December 2003 - cypherpunks-legacy

Re: please stop the Mitnick stuff
by Perry E. Metzger 17 Dec '03

17 Dec '03

Gordon Campbell writes: > >When there are one or two small items posted on a topic thats no big > >deal. When its a lot of stuff, it becomes an enormous pain. Multiply > >the few seconds to read and digest enough of a message to know you > >should delete it by dozens of messages per mailing list per day and by > >a dozen mailing lists and you suddenly have an untenable waste of your > >time. > > I con't recall you speaking up against the various flame wars that have been > going on in here lately, Perry. Thats because I largely send people private mail. I try not to nag in public. Just because you don't see me say "this is irrelevant" doesn't mean I didn't notice. Perry

1 0

Re: S.652 (H.R. 1555)
by berkley＠ixl.net 17 Dec '03

17 Dec '03

Earlier today (Mon, 8 Jan 1996), you (Don Gaffney) expressed the following: >I'm not a lawyer, but from what I've read from the WWW site above, it >seems that only providing "indecent" materials to minors is prohibited. >I think this is already illegal. It is _not_ currently illegal, as the term "indecent," in all its vagueness, can be defined as anything from a "Bonnie's Busty Barnyard Buddies" video, to _Catcher in the Rye_, which has been deemed "indecent" by several of this nation's local legislative bodies. >Broadcasting or sending unsolicited "indecent" materials is also >prohibited, but that seems to have always been the case (except that >objectionable materials have been called "obscence" rather than "indecent"). And that is EXACTLY the point. You'll notice that the passage (I believe) in question: "(B) by means of a telecommunications device knowingly - "(i) makes, creates, or solicits, and "(ii) initiates the transmission of, any comment, request, suggestion, proposal, image, or other communication which is obscene or indecent knowing that the recipient of the communication is under ^^^^^^^^^^^ 18 years of age regard less of whether the maker of such communication placed the call or initiated the communication; goes deliberately beyond simply "obscene." Which means that if I were to send my 17 year-old cousin a digitized copy of some "indecent" song lyrics or possibly even information on the AIDS epidemic, I am now facing felony charges from los federales. >There are provisions, as I read it, that protect electronic >intermediaries from the acts of the actual publishers of the materials >(i.e. an ISP is not responsible for the material of other internet sites >not under their control). It seems... But if I let my friendly neighborhood service provider know I'm sending my cousin the electronic copy of Charles Bukowski's "Septegenerian Stew" he requested, no doubt we're both doomed. (...knowingly permits a telecommunications facility under his control to be used for any activity prohibited by paragraph (1) with the intent that it be used for such activity) >It sounds to me like the only real task posed is to authenticate those >accessing questionable materials as being >= 18 years old. Hmmmm. Don't >authentication & crypto go hand-in-hand? No question it is one of them, but the questionable materials are being defined too broadly. >Anyway, being rather foolish I suppose, I don't exactly see what the big >deal is - am I missing something??? Along the same freedom of speech lines, the pending legislation also would make it illegal to use a telecommunications medium to express anything "obscene, lewd, lascivious, filthy, or indecent, with intent to annoy, abuse, threaten, or harass an other person;" meaning if I sent e-mail to a spamming "Get Rich Quick-er" telling him to fuck off, I am now in violation of the CDA. The real bitch is that they can continue spamming (IMO, a worse crime) as I rot away in Lemon Creek Correctional Facility; however, I am not about to propose legislation to limit their ability to do that, either. There is also the matter of allowing the FCC to regulate the internet, which I find equally as disturbing, but I am sure there are people on this list who will be able to express concerns with this far more eloquently than myself. Sincerely, Angus Durocher. ____________________________ It should be an outrage for \_ Angus Durocher people who have never seen a \_ No one of much importance road to be so presumptious as \_ berkley(a)ixl.net to regulate those of us who drive.\________________________

1 0

Anyone using Microsoft Access 95?
by Just Rich 17 Dec '03

17 Dec '03

Have a hackmsoft submission that needs fleshing out. Not enough general interest to post in detail. Basically, you're supposed to be able to spoof the database server as any user. -rich

