December 2003 - cypherpunks-legacy

Re: Cyberspace Inc & Robber Baron Age
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> Instead of an infrastructure for public communications -- like > the current Internet, or the American highway system -- cyber- > space would be developed as a corporate owned monopoly -- > priced at whatever the traffic will bear. More technophobic hogwash from an industrial-centralist mind. Anyone who looks at the possibilty of semi-autonomous, hell, autonomous, software out there buying and selling things "out of control" of the people who use it, much less those who wrote it, in an emergent-structure chaotic microtransaction market, on a network where the price of semiconductor switching falls exponentially, making everything, code, hardware, link-lengh, everything, smaller and smaller and faster and faster, (inhale) can't possibly say stuff like that. These folks are looking backwards so far they're going to trip over the future. Feh. ;-) Cheers, Bob Hettinga <roasted tail-feathers and all...> ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

C'MON N' GIVE 'EM HELL, NET-NERDS!!!!
by lindat＠iquest.net 17 Dec '03

17 Dec '03

They asked for it: "To secure Net communications, the government will need to have access to private data exchanges using what is known as a key escrow security system," -Netscape Communications chairman Jim Clark, arguing for a security system called key escrow that would require you to give the government access to your private messages. Source: STAMPER'S NEWS NUGGETS (1) SPAM THE SIGN Netscape has a webpage at www.netscape.com. There is a "toys" area and any message you leave in that area goes to an ELECTRONIC MARQUEE SIGN at Netscape that all the employees can see. SPAM THAT SIGN. (2) SPAM NETSCAPE Here's where the EMAIL BLITZ should go (extra points for creativity): info(a)netscape.com General information admgr(a)netscape.com Netscape site advertising sales x_cbug(a)netscape.com Bug reports from X Window users win_cbug(a)netscape.com Bug reports from Windows users mac_cbug(a)netscape.com Bug reports from Macintosh users hr(a)netscape.com Netscape Human Resources department training(a)netscape.com Netscape Training programs information admgr(a)netscape.com Netscape site advertising sales and Sponsor program information proprietor(a)netscape.com Netscape electronic store feedback editor(a)netscape.com Feedback about Netscape's Net site ssl-talk-request(a)netscape.com E-mail list for Secure Sockets Layer protocol discussion standards(a)netscape.com Questions about Netscape's open-standards activities nswinapi-talk-request(a)netscape.com E-mail list for users of the Windows Netscape Server API CORPORATE HEADQUARTERS ------------------------------------------------------------- NETSCAPE COMMUNICATIONS CORPORATION 501 E. Middlefield Rd. Mountain View, CA 94043 415/528-2555 Product and sales information (7:00 a.m. to 5:00 p.m. PST) 415/254-1900 Executive offices 415/528-4124 Fax http://www.netscape.com ATLANTA Netscape Communications Corporation 1850 Parkway Pl. Suite 420 Marietta, GA 30067 CHICAGO Netscape Communications Corporation 2159 N. Seminary Chicago, IL 60614 DALLAS Netscape Communications Corporation 17304 North Preston Road Suite 800 Dallas, Texas 75252 NEW YORK Netscape Communications Corporation 599 Lexington Ave. Suite 2300 New York, NY 10022 NORTHWEST Netscape Communications Corporation 501 Middlefield Rd. Mountain View, CA 94043 SOUTHWEST Netscape Communications Corporation 111 N. Sepulveda Blvd. Manhattan Beach, CA 90266 WASHINGTON, D.C. Netscape Communications Corporation 6701 Democracy Blvd. Suite 300 Bethesda, MD 20817 THANKS AND A HAT TIP TO HELEN AT E.PLURIBUS FOR GETTING ALL THE ADDRESSES!!!!!!!! Kind regards, *********************** V ************************* DEATH TO THE NEW WORLD ORDER **************************************************** Linda Thompson American Justice Federation Home of AEN News & news videos, "Waco, the Big Lie," "America Under Siege" 3850 S. Emerson Ave. Indianapolis, IN 46203 Telephone: (317) 780-5200 Fax: (317) 780-5209 Internet: lindat(a)iquest.net ************************************************** Remember Waco. The Murderers are still free. *************************************************** The Army is going to courtmartial Spc. Michael New for not wearing a U.N. uniform, but the Army won't courtmartial the members of the 160th and 158th Special Operations, 82nd Airborne, Ft. Hood Cav Members, and 10thMountain Division members who helped MURDER CHILDREN at Waco. What's wrong with this picture?

