December 2003 - cypherpunks-legacy

Sixth Conference on Computers, Freedom, and Privacy
by Hal Abelson 17 Dec '03

17 Dec '03

Please redistribute widely **************************************** The Sixth Conference on Computers, Freedom, and Privacy will take place at the Massachusetts Institute of Technology on March 27-30, 1996. CFP96 is hosted by MIT and by the World Wide Web Consortium. Since its inception in 1991, the series of CFP conferences has brought together experts and advocates from the fields of computer science, law, business, public policy, law enforcement, government, and many other areas to explore how computer and telecommunications technologies are affecting freedom and privacy. Registration for CFP96 will open on December 8. Conference attendance will be limited. Due to the enormous public interest in CFP issues over the past year, we encourage you to register early. SPECIAL NOTE TO STUDENTS: There are a limited number of places available at a special student rate. These will be allotted on a first-come first-served basis, so register as soon as possible. Events planned for this year's conference include: - Federal prosecutors square off against civil-liberties lawyers in a Supreme Court test of the "Cryptography Control Act of 1996", which criminalizes non-escrowed encryption. - Authors Pat Cadigan, Tom Maddox, Bruce Sterling, and Vernor Vinge divine the future of privacy. - College administrators, students, lawyers, and journalists role-play scenarios that plumb the limits of on-line expression on campus networks. - Panels on international issues in privacy and encryption; on the struggle to control controversial content on the Internet; on tensions between copyright of digital information and freedom of expression; on threats posed by electronic money to law enforcement, privacy, and freedom; on mass communication versus mass media. You can register for CFP96, starting December 8, by US Mail, by fax, or via the World Wide Web. For more information, see the CFP96 Web page at http://web.mit.edu/cfp96 or send a blank email message to cfp96-info(a)mit.edu

1 0

a foot here, a foot there -- pretty soon your mouth is *really* full (was: Re:Netscape, Corporations, and GAK Support)
by Dave Del Torto 17 Dec '03

17 Dec '03

At 11:36 AM 11/30/95, Timothy C. May wrote: >It's possible that Jim Clark--whose quotations I have not yet seen denied >by Netscape--is merely naive on matters of mandated key escrow. It's >possible that he hasn't given it much thought. I watched him in acquisition mode once upon a time and I rather doubt this: I imagine that he's giving this considerable thought (he has the time while counting stacks of shares on his bed every night ;), watching this space and letting the "petty officers" navigate through this reef for now. His statements so far indicate nothing more to me than that he's just playing his cards very close for now so as not to alienate anyone: this is what a captain should be expected to do when the waters are potentially this "dangerous." Why would/should he chop the Feds off at the knees until he knows exactly which way _their_ smoke blows? They're still trying to figure out what the hell we're up to, and if we can manage to stay ahead of their lumbering giants (Freeh, et alia), it'll pretty much stay that way for a long time. Anyway, no policy statements coming from Netscape NOW can be a reliable indicator of where they're going to be -- even in a year -- on crypto policy or on the internal development. All we're seeing for the forseeable future is trial balloons and other strategic positioning. I bet Jim's read the Book of Five Rings... > It's also possible that he >sincerely is supportive of plans for Big Brother to have an "escrowed" copy >of our conversations, diaries, travel plans, etc. Jim may "appear" a tad "hawkish," but he's no dope. Look, a 70% share, even with momentum behind it, can slim down mighty fast with bad choices and lots of fast dogs at his heels and he knows it. Let me put it this way: "the higher they sell, the faster they drop." Tim, you're absolutely right that speaking out NOW (and directly at him) is the surest way for him and others to have data on which to base their future decisions. If there are other solutions for modules Netscape intends to provide (like...NS2.0's Mail module + GAK vs a c-neutral Eudora with an optional MOSS translation plug-in), then he'll lose market share proportional to how much we scream about it in public (I'm doing daily vocal exercises, just in case ;). If he makes enough bad choices, like throwing his full weight behind GAK and other atrocities, he'll end up like DigiCash *would* if they kept/keep the bank protocol hidden. I just refuse to believe he hates his work that much. At the worst, I see a special "gaak" version for the Feds, but I sure as hell wouldn't buy it (and I bought my copy of Netscape). It would be nice to hear from him here directly, though. One can only tolerate so much pussyfooting around before one becomes snippy. dave ________________________________________________________________ "I prefer a _real_ whorehouse to The Theatre." --Dorothy Parker

