December 2003 - cypherpunks-legacy

PGP signature legal standing?
by Russell Nelson 17 Dec '03

17 Dec '03

Is there any legal standing for a PGP signature? I'm tired of my luser customers faxing me legal documents, then expecting me to sign it and fax it back. Yeah, right, like photoshop can't cut-n-paste. I've got a fax modem on my Linux box, so I'm going to start (in fact have started) uuencoding the .g3 file, indicating my assent, and emailing it back to them. -- -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom causes peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry.

3 2

PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Date: Nov 6th, 1995 Contact: Sameer Parekh 510-601-9777 sameer(a)c2.org PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE Two Princeton University grad students, Dan Wallach and Drew Dean, recently discovered holes in Sun Microsystem's HotJava web browser. In response to this finding, Community ConneXion, well known for offering rewards for exposing holes in internet security products, has decided to award them with a t-shirt and expand the Community ConneXion Hack line of promotions to include Java and Java-related products. Sun's Java product is alleged to allow people browsing the World-Wide-Web to execute programs on their own computers without worrying about whether or not the programs were viruses or not. The holes Wallach and Dean found show that there are a few things in the HotJava alpha implementation of the Java language which make viruses and other malicious programs possible within the alpha HotJava web browser. "We were very impressed with the HotJava concept, so we thought it would be good to poke around their implementation," said Wallach. "While we did find some interesting holes, we believe these can be addressed and Java could make a good standard for remote code on the Web, if an effective security policy is defined." Wallach and Dean released their findings initially in the RISKS Digest, and plan to publish a paper detailing their results. The holes they found make it possible for a malicious applet to set things up so as to be able to monitor or modify all of a given web-surfer's activity, after they ran the malicious applet exploiting the holes. By doing so the applet may make it possible to violate user's privacy by revealing to an third party their web traffic. The holes they found exist only in the alpha release of HotJava. The beta release, which is the version found in the widely-used Netscape Navigator 2.0b1J is not vulnerable to these attacks. "I don't want to be in the t-shirt business," said Sameer Parekh, President of Community ConneXion, "but we felt that these students' work deserved a t-shirt. Java has great potential for making the Internet much more powerful than it already is. It is very important that we examine Java and make sure that we can trust it." Community ConneXion, in addition to this Hack Java t-shirt promotion, is offering t-shirts to people who find holes in Netscape, Microsoft, and DigiCash. Information about the Hack Java promotion is available from http://www.c2.org/hackjava/. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org/ or from sending email to info(a)c2.org. Java and HotJava are trademarks of Sun Microsystems, Inc. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. The Hack Java promotion is not affiliated with nor sponsored by Sun Microsystems.

1 0

Crypto-law etc
by Chuck McManis 17 Dec '03

17 Dec '03

The longer I follow the crypto "debate" the more I begin to understand what must have been the real intent behind the 2nd amendment of the constitution. If the White House can get crypto code defined in the true legal sense (that is backed up by case law) as a munition, do US citizens then have a constitutional right to "bear" it? Just curious, --Chuck

3 2

SSL-encrypted apache web server available for beta-test
by sameer 17 Dec '03

17 Dec '03

I put together an SSL/Apache using mostly other people's work, but some of my own. It's available for beta-test to use non-commercial to US-persons. See http://www.c2.org/apachessl/ The README is attached. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org "I don't want to get into the t-shirt business." The release of Apache supports SSL, using Eric Young's SSLeay package and RSADSI's RSAREF cryptography library. Ben Laurie <ben(a)algroup.co.uk> wrote the interfaces to SSL within the Apache server, which was developed by the Apache Group. This release of Apache-SSL is maintained by sameer <sameer(a)c2.org>. For more information on sameer's releases of Apache-SSL see http://www.c2.org/apachessl/. For more information on Apache see http://www.apache.org/ For more information on SSLeay see http://www.psy.uq.oz.au/~ftp/Crypto/ For more information on RSAREF see http://www.rsa.com/ Portions developed at the National Center for Supercomputing Applications at the University of Illinois at Urbana-Champaign. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. Use of this software is allowed for non-commercial use only, as described in the RSAREF license. For information on commercial use of this software, please see http://www.c2.org/apachessl/. This package is using Apache 0.8.14 -- not the most recent version of Apache. While every effort will be made to keep this package up to date with the most recent Apache version, that can not be guaranteed.

