be equally well placed to answer. Hacker warfare would, without doubt, be a new form of conflict ... ----------------- URL: http://www.ndu.edu/ndu/inss/actpubs/act003/a003ch09.html Cyberwarfare Of the seven forms of information warfare, cyberwarfare -- a broad category that includes information terrorism, semantic attacks, simula-warfare and Gibson-warfare -- is clearly the least tractable because by far the most fictitious, differing only in degree from information warfare as a whole. The global information infrastructure has yet to evolve to the point where any of these forms of combat is possible; such considerations are akin to discussions in the Victorian era of what air-to-air combat would be. And the infrastructure may never evolve to enable such attacks. The dangers or, better, the pointlessness, of building the infrastructure described below may be visible well before the opportunity to build it will present itself. ... The difference between a semantic attack and hacker warfare is that the latter produces random, or even systematic, failures in systems, and they cease to operate. A system under semantic attack operates and will be perceived as operating correctly (otherwise the semantic attack is a failure), but it will generate answers at variance with reality. The possibility of a semantic attack presumes certain characteristics of the information systems. Systems, for instance, may rely on sensor input to make decisions about the real world (e.g., nuclear power system that monitors seismic activity). If the sensors can be fooled, the systems can be tricked (e.g., shutting down in face of a nonexistent earthquake). Safeguards against failure might lie in, say, sensors redundant by type and distribution, aided by a wise distribution of decisionmaking power among humans and machines. GIBSON-WARFARE The author confesses to having read William Gibson's Neuromancer Note 61 and, worse, to having seen the Disney movie "TRON." In both, heroes and villains are transformed into virtual characters who inhabit the innards of enormous systems and there duel with others equally virtual, if less virtuous. What these heroes and villains are doing inside those systems or, more to the point, why anyone would wish to construct a network that would permit them to wage combat there in the first place is never really clear. Why bring up Gibson's novel and the Disney movie? Because to judge what otherwise sober analysts choose to include as information warfare -- such as hacker warfare or esoteric versions of psychological warfare -- the range of what can be included in its definition is hardly limited by reality. ... Possible? Actually, yes. Relevant to national security? Not soon.

1 0

Re: John Gage's comments at Computer Security Day in Cleveland
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 1 Dec 1995, Dr. Frederick B. Cohen wrote: > John Gave gave an interesting pitch for Java at the CSSI Computer > Security Day sessions in Cl;evelan yesterday (November 30). Among > his comments were: > > Java is not secure - it is "safe" No comment. > He (John Gage) regularly downloads binary executables from the > Internet and runs them on his workstation at Sun - (connected to > the internal Sun network). He downloads executables and runs them while connected to ... Oops, ... no comment. > Sun has terrible physical security - unknown people roam the halls > at night all by themselves. How do they get in the building in the first place?? Someone should think about a MEMBERS ONLY sign or something ... Oops, ... no comment. > In 2 years, you will be able to buy a computer that does more than > a Sparc now does, in a portable package the size of a cell > phone, with more than 30 million bits per second of mobile > bandwidth direct to the Internet, for less than $30. Now this last one could not pass without a deserved comment. How will John have my fingers connect with the cell-phone sized keyboard?? I guess for LESS than $30, I probably shouldn't be moaning and complaining, though ... especially if its energy-star compliant. > -> See: Info-Sec Heaven at URL http://all.net/ > Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Dr. Fred, as usual ... you're a hoot. Your timing is great. And as luck would have it, I've got a Sun open house to go to this Monday for their pre-Christmas shin-dig. The President of Sun Canada, (I think) is supposed to be in attendance. You just gave me some great material to goad him with. Thanks. Even though these social things aren't usually for shop-talk, I think I might just save some of this stuff for use at the punch bowl. (Naah, I wouldn't do that.)-; But it is great material ... and perfect timing ... Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