1 0

Re: Jim Clark, "Mr. Bubble"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex Strasheim: > > 1 Make illegal software available by FTP > > 2 Explain it's doing so because ITAR is bullshit > > 3 Face the gov't down in the press and in the courts > > Go for it. We're behind you 100%. If I were worth billions, if I were the sparkle on the high-tech bubble, if I had a Major hand in engineering crucial protocols, if my company were so young that it hadn't yet had time to bog down in business as usual, I think I probably would. That's a lot of Big talk and a lot of Ifs, ain't it? But that's how it goes: I doubt he -- or anyone else -- would give as much to my LDF as I gave to his (chump change, but more than I could afford). Clark should ask himself what Rabbi Akiva put best: If not me, who? If not now, when? I do my small part, in my small way; he can do his big part, in his big way. One thing scares the spooks more than what they oppose: publicity. Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMINNr3g0mNE55u1AQFnDgH/UJgFGAW9njKTnm7FgJHMQa1J8VONag0v 5JupJbYMISWYHMZ0KbC8ts6GV9jqD7xYg9dWEHhWbFg3SHJ0CFVt6w== =Zza/ -----END PGP SIGNATURE-----

2 1

Re: FW: websurfer 4.6 (fwd)
by James A. Donald 17 Dec '03

17 Dec '03

At 11:56 AM 12/2/95 -0500, Michael Froomkin wrote: >so much for compatibility....guess I'm sticking with netscape for now. Websurfer is intolerably buggy. The latest Mosaic seems pretty good to me. > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: your mail
by James A. Donald 17 Dec '03

17 Dec '03

>At 11:32 PM 12/2/95 -0800, sameer wrote: > I hate to repeat myself, but sometimes people don't listen. >http://www.c2.org/apachessl/ > This Web page fails to explain what Apache-SSL actually is, what it is good for, and why people should use it. Looks like the page was constructed by the same marketing experts as Central Point Software employed before it went under. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

ANNOUNCEMENT: ALICE'S ADDRESS REVEALED.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

As I promised, I've now opened a channel so that anyone who wants to can send Alice de 'nonymous email. I can now be reached via an455120(a)anon.penet.fi. Mail sent to Alice de 'nonymous at that address will get to me, and I will do my best to reply to you as well, but I can't guarantee, anything. And before I get attacked for wasting bandwidth, I've got a deal to make it all worthwhile. A temporary break from GAK talk ... a pointer to a truly HOT website. Here's just a small sample of what you'll find there: :| ELIMINATING LIMBO :| :| "So the pope eliminated Limbo, did you hear?" she says :| "What?" :| "You know the pope, right, well he eliminated Limbo..." :| "When?" :| "I don't know, a while ago." :| "Well that means we're fucked..." :| "You got it." :| "What's Limbo for?"asks Jessica :| "That's where all the people that were around before they had the :| chance to get the word of christ get to go...and unbaptized babies :| that die early..." :| :| "It's not as good as Heaven, but it beats the hell out of the other :| options." :| "How can he just eliminate it like that?" :| "Cause he's the pope..." Check all of this out and MORE at the SCARED SACRED site. You'll be able to read the pope's "LETTER TO ALL THE WOMEN OF THE WORLD". :| "What he wrote a letter to all the women of the world? Man, his direct :| mail expenses must be huge!" :| "Yeah the people in the Vatican are just freaking out..." But you have to be running NETSCAPE. (1.1....NOT 2.0....OR IT JUST WON'T WORK...) Point your Navigators to http://www.banffcentre.ab.ca/ and then choose the --> Media & Visual Arts Page <-- and then from there the --> Artists Web, <-- and then just look for --> VELCRO RIPPER. <-- BE CAREFUL THOUGH IF YOU ARE PRONE TO EPILEPTIC ATTACKS!!!! IF YOU ARE, CHOOSE THE DIRECT ENTRANCE AND ENTER THERE!! YOU HAVE BEEN WARNED!!! Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 2

