December 2003 - cypherpunks-legacy

SUN, UNIX, et al versus MS standards
by attila 17 Dec '03

17 Dec '03

my only comment on Sun's non-portable software is that it **used-to-be** a case of excessive Berzerkely attitude. Solaris is an effort, and a very credible effort to meet industry and consumer standards. The code is compatible to Sys V R4, and on x86 implementations will execute Sys V R4 binaries, as well as SCO binaries which opens that whole set of markets (software availability). at the Solaris 2.1 and 2.2 levels, Sparc Solaris and X86 Solaris were not even compatible to each other. I just took 200K+ lines of code from a Sys V package and ported it to both Sparc and X86 Solaris 2.4 --perfect. The code also had defines for 4.2+ BSD --those also compiled. Take your pick. Sun got the message on standards; their respone was to meet both; and, they have done a good job of it. Secondly, there is no such thing as bug-free code --that's like free-lunch and it's all relevant. Which would you rather have? patches available on the net, or be forced to upgrade to new bugs with MS plus a few more overkill features. Again, my point is: why bad mouth Sun? This is what has fractured UNIX in the market place and gives the MS assholes the ability to not only stomp UNIX with reviews which always ask "...which flavour of UNIX is it this month?" but, even worse, it gives Gates an opportunity to set YET ANOTHER **PROPRIETY** MS STANDARD --that does not run securely with the mainline. Do you wish to give Microsoft, whose intentions have never waivered from getting a piece of every transaction in the world, **complete** control over everything? on every desktop? In other words, do you want to see Microsoft, and possibly only Microsoft/Intel, in the marketplace. Network managers complained about the Ray Noorda cult, but wait until everybody is forced to join the Bill Gates cult. SUN is not the enemy; MS is. Do you wish to live with MS who, according to the head cultist, **never** issues a maintenance release since the software does not have bugs. Just updates, **expensive** updates, which fix some bugs, add a few overkill features, and introduce new bugs. Is there any really good software for **applications** on UNIX at even close to windows compatible prices --let alone the wealth of material available. Sure WABI gets the main productivity pieces, but PagerMaker and Corel are frozen at Version 5 for WABI. Personally, I use OS/2 as the front end to my Suns; OS/2 is likewise frozen at W3.1 level software --but at least WinOS2 does not crash my entire system or network. I want some of the features in the W95 versions of Corel and Pagemaker, such as HTML --they will never be made available for either OS/2 of UNIX. In other words, we need to stop bitching, and start supporting the alternative systems --constructively. It all comes back to software, and even us techo-freaks, or whatever we are with the long hair blowing all over, need to think about the people who want a simple answer and MS gives the glitter --if we do not help sustain the alternatives, we will not even have the luxury of decent hardware. Even GNU has a W95 and an NT **full pack**.

1 0

Re: cypherpunks at ietf
by Michael Coates 17 Dec '03

17 Dec '03

>> OUR CURRENT PROBLEM IS THAT THE AVERAGE CONSUMER CAN NOT COMPLETE AN > ACCURATE >> SEARCH ON THE WEB. >> >> [...] >> >> AT THIS POINT SO MANY CYBERPUNKS HAVE EMBEDDED SO MUCH GARBAGE ON THE > WEB, >> THAT YOU CAN NOT COMPLETE AN ACCURATE SEARCH. > >Gee: Someone who has not learnt to use the caps key on his computer >cannot do accurate searches, so will everyone else please get off >the net. > >> >> [...] >> >> BUT MORE IMPORTANT, WE NEED TO CLEANUP THE TRASH THAT THE CYBER-PUNKS ARE >> PLACING ON THE WEB. > >Pleasant comic relief. > My guess is; he simply wanted to embarass himself. Don't they have karaoke bars for that sort of thing?