RE: sooner or later
by Fisher Mark 17 Dec '03

17 Dec '03

>3. A ban will eventually be lifted, because of the impracticality of GAK, >abuses, wide-spread security problems caused by added complexity or >hackers stealing the master keys, ineffectiveness, sympathetic courts etc. >The sooner it comes into effect, the sooner it goes away. But eventually could be 2047 (or 2097)... I'm 40 now. I'd like to live to see the day. This situation starts to unpleasantly remind me of Heinlein's "If This Goes On...". ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Info Foes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://www.ndu.edu/ndu/inss/strforum/z1106.html Strategic Forum THE REVOLUTION IN MILITARY AFFAIRS Martin Libicki, CDR James Hazlett, et al. [Excerpts] DISCUSSION I: STRATEGIC CHALLENGES Those who assess future strategic challenges tend to look to Asian countries, and to categorize competitors as peer, regional, or niche. Asia and the Nation-State Most conference participants believe that, over the next twenty years, the fulcrum of world politics will continue to shift from Europe and its peripheries to the Asia-Pacific region. The period of European dominance produced innumerable wars as various countries challenged each other for power, resources, and sovereignty. With the formation of the European Union and the dissolution of the Warsaw Pact, great power rivalry in particular and the nation-state in general are fading somewhat in importance. The nation-state remains strong in Asia, however. The last fifty years have seen considerable economic progress as various nations have made themselves richer by grasping the secrets of rapid industrialization. This trend, which started in Japan in the 1950s and 1960s, spread to the Tigers in the 1970s, ASEAN countries in the 1980s, and China and perhaps India in the 1990s, has left no Asian country unaffected. Economic growth, however, has not made the nation-state obsolete. To the contrary, the nation-state has been instrumental in creating the internal and external conditions for economic growth. European history suggests that countries, once they taste wealth, will struggle for power. Will Asian countries follow that pattern or demonstrate new models of what the nation-state is capable of? ... Types of Competitors One taxonomy of future threats suggested at the conference is to classify potential competitors as peer, regional, or niche. A peer competitor could challenge our military across the board. A niche competitor would be incapable of doing so, but would strive to inhibit or defeat U.S. intervention by developing capabilities such as primitive weapons of mass destruction, sensor blinders, physical terrorism, information system attacks, psychological operations, or hostage maneuvers. ... DISCUSSION II: OPERATIONAL CHALLENGES Considerable evidence suggests that commercial access to information -- GPS readings, space-based imagery, and Internet data -- could be transformed into military advantage thereby levelling the playing field between ourselves and our potential opponents. Other dual-use technologies, for instance, those that would permit remote piloting of aerial vehicles, permit commercial technologies such as electronic video photography to act as powerful military tools accessible to all (RPVs are made in more than thirty countries). Technologies That Level the Field Does the proliferation in information technologies necessarily negate our current military lead? Information-based warfare creates new vulnerabilities for industrial-age institutions slow to adapt. Because most U.S. logistics facilities and command nodes are not well hidden, they are vulnerable to precision strike. The widespread availability of overhead imagery coupled with GPS integration into weapon systems-- no more than a few years away for countries such as India--poses a serious threat to which our improving defensive measures (e.g., anti-tactical ballistic missiles) will provide only a partial solution . Our own counter-C2 operations are complicated by the rapidly falling cost of bandwidth and redundancy. Even if 90 percent of a bit flow can be interdicted, the remaining 10 percent may suffice for operational uses. Rapid expansion of cellular nodes, particularly through exploitation of commercial space assets, may make targeting and communications denial difficult or impossible. Multiple channels of electronic access will also complicate psychological operations and countermeasures. With the advent of the global information infrastructure, a clever adversary could take advantage of open information systems to enhance its own communications, information, navigation, intelligence, and operational support: examples include GPS, one-meter imagery, weather data, and even CNN. Every year more information with potential military use can be gleaned by anyone from the Internet without leaving fingerprints. How easily can a country's access to the global satellite communications networks be blocked? The coming global information infrastructure will have many points of entry. It will also be difficult to curtail certain services (e.g., global navigation) without denying them to U.S. users or even our own national security establishment. Technologies that Keep Us Ahead The United States, nevertheless, retains an edge in two important areas: space and systems integration. Space systems are relatively difficult to build and although many potential middle-income adversaries can borrow space services from third parties, fewer can own satellites, and far fewer can launch them. Thus the United States will retain a clear edge in the size and sophistication (timeliness and interpretation) of space capabilities, in their adoption and adaptation for military uses, in their augmentation or adaptation for the particulars of future contingencies, and in the assurance of their continuity. The distinctions between data and information, and between information and knowing could also favor U.S. forces. There are vast differences between, for instance, access to meteorological imagery and determining, for instance, that a locus of operations is likely to be fogged in 24 hours hence (a distinction relevant to the Falklands campaign). The art of operational planning is not acquired automatically with the acquisition of computers. Similarly, as sensors proliferate in type as well as numbers, data fusion is likely to become more decisive in future conflicts. ... POLICY RECOMMENDATIONS Two conference threads merit further examination: * U.S. defense policies that make it more difficult for potential competitors to threaten their neighbors and hold off the United States at the same time may be worth pursuing for that fact alone. * If militarily relevant information technologies are everywhere, sophistication at using them may be a better predictor of how challenging a competitor may become for the United States. Therefore, in addition to worrying about how large future foes are (and sizing our own forces accordingly), we should also focus on the potential sophistication of our foes (and develop doctrine accordingly).

