December 2003 - cypherpunks-legacy

Re: Micro$oft and Java
by leefi＠microsoft.com 17 Dec '03

17 Dec '03

| The interesting thing here is a plan to use digital signatures on | controls and scripts as a means of authentication. There was a press release on this. The PR index on http://www.microsoft.com/corpinfo/pr.htm points to a few Internet-related announcements that were made on 12/7. A brief quote on these signatures: "Microsoft plans to propose the Internet digital signature specifications to the W3C and the IETF as an open Internet standard. The technology will be an open, proposed specification available to the entire Internet community. In addition, as part of the Open Process Design Review, Microsoft will host a digital signature design preview in January to solicit feedback from the Internet community." This week there was also another workshop for ~150 ISVs, and these signatures were one of the topics. The event was not under any NDA, so you should start seeing feedback once folks get home and they catch up with mail (at least two were on Cypherpunks). The folks putting on the event have put lots of docs on the "Sweeper" SDK, on the below-referenced web site. Honestly, I'm not sure if all the stuff from the event this week is up there; if not now, most of it will get added in the next week or so. | Servers and some clients will support end-to-end encryption. No details... I believe SSL in current versions of the web browser and server, PCT around the corner (perhaps PCT is earlier than I'm thinking). | Maybe I'll test the search capabilities of the MS Web site later tonight. The clearinghouse for internet developer info (opened 12/7): http://www.microsoft.com/intdev/ It contains info on various VB Script, OLE Control, etc, as they refer to some of our Internet solutions. A page related to this press briefing (I presume also opened 12/7): http://www.microsoft.com/internet/ Hope this helps, Lee Fisher (wondering if I really should've de-lurked)

1 0

Re: Solution for US/Foreign Software?
by Oliver Huf 17 Dec '03

17 Dec '03

> or rational here.) The issue is that, unless written very carefully, > the crypto-less software is a "component of a cryptosystem", > and therefore still requires permission to export. Thanks for the hint. Oli.

1 0

Secrets (was:Is there a lawyer in the house?)
by Adam philipp 17 Dec '03

17 Dec '03

There seems to be some confusion about what the law of the land considers a "secret." Secrets according to our laws are knowledge one doesn not share without a BINDING legal obligation to keep the secret. Remember R4.C? That was a secret until it was shared, and hence lost its privileged position as a "Trade secret." Your secret key is just as safe, so long as it is always kept out of anyone else's hands. However if you are going to provide it to someone else it should be only through some form of contract. Even this might not be sufficient in some circumstances. The only truly safe possibility would be giving it to your lawyer in the course of your lawyers representation of you. NOTE: NOT YOUR COMPANY'S LAWYER. In house council have their obligation to the company, not to you. As such if they felt your key was unrelated to company business interests and possibly adverse to the company's interest...kiss that secret good bye. Sure, the police still need a warrant to go into your house and get the key, but they do NOT need a warrant to ask anyone else for your key, if you revealed your secret to someone who does not have an obligation of confidentiality to you, then they can reveal it with impunity. The danger of revealing it to a nonlawyer who has a contract with you is that they can be forced to reveal it, and still be liable to you for breech of contract... I am sure you see the dangers...just say no to key escrow...much safer. -Adam [NOTE: I am not an attorney, this is not legal advice, you get what you pay for] --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://XXXXXXXXXXXXXXXXX/adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA... |communications are preferred for | | (see home page for definition) |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

Re: Cyberia-L Archive [was Re: ERA_sur]
by The user formerly known as Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.ULT.3.91.951206142028.4575V-100000(a)Networking.Stanford.EDU> you write: >As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived >on http://www.hks.net/ and the public news server nntp.hks.net. !!! As far as I know, Cyberia-L isn't accessable via http from us. Please let me know if it is...if so something's very misconfigured. The nntp part is correct, though. And a bunch of the lists might soon be added to the http archives: cypherpunks is the test message base for it. >Now send them some of the money you're going to make from the stock market. That'd be way nice... Small unmarked bills are preferred. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMgBryoZzwIn1bdtAQGB3gGA15WO7RLcosT3hrjEJN9d0H6Fk0fMu4lG E/cw+h9YZcB6Nk0jiURfceCkBSz4+JSC =TnoU -----END PGP SIGNATURE-----