2 1

Filtering Net Commercials
by Jeff Simmons 17 Dec '03

17 Dec '03

On December 1, Timothy C. May wrote: > One patch I'd pay money to have is one which intercept the "commercials" > Netscape blasts out at us and replace them with something else (maybe > nothing, maybe a "quote for the day," maybe something from a > user-selectable file of items). > > I understand that Netscape is collecting money for these "commercials," and > that they control what is sent out. So, any such patch to intercept/remove > these commercials would have to be done locally. Can this be done? This is from a post to cypherpunks back in September. Given the current situation, maybe a re-posting is in order. (If not, flames to my address please, the list has enough to worry about.) I just checked, it's still at the ucsb.edu site. - - - Begin forwarded message - - - On the subject of HTTP proxies, [SEVERAL FWD'S DELETED, ENTERTAINING SUBJECTS RETAINED] Subject: The agents/advertising arms race heats up Subject: OH YEAH BABY, FILTER ME HARDER >From: Axel Boldt <boldt(a)math.ucsb.edu> >Newsgroups: comp.infosystems.www.announce >Subject: SOFTWARE: Filtering ads out of popular web sites >Organization: Univ of California at Santa Barbara, Dept of Mathematics >Approved: www-announce(a)boutell.com >Message-ID: <44ercn$nhl(a)holly.aa.net> Several popular web sites have recently turned to putting advertising gifs on their pages. NoShit is a tool that filters these out so that you don't see them - in fact, you don't even download them in the first place, thus saving time, money and brain capacity. NoShit is implemented as a set of patches against Cern httpd to turn it into a "filtering proxy server". This means that the proxy maintains a list of URL templates together with corresponding filter scripts. When a document is requested form the proxy that matches one of the templates, then the page is piped through the corresponding script before being presented to the client. This works together with caching, if desired. The idea is to run your own personalized NoShit proxy server and point your browser to it. The proxy does the filtering; the browser doesn't even know about it. This scheme works with every browser. I have written a ready-to-use library of filter scripts for a couple of well known, ad-infected sites, including Yahoo, Lycos, Netscape, HotWired, CNN, Infoseek and NandO Times. You can change these or add your own very easily. Locations: <URL:http://math-www.uni-paderborn.de/~axel/NoShit/> (Germany) <URL:http://emile.math.ucsb.edu:8000/~boldt/NoShit/> (California) Enjoy, Axel - - - End forwarded message - - - -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