1 0

re: SKIP source release is out
by markson＠osmosys.incog.com 17 Dec '03

17 Dec '03

> Doug Hughes writes: [ Perry Metzger writes: ] > > >SKIP is a non-standard being pushed by Sun. > > > > Correct me if I'm wrong, but isn't sun trying to make it a standard > > (in competetion with Photuris) ? Doug, you are correct. SKIP is an IPSEC internet draft. Photuris is an IPSEC internet draft. Perry is incorrect in saying that SKIP is a non-standard. Both of the chairs of the IPSEC group have said SKIP is part of the IPSEC working group. Phil Karn (author of Photuris) has also said this. Both SKIP and Photuris are on the standards track. They are, as you indicated, "competing" protocols. > The IETF has many sorts of standards. It explicitly has a way to > standardize things that the IETF doesn't think are a good idea but > which should have the ability to interoperate if you do them. That's true, but SKIP is not in that category. I believe neither SKIP nor Photuris have been declared "mandatory" as of this point. They both have the same status in IPSEC. > My opinion is that it is fairly clear that Photuris is the key > management system people will be using, although it is going to have > to evolve to work with a real network wide certificate database > infrastructure. SKIP isn't going to be the standard. Again, in *your* opinion. No determination has been made that I know of. --tom

2 1

Re: A newsgroup for exposing Usenet pedophiles
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From nelson(a)crynwr.com Fri Sep 19 08:41:11 1997 Received: by bwalk.dm.com (1.65/waf) via UUCP; Fri, 19 Sep 97 11:08:25 EDT for dlv Received: from ns.crynwr.com by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA24849 for dlv(a)bwalk.dm.com; Fri, 19 Sep 97 08:41:11 -0400 Received: (qmail 31458 invoked by uid 0); 19 Sep 1997 12:43:53 -0000 Received: from desk.crynwr.com (128.153.44.67) by ns.crynwr.com with SMTP; 19 Sep 1997 12:43:53 -0000 Received: (qmail 12012 invoked by uid 501); 19 Sep 1997 12:51:04 -0000 Date: 19 Sep 1997 12:51:04 -0000 Message-Id: <19970919125104.12011.qmail(a)desk.crynwr.com> From: Russell Nelson <nelson(a)crynwr.com> To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Cc: steering-committee(a)usenet2.org, freedom-knights(a)jetcafe.org Subject: Re: A newsgroup for exposing Usenet pedophiles In-Reply-To: <suy0ce21w165w(a)bwalk.dm.com> References: <suy0ce21w165w(a)bwalk.dm.com> Dimitri Vulis KOTM writes: I am now filtering out any mail with the word ``vulis'' in it. You were warned. -- -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom causes peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry.

1 0

Re: DigiCash releases protocol specs!
by Adam Shostack 17 Dec '03

17 Dec '03

| By popular request, DigiCash is releasing the protocol specs. | | The specs are available at | http://www.digicash.com/ecash/protocol.html | | Please be aware that the doccument is work in progess. More | specifications, including byte level descriptions of the message | format will be added throughout the weekend. And of course, you'll be including a description of how you generate random numbers for use in keys and blindings? I ask only because I didn't see a place for it on the Digicash site. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

A challenge ...
by jmhayes＠netcom.com 17 Dec '03

17 Dec '03

I've been challenged to try to find a bank account; I win the challenge if I can wire in $100 to the hidden account. Anyone have any good ideas about how to find an ABA number?

3 2