Re: Do the Right Thing
by James A. Donald 17 Dec '03

17 Dec '03

At 12:22 PM 12/3/95 -0800, Timothy C. May wrote: >Netscape, being the dominant browser company, and Microsoft, being the >dominant OS company, are in special positions to "build in Big Brother." Bill Gates, after some ducking, weaving, and equivocating, has said that GAK is a violation of our right to privacy. Jim Clark has said that GAK is the government benevolently protecting our privacy. I hope to see a "clarification" of Clark's position soon, and I am far from happy with the "clarification" provided by Jeff. > Netscape is becoming the yellow corn of the Web, and an obvious > "choke point" for the NSA and its sisters to mandate crypto policies. > Hence, the role of non-yellow-corn alternatives...) I recommend Mosaic, much improved in its latest release, and, unlike Netscape, standards compliant. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Globally legal Netscape
by fc＠all.net 17 Dec '03

17 Dec '03

If Netscape wants a global product that is completely legal anywhere, all they have to do is eliminate all encryption. The deal they are cutting now is to claim that they provied privacy when they do not. The saddest part is that many people will believe they are secure: -> the credit card companies and ecash banks will charge interest on every transaction to pay for the fraud rates, -> the government will close its grip even tighter on individual freedom and get an even tighter stranglehold on free speech, -> politicians and right wing demogogues will begin to expose individuals for having abortions and reading smut and thinking the "wrong" way. I'm not asking you to believe this - only to look at history and see the parallels throughout time. - The Russian revolution resulted in purges killing hundreds of thousands of innocent people because of their private, turned public, views as expoused in their private writings. - The Soviet government took away personal privacy to keep their stranglehold on their people. - The Chinese government used cameras and other similar privacy-removing techniques to track down the peaceful protesters who stood for free speech in Tien-a-men square. - The Germans under Hitler used personal records to identify and murder millions of Jews and other peoples. These are just four examples of selected from this century! There are many more in each century. Personal privacy - freedom from unreasonable search and seizure - the right to bear arms - all of these tell me that the US constitution secures the ability of Americans to have secure personal encryption in the information age. The president of the United States, each member of congress, and each CIA and NSA and FBI agent swears to God that they will protect and defend these rights as a condition of taking their offices. Those that fail to support the constitution in this way should be tried as traitors. But instead, we see these people coercing Netscape into breaking the law on their behalf. Breaking the law by cooperating with the government in illegal search and seizure, breaking the law in preventing Americans from attaining privacy, and breaking the law by defrauding the public with false claims of privacy protection. This is the time for Netscape to prove itself to the public by taking a stand for the Constitution, for the law of the land, and for the people of the United Stated and the world. If Jeff the Netscape munitions expert sees this, I hope he forwards it to his boss, and I hope his boss considers seriously that he may be the instrument of a totalitarian state arising in the US and throughout the world. It's easy to say that you're not responsible and that it's the government's fault, and that you're just following orders. But there is an old saying - evil flourishes when good people do nothing. If money is what you worship, you can get it by standing on the dead bones of your fellow human beings. Hitler did it, it was done in the Russian revolution, it was done in the Soviet Union, it was done in China, and it will be done again and again, as long as the Netscapes of the world fail to make a stand when it counts. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

4 4

No Subject
by Anonymous 17 Dec '03

17 Dec '03

The recent flap over Netscape and GAK ought to serve as a wakeup call and a reminder of the advantages the anarchstic GNU/FSF paradigm of software development has over the corporate model. No one can control GNU code, and no entity can impose changes on everyone else. If everyone was using GNU browsers and ssl servers right now we'd be safe. Competing with Netscape is obviously something that's easier said than done. But we ought to consider the strategic importance of having robust, free, open source packages for security applications, even if affordable and high quality commercial products exist.

