December 2003 - cypherpunks-legacy

Re: "Junk E-Mail"
by Rich Salz 17 Dec '03

17 Dec '03

>RICO is very serious stuff. Criminal prosecution under the terms of the Like Operation Rescue? Wrong again, Alice.

1 0

Re: "Junk E-Mail"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 20 Nov 1995 hallam(a)w3.org wrote: > I think it would be better to slap a RICO suit onto the company > concerned. It sound to me like an attempt to gain financial advantage > through threatening behaviour. Where I come from that means jail time. RICO is very serious stuff. Criminal prosecution under the terms of the Racketeer-Influenced & Corrupt Organizations Act is reserved for very serious situations indeed. It's true "rubber hose" stuff. It was intended as a tool for use against mobsters, but US attorneys have used it against white-collar criminals. I think, you'd have to have strong evidence of an ongoing "criminal enterprise", which I don't think you have with junk e-mail. I doubt that there are many experts in RICO as it applies to computer law. I really don't know if the laws pertaining to breaches of computer security would be applicable, or not, or how RICO really does work or fit. Although the armchair solicitor in me might speculate that you'd have to show some form of organized collusion or somesuch to breach computer or network integrity to prosecute under RICO. And you'd have to show -- I'm uncertain if the standard is beyond a reasonable doubt or not -- that it was at some point willful and well-organized. I suppose that is a moot point though, when we're talking about pre-trial forfeiture of all assets -- right down to the food in the refrigerator. I doubt at that point that a trial would be forthcoming. It really does reinforce the maxim, that it's best not to fight a battle that you cannot win. RICO is very persuasive that way. I'm certain that there will be those who would say that it's not administratively possible to apply RICO to this situation. Most legal advisers would probably say that it can't be done, but I suppose then, that would be the time for the clarion call, "Then get me a lawyer who says it CAN be done." Personally, however, I'm unconvinced, and would defer to those much more knowledgable in such matters. Although, in all honesty, RICO and computer networks in the same sentence literally scares the be-jeebers outta me. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

cryptl99.zip Free encryption library for DOS/UNIX/Windows (fwd)
by Enzo Michelangeli 17 Dec '03

17 Dec '03

Found on sci.crypt, apparently not yet posted on this list. I haven't examined it at all, caveat emptor. The size of the ZIP file is about 148 Kb. Enzo ---------- Forwarded message ---------- Path: news.hklink.net!hpg30a.csc.cuhk.hk!cuhknntp!news.uoregon.edu!cs.uoregon.edu!reuter.cse.ogi.edu!hp-cv!hp-pcd!sdd.hp.com!swrinde!newsfeed.internetmci.com!in1.uu.net!brighton.openmarket.com!decwrl!waikato!auckland.ac.nz!news From: pgut01(a)cs.auckland.ac.nz (Peter Gutmann) Newsgroups: alt.security,comp.security.misc,sci.crypt Subject: cryptl99.zip Free encryption library for DOS/UNIX/Windows Date: 20 Nov 1995 09:57:45 GMT Organization: University of Auckland Lines: 45 Sender: pgut01(a)cs.auckland.ac.nz (Peter Gutmann) Message-ID: <48pjep$7ge(a)net.auckland.ac.nz> NNTP-Posting-Host: cs26.cs.auckland.ac.nz X-Newsreader: NN version 6.5.0 #3 (NOV) Xref: news.hklink.net alt.security:6498 comp.security.misc:5814 sci.crypt:6827 [This was announced a few days ago, I've reposted it to a few crypto and security groups for people who don't read the archives groups] File name: ftp://garbo.uwasa.fi/pc/security/cryptl99.zip One line description: Free encryption library for Unix/DOS/Windows This encryption library provides a universal interface to a number of conventional-key encryption algorithms. The library currently supports encryption algorithms and modes of MDC/SHS CFB, DES ECB, CBC, CFB, OFB, PCBC, triple DES ECB, CBC, CFB, OFB, IDEA ECB, CBC, CFB, OFB, RC4, SAFER ECB, CBC, CFB, OFB, and SAFER-SK ECB, CBC, CFB, OFB. All encryption routines are accessed through a single standardised interface with parameters such as algorithm, mode and key size being selectable by the user. The library is supplied as source code for Unix, DOS, and the Amiga, and as dynamic link libraries for Windows and Windows NT. The design goal for the library was to create an easy-to-use, standardised interface to a number of popular encryption algorithms. Like the standard C file I/O libraries which work with FILE objects, this library works with an "encryption context" of type CRYPT_INFO. To encrypt data, you create an encryption context, load a user key into it, en/decrypt data, and destroy it when you've finished. This concept lends itself to implementation either as a C++ class or as C routines. The library has been written to be as idiot-proof as possible. On initialization it performs extensive self-testing against test data from encryption standards documents, and the API's check each parameter and function call for errors before any actions are performed, with error reporting down to the level of individual parameters. The library API serves as an interface to a range of plug-in encryption modules which allow encryption algorithms to be added in a fairly transparent manner. The standardised API allows any of the algorithms and modes supported by the library to be used with a minimum of coding effort. As such the main function of the library is to provide a standard, portable, easy-to-use interface between the underlying encryption routines and the user software. All code is plain ANSI C, with no machine or OS-specific functions or calls being used. Peter.