1 0

Re: PGP
by john.ellis＠wmcmail.wmc.ac.uk 17 Dec '03

17 Dec '03

Does anyone have the source code for PGP (DOS) not Unix, ______________________________ Reply Separator _________________________________ Subject: PGP Author: Daniel 'genius' Charpentier <drcharpe(a)hamlet.uncg.edu> at internet Date: 06/12/95 18:29 -----BEGIN PGP SIGNED MESSAGE----- I've tried to find out the answers to my questions myself but I haven't been very successful. Actually, I haven't been successful at all. First of all, I've been using PGP on my computer but when I tried to port it over to my unix account it didn't work. I took the source code and tried to compile it using the unix g++ compiler but it gave me all of these errors. Where can I find PGP that is already compiled for unix or at the very least will compile for unix? Secondly, if I create a program that makes using PGP more user friendly can I let other people have it ( for FREE )? Lastly, what is considered overkill with cryptography? I don't believe anything is. My programs accept what the user inputs for how large prime numbers should be ( my public key programs ) but I make them able to accept values that go up to 30720 bits ( I don't believe a number can ever be large enough ). You can never be to safe...never. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMXVhDMGe42brZbVAQEo/Qf7BSshqKJAmxVzyGSyAp2Qkj+/dqh1Zon1 xDqMnvU6ihLimHZ/uXGiQE2jM6N8FRbYu7psQ/iPJ+gX5/VKfrxlxjCfDM0Jx2s9 vucgMQz1KYbELA8Fo1QUEsDuTMzJ80VoTicXfZZmILhr7cBJH4pHa5RgkgrS2Lun iodQ+F7BXdio86TnctQgoKJ+78qOYDuV4Vfha/a290ZoZmPRcqArYv7tU6X3KMjf DGxqgugiwpHnkTO1B9wypoePbbJZSNzFYYvZKMI8Ntg7yFkMl/lSxcLh6oYq0ACe R9NfZR9x11H/fIrn8HZlq0Q86OptWhZz53p77VNN+sVZJOktHJIWqg== =WK6x -----END PGP SIGNATURE-----

2 1

Re: Is there a lawyer in the house?
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May wrote: > Sameer Parekh writes: > >How is this different from > >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, > >you need to give it to me. I don't have a warrant." > > > But I share Sameer's confusion. If cops show up at my door, they must, it > seems to me, present proper warrants before they can _enter_ my premises, > or _search_ my premises. Something given to me, whether a letter, a key, a > photo, etc., is essentially *my property* and may not simply be taken away > from without due process. What's important here is the difference between things and information - if the cops want to get *things* in your possession, they need a warrant or consent or exigent circumstances or whatever. If they want to get *information* in your possession, they can subpoena you and make you talk (or show them the papers/records/whatever, modulo the Fifth amendment, modulo immunity). Either way, the standard for due process (essentially nothing for a subpoena - "more likely than not will lead to the discovery of fruits of/evidence of a crime" for a warrant) is pretty minimal. But, it's worse than that: as a matter of federal law, if I write "I, Greg Broiles, killed Jimmy Hoffa and hid his body in one of the concrete columns used to construct Giants Stadium", and give that piece of paper to you, and cops search your house illegally and find that scrap of paper, the information on the paper (if not the paper itself) can be used against me, even though it was found in an illegal search. I wouldn't have "standing" (e.g., a legal basis to contest the search) because federal law doesn't think I have a privacy interest in the stuff in your house. I think that's the tricky bit behind the idea that there's no (personal) expectation of privacy where a key is given to an escrow agent - the standing requirement. State constitutions and statutes may provide a higher level of protection - Oregon's constitution, for example, is interpreted to be more generous re who's got standing to contest the legality of a search. It occurs to me that the owner of the key might have a good argument that they've got "third party standing", where they can essentially adopt the position of the key's owner, because the key's owner is in a position such that they can't do a good job of representing their own interests, and the third party will. (e.g., the doctor(?) in _Eisenstadt v. Baird_) The owner of the key (at least if they're anonymous, and the key server is served with a subpoena to "disclose the 'true name' of the owner of key 0x58ddf30d") may wish to avoid revealing hirself. Hmm. That, of course, assumes that the escrow holder feels like fighting the subpoena - perhaps that's something to look for when you go escrow shopping. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMgNC33YhjZY3fMNAQGPPQP+M7IFM/DgfEf6z5f8YUoBHo+aXPfTzwtf xee1SPkJOxfH7dYaUIKs7JDAKxOGTaNdrlJjrMno7yHVFVHq6R7wRw8jOPUXhJ3C VZ94LpTqNF6OPPoD+pr2MFG+SaFLl7JyS16Kbe9ilUE5cG6N2hToUibSjwyz3BKc R95RR9TkRzs= =4jN1 -----END PGP SIGNATURE-----