2 1

Re: Microsoft continues to mislead public about Windows securitybugs (a bit long, with references)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 0:37 1/9/96 -0800, Lucky Green wrote: > >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? Having, in the past, attempted to sell an Operating System with high security features, and failed, I think I can give you some insight. Security does not sell an OS to anyone, even the Department of Defense. People buy OSs to run applications. The only thing a lack of security in an OS will do is allow someone in an obscure department (perhaps called Corporate Security) to say no. Security is a checkoff item, and if you can convince a retired major that the OS is secure, then he will approve it. He is not going to check the details. His expertise is in guard stations and chain link fences. However, if someone, e.g. the trade press, rubs his nose in the fact that an OS's security can be breached, then he will take action. He will pressure the publisher to release a fix that they say will fix the problem. When they do, he will be happy. Microsoft particulary, is oriented to selling product, not pride in workmanship. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Why I think the NSA should love Strong Crypto
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Perry writes: >Once SIGINT becomes much harder regardless of their previous attempts >to stop it, I suspect that the NSA will become a friend and not an >impediment. Well, I often think that institutions and their desire to maintain their funding can lead to strange decisions. On one hand, doing everything to slow the emergence of strong crypto allows the NSA to continue to vaccuum up signals from the world. That would seem to justify their existence. But there are many people who can do this without the assistance of the NSA. The FBI has a crack team. I'm sure every agency can learn to snoop on phone calls. The US Forest Service, for instance, is meeting plenty of resistence out in the American West. I wouldn't be surprised if they have their own internal security unit that has developed the ability to do this. Now, imagine a world with plenty of strong crypto everywhere. Suddenly, cracking messages is a very tough job that requires plenty of computer power and high-powered mathematicians. The Forest Service can't order that up from the Police version of Toys-R-Us. Even the FBI's relatively sophisticated team isn't ready for it. It just takes plenty of investment of time and education. That's why I say that Strong Crypto is really in the NSA's best interest. They haven't had a worthy adversary since the Soviet Union fell apart. But I'm just a wise guy. -Peter

1 0

Re: DNow2> Re: DNow2 Re: Hammill 1987 speech
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings to all from someone on the cypherpunks list. Please don't crosspost threads on cypherpunks + other mailing lists. This thread, in particular, has essentially nothing to do with cypherpunks at this point. Please eliminate cypherpunks(a)toad.com from the cc: on future responses. Thanks. Futplex <futplex(a)pseudonym.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPKyuinaAKQPVHDZAQFoYQf+PKbtkD4P5SmV0JchrkMNvKWfGXLik1mW /0WkUXTZ8rENwozWkrh3cUmzmR0YoMJBLAlJvmcJuzPVIpz8rjTLMhbp2VPeuQct 9/eTT7DOUqrekL0QWzlZP24wMYiHhTQEsMtbKlI3PT55ZMu95L4PJscZsdVG6OQY cX7rJD2xbLYcaxRF04KKm8ajltieDmTmH3/Lk3AOnnB/HFn5ZArCam5PJcWvXFWg kdPQjlW+iUFT+5kuXny5Jug9PTXL37zW8z9OBsKXMGARdeV8vDFiV8HX/ge4SAie qWpgPfuMqHXZbCc1doQdOMv1iuWCUhQH0f2azkNG6UiPurVxqwnCYg== =JcyK -----END PGP SIGNATURE-----

1 0

NSA and NT security
by Corey Bridges 17 Dec '03

17 Dec '03

PALO ALTO, Calif., Jan. 8 /PRNewswire/ via Individual Inc. -- Global Internet today announced that the National Security Agency has awarded them a contract to conduct a feasibility study on raising the security level of Windows NT 3.51 to B-level. Global Internet will analyze Windows NT's ability to meet B-level security requirements, as well as develop a software prototype that demonstrates a Fortezza-based cryptocard access control mechanism. The contract was granted by the NSA under the Multilevel Information System Security Initiative (MISSI), which has the charter to provide security services for information ranging from Unclassified but Sensitive up to and including Top Secret. Windows NT was originally designed with security in mind. A NSA evaluation team has determined that Windows NT 3.5 with Service Pack 3 satisfies all class C-2 security requirements. B-level of security strengthens the C2 level security features while providing stricter system assurances. Global Internet has a proven expertise with Windows NT. Centri TNT is the only network security solution that is fully integrated into Windows NT TCP/IP networks by complementing and extending Windows NT's inherent strengths, while maintaining 100% compatibility with existing applications. Global Internet also has extensive experience architecting, designing and developing high level secure operating systems. "This project addresses anticipated security requirements for DOD, as well as commercial customers using Windows NT," said Michelle Ruppel, a director of the Global Internet Software Group. "Our analysis will address compatibility issues with B-level security requirements and identify the changes necessary to provide this level of support." According to Outlink, Inc., a New York-based research and publishing firm focusing on the information security market, about 80% of the PC hardware market supports Microsoft's DOS and Windows 3.1. This combination, though popular, does not provide inherent security features such as secure login, access control, auditing and self-protection. Strong access control is a highly desirable function of the MISSI architecture. Trusted Operating Systems will play a role in the MISSI success. Windows NT is a modular OS and combined with its current security features that are based on the Trusted Products Evaluation Program (TPEP) C2 level of security and it's ability to operate on the majority of customer platforms while supporting DOS and Windows applications, the architecture lends itself to support B-level requirements. An operating system with few security features allows anyone to use the machine without validating their identity, while allowing access to all files, objects and resources. C2 level security includes: auditing to allow security-relevant events to be recorded and monitored, discretionary (need-to-know) access controls to mediate who can access (read or write) files and other objects and identification and authentication (login) to require users to identify themselves to the system before they are allowed to use the system. B-level security additionally includes: labeling of users, files and other objects with a sensitivity label, mandatory access controls to enforce a security policy based on the labels of the users and objects and trusted path that ensures users they are using the actual programs provided with the system. The Global Internet Software Group specializes in security software for Windows NT networks and other operating environments. The Software Group is a division of Global Internet, a full-service internetworking solutions company focusing on secure, reliable internetworking software and services. Located in Palo Alto, California, Global Internet is privately held and was founded in 1993. Global Internet Home Page: http://www.gi.net. /CONTACT: Jim Adams of Adams And Associates, 408-370-5390, or E-mail: jaadams(a)ix.netcom.com, for Global Internet; or Mark R. Kriss of Global Internet, 415-855-1700, or E-mail: mkriss(a)gi.net/