2 1

Re: Syrinx Remailer is no more
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is the kind of announcement which really needs to be authenticated. I will leave syrinx on my list until I see a signed message confirming this announcement. If we do not bother to authenticate this kind of message, why bother with all the crypto, here is the mother of all denial of service attacks. -Lance At 7:22 PM 11/21/95, Sam Kaplin wrote: >Effective immediately syrinx(a)c2.org is no more. I no longer have the >time to keep this remailer up and running. Perhaps somewhere down the >line I will set up another one. Please remove Syrinx from your chains. > >Sam -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMLK1+vPzr81BVjMVAQHgoAf/TpVsZ+St9vz4ix5PLaabP60ybJRATE+V t2iBxQmxRqhOcdVPZJU1An5pUdCOCgB3amLXNJXkMnoOasi/0ps3igOw0uFaFUf8 ZgCvM4MfNsdPfduCRfsb+5a1IvTkhmP6oapX9lUXDB5a4nHRQvtXkt96sg2hgaIj sqwPpGFaFvLhkiqQ971CL3+EV4+0GkZ3iH2g5pQ2BD6iACVBReINgCuyi/LiNbvZ yGBguPb38VTCDWbzancgQVrMEzTdwcQrmhfhHDO/5H5g6reWrEMioKGWScTZgxH1 fMs40LXxwu25cUziywYjgw9uhEEQu1K1GY7sVE3CoPPenRfcKAutsA== =c2AJ -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Wed, 8 Nov 1995, Daniel R. Oelke, <droelke(a)aud.alcatel.com> wrote: > > Now were getting specific. These are things that us ordinary folk can do > > which show the 'leaders' how to follow. What software, hardware, > > applications, support and sysadmin experience is required and where is it > > available on what terms. What are the cash flow opportunities to support > > such services? By "cash flow-opportunities", is this the "opportunity-cost" of providing services?? The foregone profits of today. Or is this the future cash flow opportunities which could arise from this type of activity. The future assets of tomorrow? Essentially, doesn't all of this reduce to "valuing" in present dollar terms (i.e. attaching a discounted present value through some appropriate hurdle rate) to some level of future benefit. The real issue as I see it, is finding some way to actually "fund" that hazy discounted present value. > A good service would be to provide and support distribution of > of privacy enhancing tools to universities and companies that > want them. i.e. have people who will help set up firewalls, > PGP, encrypted telnet (pick your flavor), etc. As long as it of course *obviously* excludes product like Netscape Navigator -- the black-box code with significant security holes and flaws -- I'd have to agree that this is in fact a very good idea. But it requires forward-thinking. It's no different actually than paying someone for what they know, rather than paying them for what they do. > Yes - I know that most of this stuff is out there already, > but having people *willing* to integrate it for you without > charging an arm and a leg would go a long way towards convincing the > suits that this is a *good* thing. It sounds good on the surface. In fact the liason officer / integrator might even establish some valuable "working relationships". I think that this form of thinking is what will define who will be long term players in this industry -- and who won't. Those who are able to build "goodwill" will survive and flourish, while the others will flounder. If I may paraphrase, I believe that Dan is speaking possibly of loss-leader services. Services which do not in actuality show presently as "high value-added" under our antiquated systems of accounting and measurement. Services which might in fact reduce short-term "profits" because they are "current-expensed" rather than being recognized as the deferred assets, they in fact truly are. (Essentially, the same problem we've visited with R&D expenses. The problem where the "solution" is defined as cutting R&D expense, so that there is increased "profit", although long-term health and corporate competitiveness is actually weakened. A true management accounting paradox.) There should be a re-focus onto a horizon that is somewhat longer than the current quarter. Or the current day, for that matter, or the current moment. Unfortunately, these types of "forward-thinking" plans and projects all require current funds. Money. And lots of it, before they start showing and generating "measurable" returns. It really is the laying and strengthening of foundations. And who has the authority to spend any money on "wasteful" foundations?? If no one funds these types of projects, either jointly or individually, then these projects and bright ideas invariably go absolutely nowhere. > Dan > ------------------------------------------------------------------ > Dan Oelke Alcatel Network Systems > droelke(a)aud.alcatel.com Richardson, TX Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Applied Cryptography case filings on the Web
by Phil Karn 17 Dec '03