key escrow compromise
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

to most on the list, the subject of this message would be an oxymoron. ("there is no compromise!") regarding the recent Netscape brouhaha: I tend to agree with Clark in only one regard: the government is going to get into the key storage/retrieval business in some form or another eventually & inevitably; it's just not stoppable. like one of the NSA spooks said after the Clipper fiasco, "well, we had to try". the aspect that is up for grabs is whether these systems will be *mandatory* for all private communication. here's a quick idea. the post office is getting into certification authorization come hell or high water (ETA summer, 96). now, frankly I think this is a good thing. someday we will need some kind of legal agency to deal with citizen keys, so that we could have cryptographic dealings with federal agencies such as the motor vehicles department, etc. many are going to blast me to oblivion for saying this, though. but don't you think there are some benign government services that you would like to have access to via your "state" or "legal identity" key? this would prevent other people from faking your identity in front of the state, e.g. voter fraud, and other miscellaneous things. it seems to me the problem is when a government begins to insist that the only authorized encryption you can use must be based on the secret key they give you is where all the problems arise. so, what we could advocate as a compromise (given that the post office is absolutely not going to *not* get in this business, from what I can tell). we encourage the idea of KEY FREEDOM this would be a heading for the idea that we are in support of the (our) government creating cryptographic infrastructures and key authentication services, as long as we always have the total freedom to encrypt according to however we please in private communications. in other words, we are willing to have an official state identity/key as long as it is not required in our private transactions, only those involving the state. (yes of course I know "state" is a pornographic word here, heh). if you don't like this imagine it as a "stopgap measure" on the way toward full cryptoanarchic infocalypse that government bureacrats might buy. another idea is that we might reasonably support a system that has such a thing as "key escrow" but we only use the keys they give us as part of our signatures to other people if we want to reveal our "official" state identity, not to encode the communication itself. in this way someone else could verify your identity for e.g. legal/ contractual purposes, but the overall communication would remain private. in other words, we agree that the government does have the authority to link people to their "official numbers", but we have a choice about when to use those official numbers in any private communication, and by law businesses do not ever have to *require* authentication in this way. the numbers of course would be required in communication between the individual and government. the situation is that the government *now* requires that it knows who we are when we communicate with it in any official context. therefore I submit that the above system would not take away any rights, and in fact might lead to privacy advocates being able to use a massive government key-infrastructure but still retain communication privacy. in other words, you now have the government actually supporting your cryptographic freedom by giving you a massive "official" key distribution system you can use any way you like. another possible compromise is that by default, keys would be insecure, in the sense the government stores them for "key escrow" purposes, but people are always recognized as having the right as "tunneled encryption" (a great term for private encryption within the state encryption). you see, cypherpunks often recognize that most of the world is so clueless that they don't protect themselves, and they almost don't deserve to have privacy by the default if they are entirely clueless or apathetic about obtaining. so what we might be able to accomplish is a system in which all the clueless people use the government-supplied keys, the FBI cracks some percentage of "clueless" criminal communication, and non-clueless people go ahead and bypass it all. now, before you hotly flame my eyebrows off, I say these things not because I like key escrow, but that I suspect the post office is going to move into certification no matter what, and the idea of key escrow is closely related to that. with a little finetuning the cypherpunk position could help define the actual rights of individuals relative to these new government systems in a way that is totally compatible with all our core privacy beliefs. what I am getting at is that we could twist the words "key escrow" to mean that the government provides some infrastructure for storing & accessing public keys (similar to phone books), and we could simultaneously vehemently deny that "key escrow" legitimately allows the government to actually *have* our secret keys. in other words, we say, "yes we support key escrow. of course it is a good idea to let the government have simple phonebooks of keys. oh, wait, you mean we have to USE THESE KEYS? in the official STATE ENCRYPTION ALGORITHM? we have to STAMP OUR SSN# ON EVERY TRANSACTION WITH EVERY BUSINESS? sorry buster, what I do with my key is my private matter. this would be again to having official government phones that allowed the government to call any number and start surveilling the room the phone is in."

2 1

Netscape, Mosaic, and other goodies.
by Laszlo Vecsey 17 Dec '03

17 Dec '03

> > > The field is User-Agent. However, blocking access to users of Navigator > > > isn't a particularly useful thing to do. If you must do something, why > > > not modify your GET handler to add a header to the start of all html > > > pages informing people of the problem, and suggesting alternatives. > > > > Great idea! I'm sure there is a cypherpunk on this list willing to write a > > patch to NCSA HTTPd to get the job done, in a configurable manor of > > course so that a template.html would be 'inserted' at the top of every > > document sent out to the specified browser. Any takers? > > No need. Simply add > > <meta http-equiv="Refresh" content="1;URL=netscape-warning.html"> > > to the start of your page. Netscape browsers will be redirected. Are you sure Netscape browsers are the only ones that currently implement this tag? Other browsers will be implementing it soon enough I'm sure. I think the only fool-proof way of doing it is at the webserver. Anyway, isn't 5 million bux a little too much for the government to give Netscape for the security improvements? I would think that for less than a million a group of programmers could be rounded up to create a stable multi-platform web navigator with VRML, MPEG, Audio, Postscript, and a zillion other features built in. :) It's funny how one day we are raving about how great Netscape is, and the next day we hate them. If we aren't pleased with a particular piece of software, instead of argueing about it we should just go and make one that we are pleased with. Using the many libraries available such as MPEG, GIF, JPEG for example and releasing it under the GNU agreement is the way to go. Or perhaps we should just back the original browser, NCSA Mosaic. With some improvements it could once again be the best browser on the net. I suppose I'm not clear about the implications of these eskrow keys... just because the government is supporting it, and Netscape will be implementing it doesn't mean that we have to use it. Is it against the law to encrypt data (using your own method) and send it over the Internet? I don't think so. ...