1 0

Re: Geodesic Payment Systems?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:40 PM 12/7/95 -0500, Nathaniel Borenstein wrote: >None at all, if you can find an underwriter who is comfortable with the >fact that his investigative options will be limited in the case of >suspiciously large or suspiciously frequent "cash out" events from a >given customer. Apparently Mark Twain Bank finds that risk acceptable. >I'm sure the larger banks will be watching quite closely. I seem to remember from my favorite Law School class -- Commercial Paper -- that banks weren't liable if they paid out an account from cleared funds under the terms of the account. A bank is responsible for payments made on a forged drawer's signature and anyone who accepts an instrument from a forged endorser eats the loss. But online clearing with digital signatures makes it hard to forge the drawer's signature and digital cash doesn't have the sort of endorsement system used on paper checks. DCF

2 1

Re: [NOISE] Re: FW: websurfer 4.6
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Thu, 7 Dec 1995, Ed Carp wrote: > > On Thu, 7 Dec 1995, Rich Graves wrote: > > > > Its interesting to note that all the people that were raving mad about > > Java seem to be quiet now that MS is proposing to use VB. At least Java > > was designed from the ground up with security in mind. But VB? Java was not designed from the ground up with security in mind. Not by a long shot. It was an incubator project. I know that. And the Java team knows that as well. And the ones who WERE raving about Java -- myself and others -- might simply be attempting to speak to Sun through some non-public channels. I, as an example, have tried to speak with my local Sun software manager, Warren Strange, about Java and voice some of my concerns, that way. (Yep, that's his name ... "STRANGE" ... what else would you expect with a company who's Canadian subsidiary is run by an "Everett", and who has a Vice-President named "Tribble".) Mind you ... I got absolutely _nowhere_ with Mr. Strange. I think he said that James Gosling was WAY too busy (as was he), and that the last time he had checked Gosling had 800 email messages in his mailbox, and that I should probably post my questions to comp.lang.java, if I expected any answers. I really didn't have the heart to tell him, that I generally avoid comp altogether, and stick primarily to the alt hierarchy -- especially alt.fan.alt.bigfoot. Strange as that might seem. Then again, I tried to have a bit of quiet time with Everett after Monday's Christmas party, but he never had any time for me. Too busy, I guess. He was running off to shoot snooker with some of the boys from Oracle, I think. I think that takes precedence over customer concerns. But the party was a smash. They even had a guy doing magic tricks. Shame I didn't bring any business cards with me to a social occassion. Guess, I just wasn't trained right. But I _did_ get a nifty Java T-shirt and a snazzy pin. So it was worth it. And the smoked salmon was an unexpected surprise in "It had better be Beef" Alberta. It was a very nice touch. I also tried to talk to a Sales Representative (grin) about this -- about Java security. Poor man. I think he was almost tearful, when he snapped at me, "Why don't you attack Microsoft instead??" So, I guess I might just do that, here. Does anyone besides me, see a sucker-punch in Microsoft's announced support for Java?? Support for a competitor's product?? I certainly do, especially from the way I saw the press presentations fly out over the airwaves. The media coverage seemed not to convey the "right" touch of sincerity. It seems like Gates wants to support and promote a product as being appropriate for something that it isn't suited for, and isn't designed for, while having his very own own fall-back position with VB. A sucker-punch. Or at least that was my perception of it. I don't know about anyone else, here. I wonder whether anyone from Sun smells a rat in Microsoft going this route. It seemed grossly out of character, for Microsoft. Major paradigm shifts such as this are truly unusual for large firms. Especially Microsoft's IETF comments. The frosting was just a little too sugary and thick, I think. > And all this from a software company that took over 10 years to make > their "operating system" do preemptive *anything*. It worries me when a company promotes another company's product heavily, while only embracing it partially. Then again, what would I know. I can get suckered into writing about Microsoft's puffery by a single tearful Sun salesman. Well, that, and some smoked salmon ... guess that rules me out for a security clearance, huh?? Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. > > But I guess I shouldn't complain. After all, VB has made me a pretty > decent living for the past year or so... > :: Request-Remailing-To: cypherpunks(a)toad.com Subject: Re: [NOISE] Re: FW: websurfer 4.6