1 0

Re: Attribute-testimony example (was Re: The future will be easy touse)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"cme(a)TIS.COM" "Carl Ellison" 30-NOV-1995 12:34:35.18 Once an element of that set is identified, it can be assigned a codeword (to make parsing easier). ---------- How about an email address? Or a URL? Those can be autodetected easily enough. Plus, the email one could be used to automatically use the appropriate key if reading something from a particular address (whether for decryption or for signature verification). If there are more than one with that address, try all of them and if one turns up looking right (looks like email headers, for instance) use that decryption. That last is even easier with the signature verification, and that can show up the user-specified portion of the field so as to remind you who's sent the message. Sorry if this has been thought of (and suggested) before... it is kind of obvious. -Allen

2 1

Re: VisaCash security.
by ljo＠ausys.se 17 Dec '03

17 Dec '03

<fletch(a)ain.bls.com> wrote: > I think the Visa stuff is basically stored value and >rechargeable smart cards, not really ecash type money. Supposedly >you'll be able to get a card with $10 or $20 on it and all the >vending machines and phones around the Olympic venues will be set >up to take the cards. So to answer your questions, no it's not really >digital cash (like ecash); and yes I think it's probably traceable >to some extent (unless you buy stored value cards w/paper cash). > > First Union, the bank selling the cards, has a page on them: > >http://www.firstunion.com/visacash/ > > Low on the technical info, but they give an address to mail >questions to. A couple of weeks ago I was giving a talk at a conferance on computer technology in financial applications in Stockholm. I mentioned VISA:s electronic purse 'Smart Cash' in my talk and during the break afterwards a representative from a danish bank told me that VISA:s 'Smart Cash' was actually bought from the danish purse/project 'Danmont'. Does anyone know the truth of this, please let me know. Regards, /Lars Johansson ljo(a)ausys.se

1 0

Re: Netscape gives in to key escrow
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