5 4

RE: Do the Right Thing
by Pat Farrell 17 Dec '03

17 Dec '03

I personally believe that this topic does not deserve the heat that it has generated on this list. This opinion could change. I'll have a much better idea Tuesday evening when I've had a chance to hear the latest from NIST on GAK for export. Much of the complaining in September was that vendors didn't want to build two versions, one domestic and one for "export" Netscape is currently doing at least two, and probably closer to ten if you count Windows 16, 32, Mac, Motif, etc. tcmay(a)got.net (Timothy C. May) writes: > Netscape, being the dominant browser company, and Microsoft, being the > dominant OS company, are in special positions to "build in Big Brother." > I'm not claiming they are, just that they are clearly in a position to > make it technologically more feasible to make non-GAK illegal. They both > need to carefully think about the role that's been "given" to them > (whether by fortune, hard work, or being in the right place at the right > time) and do what's right. Except for Louis Freeh and Dorrthy Denning, I haven't heard real people support GAK domestically, although Geoff Grevildinger's pitch at the Sept NIST meeting was 99 & 44/100% domestic. I'll be listening pretty carefully this Tuesday. I think we need to save out fury for real statements about making non-GAK illegal for domestic use. If this starts to condense out of the Ether, I expect that the civil liberties lobbies will get real loud. the ACLU and VTW were both vocal at the September meeting, and EPIC was there, along with folks like Proffessor Hoffman of GW. > And what Netscape agrees to put in future releases of its browsers or its > servers could have dramatic effects on the whole climate. I have no problem with Netscape having a GAK-ified browser in addition to a real one. At least as long as the GAK'd version is clearly identified -- a logo saying "big brother inside" covering 25% of the screen should do it for me. > And if export laws demand GAK in exported products, Netscape should "do > the right thing" and have two versions. It may add to their costs a > little, but it's better than building in the machinery for a GAK law to > later be passed. Netscape is currently doing two (or ten) version. This simple fact seems to have been lost by most of the posters in the past few days. If the issue is just that people don't like the idea that the free, downloadable is GAK'd and that they have to pay $50 for a browser with strong crypto, please take your whining off list. Or find one you like (Netmanage's is too buggy for me, but Mosaic version 2 is quite usable, as is Microsoft's, IMHO) > (Explain something to me. I have never, ever understood why it is a > concern of the U.S. government that we help build in GAK for foreign > governments, that we make sure that products intended for export to > France or Syria have GAK that allows those governments to read the > traffic of their citizens. And if the concern is that exported versions > of software must be readable to the _United States_, then this is a > non-starter in terms of sales in many or even most foreign countries! I'm > sure France will welcome with open arms a version of Netscape that allows > the NSA to read the traffic of French citizens. Oh, by the way, what > legal jurisdictions will be involved in obtaining the escrowed keys of > foreigners? The answers are both clear and murky, if you catch my drift.) The "criteria" (see my http://www.isse.gmu.edu/~pfarrell/nistmeeting.html page) clearly say that approved systems can _not_ interoperate with unapproved systems. This means that exportable systems can not interoperate with, say, PGP. There was talk about having multinational treaties so the French, Iranian, and other "friends" could access the GAK's messages, but that was recognized as being many years out. Diplomacy is slow. It was quite clear from multinational vendors that they thought that non-US corporations would _absolutely not_ accept GAK in the US. The main effect of this stupid export stuff is to drive crypto development offshore. > If the U.S. insists on GAK _within the U.S._, as many of us fear is the > long-term danger, then all bets are off anyway. But I would hope that > Netscape does nothing to make it _easier_ to make this the case! It was quite clearly implied at the September meetings that the Government expected that vendors would do only one version, GAK'd. This would allow the LEAs to tromple all over US civil liberties at will. > A viable thing for Netscape to do is to announce forthrightly that it will > separate the issue of export from what it sells in the U.S., that there > will be NO GAK included in any U.S.-sold packages. The quest for an "all > world" version, freely exportable, should not take precedence over the > civil liberties issues. And I predict that any slight losses in market > share or slight increases in product cost will be _less_ than the effects > Netscape will see if their product comes to be associated with "Big > Brother Inside." I've been developing software too long to accept that the increases in product support costs will be "slight". But I agree that Netscape should _continue_ to have three separate versions, one for domestic use, a second one for export from the US, and the third with Fortessa for sale to Govie agancies that want it. They probably need to add a fourth version, a strong foreign version developed offshore. Tim's suggestion of a formal statement that separates domestic product from export, and clearly leaves GAK out of US products, is a very good one. It is close to what Netscape is doing now, it is completely consistant with current and publically announced policies, and it would let this list return to discussions that are relevant to cryptography. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

2 1