2 1

No Privacy Right in UK ? - Part 3
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, A 12 01 95 The Electronic Telegraph newsstory headlined Policeman bugs own station by mistake reports: ...a listening device was found at the headquarters of Lothian and Borders Police in Edinburgh. The "bug", disguised to look like a plug adaptor, picked up the day-to-day business of the operations room, including radio and telephone messages and conservations between staff. Conservations between staff? Conversations in which not a word is wasted? Its presence was discovered when staff in a rest area tried to tune a radio to a different station and picked up the voices of their colleagues. I used to despise those who couldn't keep their hands off the dial for 5 minutes, but since reading this story my attitude's been adjusted. Concerned that secrets were being transmitted abroad, the force "swept" the control room with anti-bugging technology, only to find that the device belonged to them. It had been "planted" by an officer who thought it was a real adaptor. Of course I believe that! For what comes around...goes around. Cordially, Jim NOTE. The Electronic Telegraph website's URL: http://www.telegraph.co.uk The newsstory's by: AUSLAN CRAMB, SCOTTISH CORRESPONDENT Its online filename: 1bugs01.html

1 0

Re: DigiCash releases protocol specs!
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"support(a)marktwain.com" 1-DEC-1995 18:56:11.57 By popular request, DigiCash is releasing the protocol specs. The specs are available at http://www.digicash.com/ecash/protocol.html Please be aware that the doccument is work in progess. More specifications, including byte level descriptions of the message format will be added throughout the weekend. --Lucky Green at ---------------------- Thank you. This raises my likelhood of using DigiCash's electronic currency from about none to above that. -Allen

1 0

[NOISE] Fun quote
by Charles Gimon 17 Dec '03

17 Dec '03

Just heard on tonight's "X-Files"... "The NSA?? Since when did they start issuing you guys piano wire instead of guns??" I can hear the clatter of .sig files being updated all over the net.

1 0

Re: A "Warning Banner" for Netscape Navigator? Good idea!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

It's been a long and interesting day... >Pull down the 'Options' menu, grab the 'Window and Link styles' >page, and change the default "home page location" from >netscape's to whatever you want. Oh. *Those* advertisements! I couldn't for the life of me figure out *what* Tim was talking about. I've made mine come up blank since the initial, "Hey, what do these twiddly bits in the Preferences command do...", session after the first download. You can also put up a type-it-yourself URL window on the browser window, which comes in handy now that you have to wait 10 seconds (on my dinky PB 180) every time you change code modules in 2.0b3 Netscape (like touching<!> the menu bar for the first time, or looking at the bookmark window)... Like I've said elsewhere, Netscape is hierarchical code trying to conquer a geodesic (a word I got from Bucky Fuller, through Peter Huber, just so I keep my attributions straight...) network. It ain't gonna fly, in the long run, folks. In that vein, could someone e-mail me the best non-netscape Mac browser, so I don't get HTML-nasties when I go play on the cactus machine? Anyway... Dave Winer(sp?), the Mac-Developer-turned-gadfly (speak not ill of the other gadflies, I always say...), talks about seeing some Netscape (sorry...) patches which actually *do* strip banner ads from various web-pages. I believe you have to tell it which pages, and what the banners' file names are, but I'm not sure. Don't know where *Weiner(sp?)* got it from... I seem to remember the name "Ad Stripper" but I could be imagining things... Of course, if that's the way this code really operates, simply changing the name of the HREF call regularly on the server side, which is probably done anyway, with all the web-management code showing up out there, defeats ad-filters of this kind completely... Obcrypto: Maybe these web-pages will send you nanocash (not mine, either, sorry, taken from one of the wearable-people at mobileworld, I'll look up their name, and get back to you. soon. I promise.) to watch their message? Also, could someone talk here about how easy it might be to spoof Java "byte code"? The Java presentation at this conference had a lot of hand-waving and reverent invocation of Whit Diffie's name, so it might not be trivial. Another feature of this presentation was a really splendid "subjective axis" chart showing how "powerful" Java is in comparison to say, client-server, HTML, and other "technologies". This chart reminded me for all the world of the famous "Pravda Charts" that Tufte likes to lampoon in "The Graphical Representation of Quantitative Information". Just so I keep my sources straight. Of course. To quote Prof. Tufte. "If it looks like a duck, ignore it." Or something to that effect. Maybe the word "waddle" was in the sentence. Maybe he got it from someone else... I'll get back to you on that. I really will... ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Barring access to Netscape
by James A. Donald 17 Dec '03

17 Dec '03

At 12:32 AM 12/1/95 +0600, Ed Carp wrote: >If you want to bar access to your site from a Netscape browser, such >can easily be accomplished. If memory serves, every browser, when >connecting to a site, exchanges certain information about the client >with the server. One can gain access easily to that information. This would not be satisfactory in itself: Ideally one would like to bring up a page saying "Sorry, you cannot access that page because you are using a netscape browser: Click *here* for the sad tale of Netscape. > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1