From: SMTP%"tcmay(a)got.net" 1-DEC-1995 12:26:55.99 >With the assumption that this is not a troll, and giving the writer some No, it isn't. >At 10:45 AM 12/1/95, JR(a)ns.cnb.uam.es wrote: >>With regard to all this waving about Netscape giving in to key scrow... > >Key _escrow_, though "scrow" is perhaps just as accurate as the >improperly-named "key escrow" (hint: escrow is something done voluntarily, >not the situation here with GAK). > Yup. I should have said "mandatory key scrow". Sorry for using a shorthand. >Having said this, I think all of the shareholders, either of issued shares >or as-yet-unissued shares, are interested in maximizing share value. Not >surprising. That's the point. They look after *their* interests, not after "public" interest, specially where "public" is a local (as big as local to US may be) interest in a global economy. >Importantly--and maybe this is the real point JR is making--we on the >Cypherpunks list are probably *not* interested in Netscape's stock price. >But who cares? Our role is not to maximize Netscape stock price, but to >talk about what is "right" and what is not right. And GAK is definitely not >right, to the vast majority of us. Right. What I wanted to say was exactly that. >They were "criticized" not because they went public with their stock but >because of their security mistakes, made more important by their sudden The point is not why they were chased but the fact they were. It reflects on further reticences by crypto-interested people to get involved and opens more field to crypto-unaware or uninterested people to gain control of the company. ... >Well, this is the point, isn't it? I doubt there are such things as "tax >reliefs" for Netscape--these things are done pretty much out in the open in >the U.S., and any special tax treatment would be widely noticed--but there >may indeed have been "discussions" with senior management at Netscape. >Several of us have already speculated in broad terms on this. Well, I don't know about what kind of compensation could be offered. Tax reliefs was just a suggestion. What about saying "hey guys, if you comply with our demands we'll set Netscape as the standard browser for the administration. If you don't you won't sell a copy". In any case, the point is that a Government (anY) can make strong pressure, specially one as big as USA's Gov. And facing it is a risky position. ... >First, a viable strategy is to simply do nothing. Ignore the goverment's >protestations, drag one's feet, shrug, etc. Jim Clark could simply have >said nothing. (Recall that Bill Gates came out recently saying that strong >encryption is inevitable...Clark could have either said nothing, or said >something similar to what Gates said.) That may be a very bad move from their point of view. If the Gov. pushes hard, and it is an important customer, it is in their interest to satisfy them. As long as anyone else wants to follow the Gov. it is also good for them to follow those lines, and to be the firsts ones. What about foreign customers? If the Gov. can restrict export of your technologies, they'll move to other providers. It is better for you to pay hommage to the Gov. requests and get to overseas markets faster and sooner than anyone else. >Second, the issue is not "satisfying" a "bunch of cypherpunks." If Netscape >truly pushes for GAK, and people reject GAK and Netscape, then this will >surely hurt shareholder value. (Frankly, I expect one or more stories to >appear in the next few days about the budding "Friends Don't Let Friends >Use Netscape" and "Just Say No to Netscape" movements. Whether this will >hurt the stock is unclear.) The "just say no" movement is OK as long as you don't append "to XXX". It could work if it is only Netscape... But as soon as anyone else gives in (e.g. Microsoft) it will become a burden. It's much better IMHO to ask "say yes to privacy". It's much better to say "this page is optimized for good safety and may not be reliable under non-crypto browsers -e.g. Netscape-" than saying "your browser is bad". Which BTW, may be OK in the USA, but is not in other places. Belgium comes to mind for forbidding negative advertising. And surely others. ... >I say that the ideas being discussed are in fact "constructive" ideas. I >won't reiterate them all here, but they clearly involve concrete action >(e.g., modifying server software to issue warnings to Netscape users, or >encouragement of alternatives to Netscape). Some of them are. Others are not. Others are destructive (like denying access to Netscape users), or unpracticable (like saying "Mozilla is not the best thing" in some places), or unrealistic (like saying "quit your job"), or plain silly. If you deny access to a user, you'll make him/her angry. And not angry with Netscape. They'll be angry with you. We need people on our side. That's basic psicology. I'd go for more pages explaining what crypto is and can do for Joe Random. Many people has said "I can do this or that with my server or whatever". How many people is offering an alternate safe crypto service and making it interesting and desirable for Joe Random? And making it well known? I'd say that not enough. If you can offer an attractive service, protected with another crypto method, and make it popular, people will demand it. If you just add a note saying you use that crypto 'cos Government-enforced crypto is not good enough, people will feel happy and will learn. In general, people prefers positive presentations to complains or problems. Have a look at TV ads. How many of them say "Don't use that stuff, it's shit" instead of "Use my stuff, it's better". That's what I advocate: a positive course of action, offering a better alternative. Not just a storm of complains or "bad karma". >What more are you expecting? Have you been reading what people are actually >discussing doing and actually already doing? > Yes, I've read all along. As I hope will be more clear now. And I have found lots of people saying "I won't support Netscape", "I will say no", "I will deny access to Netscape", "I'll add a complain to my page", "Jim should retract", "Netscape should go back", "Netscape better changes its money-making policy and becomes a political activist", "This or that guy must quit job"... What I was expecting is people to be more realistic, not to forget that the main goal of a company is to make money instead of defending public freedom (which indeed is bad for business), and start promoting better (or not) alternatives. And, to finish, note that I have also seen some very good answers, on which I don't coment since I agree and have little to add to. >--Tim May > jr

2 1

Re: "Got a subpoena?"
by Jay Campbell 17 Dec '03

17 Dec '03

>> "finessing" laws will become more important. In short, they WILL have >> a subpoena--then what? > > Then they'll find out that I don't have any information that >could help them, anyway. What about a court order to (a) start comprehensive logging, and (b) not tell anyone under penalty of ______ . -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