1 0

Re: The LOGIC of Navigator 2.0 ?
by James M. Cobb 17 Dec '03

17 Dec '03

Steve, I posted a message, The LOGIC of Navigator 2.0 ?, to the list on 01 08 96. That message quoted a couple of paragraphs from a Bloomberg news agency newsstory. The story is headlined, Netscape Will Release an Updated Internet Browser in Two Weeks. The story's datelined Mountain View CA. Your 01 08 96 followup message characterized my original message as "garbage." You posted your message via Best Internet Communications Inc in Mountain View CA... Whatever the significance of that may be, there's the additional matter that you may not understand the significance of the phrase GOVERNMENT LOGIC which I used in my original message. I hope the following provides you sufficient context-- In 02 96 Internet World, science fiction writer Vernor Vinge is interviewed: Suddenly [about 1984] people realized that if a 100 million people each had computers that were one-tenth of one percent as smart as the government's computers, they had much less to fear about government. Now we've entered an era where the government understands this. On the one hand, police forces are legitimately [?] frightened; law enforcement could become much more difficult. But at the same time --with some new laws and technology-- police powers could be much greater than before.... You've heard of ubiquitous computing, but how about UBIQUITOUS LAW ENFORCEMENT? Developing that line of thought, Vinge says: ...the old Clipper chip proposal recommended that GOVERNMENT LOGIC be present in certain communications equipment. For the future I think this aspect of Clipper was as significant as the crypto issues. What would it be like if a certain amount of GOVERNMENT LOGIC were mandated in the design of every host in a country? And Vinge concludes: WE COULD HAVE REAL-TIME TAXATION. and ...very fine-grain CONTROL would be possible. Capitalization in the above excerpts is mine. The whole interview is worth reading. Its title is: Reality & Fiction. It starts at page 82. Jeff Ubois asked the questions. Every HOST in a country? As Larry Ellison says in 12 26 95 / 01 02 96 Computerworld 41: The ideal operating system arrives across a network when you turn your computer on. The GOVERNMENT LOGIC arrives too... Cordially, Jim INCLOSURE: Date: Mon, 8 Jan 1996 16:03:06 -0800 (PST) From: Steven Weller <stevenw(a)best.com> To: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> Subject: Re: The LOGIC of Navigator 2.0 ? Please refrain from posting such garbage on the cypherpunks mailing list. You are not a friend, you are a pest. On Mon, 8 Jan 1996, James M. Cobb wrote: > > > Friend, > > > 01 07 96 the business news agency Bloomberg reports: > > Netscape Communications Corp. said it will release in two > weeks a new version of its popular browsing software, de- > signed to keep the Internet software company ahead of rival > Microsoft Corp. > ... > > The [new] browser can use programs that are stored on cen- > tral computers on the Internet, making a personal computer's > operating system less important. > > > And thereby making GOVERNMENT LOGIC more important? > > > Cordially, > > Jim > > > > > NOTE: The newsstory's headline? NETSCAPE WILL RELEASE AN > UPDATED INTERNET BROWSER IN TWO WEEKS. Its dateline? > MOUNTAIN VIEW, Calif. (Jan 7, 1996 4:16 p.m. EST). Its > Nando News online filename? biz7_1087.html > > >

2 1

Re: SSH for Windows
by Alex de Joode 17 Dec '03

17 Dec '03

: ...can be found at URL http://public.srce.hr/~cigaly/ssh/. FYI. also on ftp.hacktic.nl/pub/replay/pub/incoming/ssh-1-2.zip (the .hr link is _very_ slow) -AJ-

4 3

Don't type: "g**d t*m*s v*r*s"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:35 PM 1/9/96, Kent Dahlgren wrote: >God...are we going to have to endure this like we have had to endure that >stupid g**d t*m*s v*r*s e-mail crap? Let it die. Let it die. I have edited the name of this virus so as to minimized its damage. I read that even _typing_ the phrase "g**d t*m*s v*r*s" in its full form can cause the information stored in the phrease "g**d t*m*s v*r*s" to unpack itself, install itself on all types of disk drives, and then initialize the disks. I hope we caught it in time! (More seriously, I notice that "alt.folklore.suburban(a)c2.org" was in the distribution list for the message I'm replying to (pared out by me on this message). I really hope that this does not mean what I think it means, that "alt.folklore.suburban" is not being copied! The cross-contamination of many mailing lists is one thing, but cross-contaminating our mailing list and Usenet groups would truly be the work of the Army of the Twelve Monkeys.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3