17 Dec '03

The government has filed its Motion to Dismiss, or In The Alternative, For Summary Judgment in the case of Karn vs State Dept. This case challenges the arbitrary Commodity Jurisdiction Request rulings made for the book Applied Cryptography and for a floppy disk containing the same source code printed in the book. I've begun scanning in and HTMLizing the various government documents, some of which are sizeable. As I finish them I'm putting them up on my web page. Please feel free to pass around this URL: http://www.qualcomm.com/people/pkarn/export/index.html --Phil

1 0

Re: Get your own ITAR
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

I just called this number and was given the following instructions: Fax your request to (703)875-6647 Attn Donna Davis, include your name and address. Allow 10-15 days for US mail or include your Fed-Ex account number for faster service. Enjoy, Dan > > 1 703 875 6644. > The kindly administrative assistant there will take your name and address > and send you a hardcopy of the ITAR regulations. I don't know about > overseas mailings. I also imagine you will have to wait until the current > US budget stale-mate is resolved. (Thanks to digest-reader walt(a)osf.org > for the phone number.) > /r$ > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: "Junk E-Mail"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Rich Salz wrote: > >RICO is very serious stuff. Criminal prosecution under the terms of the > > Like Operation Rescue? My apologies, I'm sorry but I don't understand this reference. What does Operation Rescue have to do with the seriousness of RICO? What is Operation Rescue? I am definitely not an expert on foreign statute. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Are there enough FBI agents to handle Digital Telephony?????
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Has anyone ever done the math on the FBI's new wire tapping proposals and determined whether they'll have enough agents to do all of the listening? Doesn't a court ordered wire tap require that people listen in and screen the recordings. Does this have to be in real time? I can't remember, but I think there is a fairly onerous evidentiary chain required to use this technology. For instance, if 1% of America is on the phone during the peak hours of the day, then that puts 2.5 million Americans on the phone or 1.25 million conversations. If the FBI wants access to 1% of that, that is still 12,500 simulataneous conversations. That would seem to imply 12,500 people to listen to the tapes, right? Would that take agents off the streets? 12,500 agents would cost $1.2 billion a year if they each cost about $100,000 in salary and benefits. But we need to account for vacations, shift work and testifying the trials of the drug lords who are sent to jail. Let's assume that you only need 1/10th the people to handle the two evening shifts. That gives you a cost of $1.4 billion before vacations. Adding 40% to cover vacation and weekends puts you close to $2 billion. Let's round up. So it would cost $2 billion just to use the information here. This leads me to believe that they're thinking of building automatic voice recognition equiptment in the future. What does anyone think of the numbers? -Peter Wayner

6 5

toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

[note cunning copy of Alice type quoting style, and cunning use of the same remailer as the last in the chain] On Tue, 21 Nov 1995, Russell Nelson wrote: > anonymous-remailer(a)shell.portal.com writes: > > Alice here ... > > How do we know this for a fact? We don't. As an incentive for Alice to generate herself a PGP key, I hereby place Alice on notice that if she doesn't sign her next post, and provide a PGP key, I will create one for her, and steal all the postive (?) reputation that she has developed so far. You have 24 hours Alice, otherwise a key gets posted to here, and to the keyservers with your nym on it. [someone masquerading as] Alice de 'nonymous ... [who will soon steal her nym (as an experiment in Nym misappropriation, and reputation theft from those who don't use authentication). Evolution in action :-)] ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0