4 3

Netscape, Corporations, and GAK Support
by John Young 17 Dec '03

17 Dec '03

Picking up on Tim's and Atilla's comments on Netscape, GAK, a WTO czar and government regulation of security on the Net: Jim Clark's speech was probably a trial balloon, to see what the reaction would be. Remember that the NIST conference on KE is December 5. It would make sense for the corporations to welcome application of police power to handle threats to public order, in cyberworld like the other. That way they reduce culpability for failures of their private security systems, as they do on private real estate property. Key escrow requires someplace for the buck to stop beyond several private pitstops, and that is usually Uncle Sugar when no other party has the resources to withstand sustained, substantial, culture-wide risk -- as, say, in the financial realm. Internationally, the same need exists. Probably the corporations would like to work in concert with governments on this, so no single firm, or nation, gets stigmatized, or wounded and prey to vultures -- as Netscape was with the brute hack, and as Microsoft and others have been with other attacks on their lightly guarded property, or as the US might be if it does not work out international agreements. Moreover, it has been noted here that government contracts are crucial for a new company -- for testing, for credibility, for prestige. All the major players already have such vital contracts -- indeed most would not have thrived without them -- so why would Netscape, and its investors, not want them too? It's possible that Netscape was selected to sound off on KE to see if it could play with the Big Boys -- take the heat, pass initiation, qualify for the Bohemian Grove bear hugs of assured stability, growth and profits. Could be, though, that after getting stable R/E for his backers, Jim will be confident enough to join Pixar in that rhumba risk of mercurial, evanescent mass-marketers. That's not to be believed now at 7,000 times earnings.

2 1

Re: "Got a subpoena?"
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 11:46 AM 11/30/95, sameer wrote: >> >> What about a court order to (a) start comprehensive logging, and (b) not >> tell anyone under penalty of ______ . > > Aren't court orders part of the public record? I don't quite >know how this would work. I don't think they can keep me from telling >people that I've started comprehensive logging, or at least keep it >from being founnd out. (Legally, that is. I'm sure they could always >use an approach like threatening to audit me every year, threatening >my family, etc.) In fact, most forms of recording need willing participation by at least one party. Wiretaps are the main method of recording information which doesn't involve willing participation of one of those communicating. Since there are no laws regarding participation of service providers assisting the government at gathering information, there is a great deal of leeway legally. If they actually pass a law (as in Penn) regarding ISP obligations it'll probably be fought a bit, but does then put more stress on the situation. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

WTO an even worse possibility as Inet regulator
by attila 17 Dec '03

17 Dec '03

based on an article from the (London) Financial Times [available from John Young at jya(a)pipeline.com with subject line WAY_lad], a very credible white paper is circulating for the WTO to establish an internet CZAR to regualate the Internet and level the playing field world wide. personally, the Feds and the FCC are bad enough --now they want to have a **global** bureaucracy play god -??? are we ready to go back to UUCP?

2 2

Re: Credit card theft Re: The future will be easy to use
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 30 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > What if it's an ecash password getting stolen? Who's liable? (lemme > guess, your money's gone, tough luck!) >From what I remember of the contract, that's true, the bank appear to take no liability for ecash (check the WWW page for the real details). As I'm not likely to have more than about $ 50 of ecash at any time, I'm not *that* concerned about it. Big users could transfer payments back into their dollar account ASAP to avoid most of these problems, just keeping enough in the ecash account to make any payments that may be required. It's not really any worse than physical cash, as long as the software is reliable, which it appears to be (I've lost payments in the past, but cancelling them has always worked to get the money back). > Disclaimer: I don't have a marktwain account at the moment, so I can't > say a thing about the security of the system. I wish them the absolute best > of luck. I do, and yes, from conversations with them it appears that if someone gets your secret key and password they can clear out all the money from your ecash account. This is potentially a real problem for shops, which have to have a secret key file on the machine they run from. Currently this even applies to shops that only *accept* ecash, though there may be an accept-only server out sometime, and I found a way to delete the secret key itself from the file and still have it work (I forget the exact details, you basically zero 256 bytes of the file that contain the key, which appears to be 768-bits according to the debug output, so I don't know what the extra bits are used for). Shops that pay out need to have an *unencrypted* secret key on the server, which is scary, but there's not much you can do about it if you're running on an insecure server... The only way around it that I can see would be to withdraw ecash using a secure machine and upload it to your server, so that the shop could make payments until the ecash supply was depleted and then you'd manually have to withdraw more. Then if someone broke into your account they'd get the ecash, but not the key, and you could limit your exposure to the amount you uploaded at any one time. I'll probably be doing that once the check I mailed over gets into my ecash account. This is strictly my understanding of the system based on what I've been told, so hopefully if I'm wrong then someone from DigiCash will correct me. Mark

1 0