1 0

Java musings
by fc＠all.net 17 Dec '03

17 Dec '03

Excellent musings. I just wanted to add something here. There is a fundamental issue with Java, and that is control: People in charge of organizations are responsible for what goes on within them. Without proper controls, it's impossible to carry out that responsibility. The people who want us to use Java are asking us to give up control over the programs run by our computers. They tell us to trust them because they say they have come up with a nearly fool-proof system for doing this safely. - They don't claim it's really secure, they only say it is harder to abuse than a C++ program. But nobody in their right mind would make it organizational policy to allow users to load and run C++ programs from over the Internet at the push of a button, and the removal of the particular things removed by Java are not adequate to justify this increased trust. - They won't back up their claims of security by assuming liability for resulting damages. Their liability disclaimers tell us they think their security is worth exactly nothing. They are asking us to bet control of our IT on a product that they take no responsibility for. - They don't even provide us with the ability to control their product in the way we control other purchased software we place into our environments. The inability to restrict which programs from which sources are run on our machines is a fundamental element of control. - Their product has been proven to be insecure in the past. Several examples of its insecurities have been demonstrated, and many more have been pointed out. There is essentially no counter point made by the Java supporters against these known defects. It seems to me that the loss of control resulting from the widespread introduction of Java would make it unacceptable to business. The use of Java as it exists today violates the policies of many businesses, and if their policies are ignored or changed to permit this to happen, it weakens the overall control structure of the organization. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

@v@ XXX
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Wall Street Journal, 8 Dec 1995 On-Line Society Angered by Plan to Curb Content By Jared Sandberg The latest move in Congress to curb "indecent" material on the Internet triggered outrage and scorn in cyberspace, as on-line users decried it as censorship and plotted ways to overturn it. "Welcome to the age of electronic book burning," said Craig Johnson, a consultant who worries that the term "indecent" could be applied to literary works, publichealth and medical exchanges, and serious discussion of AIDS and sexual behavior. "It's not only ridiculous - it's unfair, un-American and unconstitutional," said Eileen Kent, vice president of new media at Playboy Enterprises Inc. She finds it "incomprehensible" that the on-line version of Playboy could be deemed illegal while the printed magazine isn't. "Are they going to send me to jail and fine me a hundred grand because I put a Playmate on the Net?" she asked. If so, "then I'm quitting." House conferees hammering out a sweeping telecommunciations bill voted 17-16 on Wednesday to make it illegal for anyone to knowingly display indecent material that can be viewed by a minor, punishable by a $100,000 fine and up to two years in prison. Yesterday, critics tried to counter punch. The American Civil Liberties Union is preparing a court challenge on First Amendment grounds. The Center for Democracy and Technology, a cyberspace civil-liberties group, vows to do the same. On-line services drafted a letter of protest to House Speaker Newt Gingrich, who has opposed earlier attempts to impose restrictions on Internet fare. On-line advocates also are pushing for a new vote by the House conferees to define just what "indecency" means. They are hoping the 17-16 balance of the first vote is tenuous enough to allow them to ease the restrictions in defining the terms. Backed by the hectic lobbying efforts, Rep. Rick White of Washington state, who favors a less-restrictive approach, and allies have begun laboring to devise a limited definition of indecency that would be acceptable to civil libertarians and smut-fighters alike. Without a clearer, limited definition, the "indecency" standard faces the almost certain prospect of being struck down by the courts as unconstitutional, the White forces contend. On-line experts, moreover, argue the latest measure could create big problems and unintended consequences. If one 16- year-old zaps lewd fare to another, could the sender be imprisoned? If an adult makes a racy observation on an electronic bulletin board and a minor tracks it down and reads it, should the adult be punished? Last week, America Online Inc., in an effort to strike vulgarity from members' personal on-line "profiles," decided to strike all uses of the word "breast" - and thereby erased the biographies of scores of women who had breast cancer. AOL "responded to the climate of fear created by Congress," Mike Godwin, legal counsel for the Electronic Frontier Foundation. An AOL spokeswoman said the deletions were "a mistake on our part." Robert L. Smith, executive director of the Interactive Services Association, said such snafus could occur more and more as Internet access providers fret about whether their so-called content might be deemed indecent. "It's going to cause confusion, industry uncertainty and years of litigation, which will result in Congress not solving the problems they wanted to solve," Mr. Smith said. The crackdown effort, moreover, may be fruitless in a global computer network that reaches more than 150 countries. "Those American laws don't apply to me," said Patrick Groeneveld, a professor at Delft University in the Netherlands. Mr. Groeneveld, who once ran a popular Internet archive that included pornographic material, said Congress's efforts amount to U.S. "imperialism." "I didn't vote for America's congressmen," he said. "Legislators and some consumers don't understand the Internet," said Jerry Berman, executive director of the Center for Democracy and Technology. "So, it becomes an easy target for political posturing." -- Albert R. Karr contributed to this article.

1 0