1 0

Re: [noise, personal reply] CBC address.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

A post from Alice, that might be worth reading twice ... On Sun, 5 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > > On Sat, 4 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > > > Does anyone on this list know if the CBC has a web site on the Net? > <www.cbc.ca> They have a lot of shows in .au (so I hear) or accessible by > realaudio. Don't know if they have any mpigs [sic] though. There's an alt > newsgroup too. Uhhm, thanks ... I guess ... but I wasn't _really_ looking for the CBC web site. I was actually looking for someone to HOST a website which might showcase one particular program from the CBC, a program broadcast in Canada which highlighted how AECL (Atomic Energy of Canada, Limited) fails to practice safe computing and then when confronted, implements a calculated program of strategic misrepresentation. (i.e. they lie.) I thought that someone who strongly felt that error-free protocols and error-free methods were important -- especially in mission critical applications like medicine, commerce, or nuclear power plants -- might possibly contact the CBC, and either voluntarily donate some bandwidth and a host site, or conversely build a site devoted to showcasing the human tragedy that can follow in the wake of shoddily designed software. I mean, good grief, we have Atomic Energy of Canada taking a cavalier attitude towards computer code. Not only is AECL involved in nuclear medicine, in building wonderful radiological tools to help cancer patients (theoretically) live, but they BUILD nuclear reactors worldwide. The CBC broadcast documented how this international firm REACTS to reports of computer software errors. It documents how the firm reacts to reports of people dying because of sloppily written computer code. The program is NOT (unfortunately) on the www.cbc.ca website, but should be placed on the net and made available. I'm not sure how, that was misunderstood. But your next statement helped make it clear. > You oughta use Sameer's (or someone else's) replyable remailer when asking > questions Alice. I wasn't really asking for an answer, my Ottawa friend. I really wasn't looking for _another_ email in my mailbox to answer and address in my copious spare time. I was looking for some assistance. No direct reply was necessary. Someone could simply announce that they were volunteering to quarterback bringing a host website online, and dealing with all the issues that are involved with that (including liasing with the CBC.) I'm not *quite* sure how you misread what I was hoping to achieve. If however, you were looking to convince me to post to from a remailer that allows replies ... one that might let you send me known plain text back through it ... something traceable back to me ... then I *might* really understand, and I might beg off for a bit. Bit premature, and such ... I think I'll pass on _that_ offer, especially since I really wasn't looking for a personal private reply to what I wrote. Maybe, if I requote myself, it will be a little clearer all around. (That's, strike two, btw ... to my Ottawa friend.) Here's what I wrote: > I know that it is rude to follow up one of your own posts, and I > apologize in advance for this horrible faux-pas, but hopefully, it's > excused this one time. I wrote: > > > >One example of this that should serve as a useful case study is a recent > >problem which was brought to the Canadian public's attention just this > >week, on a program called the Fifth Estate. The CBC (Canadian > >Broadcasting Corporation) detailed a software code problem in one of > >AECL's (Atomic Energy of Canada Limited's) instruments which deliver > >penetrating radiation. > > > >The software which controlled the radiation dose, would periodically > >override the oncologist's calibration and deliver a radiation dose 100 > >times what was prescribed. This software "bug" literally killed wherever > >the machine was in use. > > Does anyone on this list know if the CBC has a web site on the Net? > > I'm hoping that someone (hint, hint) who has a convenient website, one > with lots of spare bandwidth could volunteer to contact the CBC and > persuade them to copyright clear the Fifth Estate program clip which > documented some of the risks of software bugs in mission critical > applications, and allow it to be placed on the Net. I'm hoping that this > English language piece reaches a wide international audience. > > The Canadian Broadcasting Corporation is a Crown Corporation which has > historically received its primary funding from the Government of Canada. > Recently, it has suffered under the budgetary ax, and the push for > privatization. I'm pretty confident that the Corporation would copyright > clear the clip for MPEG distribution across the Net, if they were > approached with the concept that the clip was a demonstration of the CBC's > journalistic excellence and integrity, a piece which is demonstrative of > the critical need to continue their funding. A concrete demonstration of > the need for the CBC. And a piece which could well receive deserved > international acclaim. > > The site would help them, and would simultaneously be a site of > international public service. > > Nothing will drive home the need for quality software, quality code, and > quality security more than the vivid graphic pictures of the consequences > of sloppy code, or of the risks if certain critical systems, LANs, or > private networks are compromised, or if security and privacy (which are > flip sides of the same coin) are ignored. > > The sight of a body, that has had a hole burned straight through it from > the front through to the spine is truly chilling and drives the message > home. Nothing seems to speak as clearly as a picture ... as to what the > stakes are ... of what "bugs" in code do ... and of what a network > compromise can leave in its wake. > > A picture of consequences. > > Six people died in Canada and the United States due to the software flaw. > Even after numerous reports of the flaws, the company refused to even > acknowledge the existence of a problem, and in fact did everything within > its power to make sure doctors, radiologists and physicists were unaware. > > The attitude of trivialization can only be characterized as fantastic, and > would be unbelievable to anyone who has not viewed the piece. > > It's one hell of a backgrounder which not only details problems, but looks > at solutions -- it examines attitudes, especially management attitudes. It > truly deserves an expanded audience. From teachers, to students, to the > international media, to the concerned private individual, all will be > served well if this piece gets wide attention. > > Takers, anyone?? Now, how on earth, (after rereading what I wrote) did my words get misunderstood?? And how on earth did someone figure that they needed to establish a bi-directional communications channel with me?? I mean it's not like I'm atacking AT&T or Netscape, I'm simply trying to coordinate a basic public service, and blow the whistle on bad code. Blow the whistle on software which people expect (rightfully) to be reliable ... software which people expect (rightfully) not to cause any human harm. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

New sendmail coming on toad.com; expect disruptions
by John Gilmore 17 Dec '03

17 Dec '03

Hugh and I will be installing a new sendmail on toad over the next day or two. You can expect some delays and troubles from the list over that period as we shake it down. We hope that the result will be faster and better service for y'all. John Gilmore

1 0

Re: toolkits?
by tcmay＠got.net 17 Dec '03

17 Dec '03

The most common typo (of any significance) I seem to make is leaving out the "not" in a strongly worded statement: >You may have gotten no responses because it generally is not up to a state >government to ensure that "mediocrity" in the Internet is avoided (though >I'm not sure what is meant by "mediocrity." If it is security and >anonymity, this is definitely the state government's responsibility, or ^ not >even area of interest.) It's almost as if I'm "leaning on the horn" so much as I'm typing, that I leave out the all-important "not" modifier. My apologies. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Recovering lost coins in ecash
by szabo＠netcom.com 17 Dec '03

17 Dec '03

> One problem a number of people have reported in DigiCash is disappearing > money. Several people have reported that if a transfer is misconfigured > the cash can flow out of the wallet, be rejected at the other end and > disappear from the system - i.e. misprinted names on cheques mean lost cash! These users need to learn the features of the software. Backups of spent coins are retained in the payment history ledger. Select the payment from the ledger, and hit _Cancel_ to cancel the payment. This credits the lost coins to your account. The story behind this (which is, alas, not so apparent to the user) is that this essentially spends the coins at the bank, so that if they were lost, the amount will be credited to your account. If the coins were already cleared and credited to the payee then you ask the payee for your money back (or to properly deliver the purchased service), relying on their business reputation (ie, complain loud and publically if you don't get satisfaction). For the latter case an escrow service would be a useful third-party add-on to the basic ecash system, to allow exchanges in larger amounts without incurring this risk from the payee. This bit of electronic magic is one place where ecash is superior to physical cash -- but at the expense of not being obvious from the metaphor. It also illustrates the superior flexibility of online clearing -- double spending is used as an error recovery tool, to find out whether the payment was in fact lost, rather than as an indication of fraud. Nick Szabo szabo(a)netcom.com Internet commerce consultant

1 0

Re: Java insecurity - long - argumentative - you are warned.
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> > While all this checking appears excruciatingly detailed, by the time >> > the byte code verifier has done its work, the Java interpreter can >> > proceed knowing that the code will run securely. Knowing these >> > properties makes the Java interpreter much faster, because it doesn't >> > have to check anything. > >Yikes!! I'll leave this for someone else to address. This sounds to me >like a variation on virus scanning. I think that there are far more >reputable virus experts than I who can comment and expand on *flaws* with >that approach. This "checking," as any comp-sci undergrad will tell you, amounts to solving the halting problem for the java interpreter. While this is possible for a finite state automata like the java interpreter (made more difficult by the fact that it can use the "net" for additional state), it is not even remotely feasable. If you can write a checker that works in a reasonable amount of time, I'll write a turing machine simulator that'll do something nasty if the input machine halts. Then we'll split the fame and fortune for solving the 5 state Busy Beaver problem. Deal? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMJ8gtXIf3YegbdiBAQGqMQJXWzwuPYM2bNb96Fgfb1wGeDC83fNFOW5H 8PQHbnt8bDFsHxKv2L8kcBhtO/TWA0cugVYR9YFf2BOaGoA2UIoCBdwfABM1HAKU hd0H =TA2E -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

2 1

Re: censored? corrected [Steve Pizzo cited in The Spotlight]
by Rich Salz 17 Dec '03

17 Dec '03

>Sorry. But still, then intent was to be user-friendly (right?), and >a side effect was to make it possible to renumber without anyone noticing. No. DNS was created because the management of everyone editing and downloading one huge file was just falling apart. The Arpanet always used names instead of numbers. Moving hosts around was always possible. CIDR doesn't affect that fact that if nntp.com switches, say, to BBN Planet then I will have to get a new address. CIDR just says you can route based on smaller/larger granularity than IP Network Address classes. >That's the connection between DNS and routing, and it's why using names >instead of numbers is Good. There is no connection. Using names instead of numbers is good. It does bring up an interesting philosophical question about where the True Name really is. And how DNS must be part of your TCB unless/until you have end-to-end mutual authentication. /r$

1 0