December 2003 - cypherpunks-legacy

Re: John Gage's comments at Computer Security Day in Cleveland
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 1 Dec 1995, Dr. Frederick B. Cohen wrote: > John Gave gave an interesting pitch for Java at the CSSI Computer > Security Day sessions in Cl;evelan yesterday (November 30). Among > his comments were: > > Java is not secure - it is "safe" No comment. > He (John Gage) regularly downloads binary executables from the > Internet and runs them on his workstation at Sun - (connected to > the internal Sun network). He downloads executables and runs them while connected to ... Oops, ... no comment. > Sun has terrible physical security - unknown people roam the halls > at night all by themselves. How do they get in the building in the first place?? Someone should think about a MEMBERS ONLY sign or something ... Oops, ... no comment. > In 2 years, you will be able to buy a computer that does more than > a Sparc now does, in a portable package the size of a cell > phone, with more than 30 million bits per second of mobile > bandwidth direct to the Internet, for less than $30. Now this last one could not pass without a deserved comment. How will John have my fingers connect with the cell-phone sized keyboard?? I guess for LESS than $30, I probably shouldn't be moaning and complaining, though ... especially if its energy-star compliant. > -> See: Info-Sec Heaven at URL http://all.net/ > Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Dr. Fred, as usual ... you're a hoot. Your timing is great. And as luck would have it, I've got a Sun open house to go to this Monday for their pre-Christmas shin-dig. The President of Sun Canada, (I think) is supposed to be in attendance. You just gave me some great material to goad him with. Thanks. Even though these social things aren't usually for shop-talk, I think I might just save some of this stuff for use at the punch bowl. (Naah, I wouldn't do that.)-; But it is great material ... and perfect timing ... Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

RE: sooner or later
by Fisher Mark 17 Dec '03

17 Dec '03

>3. A ban will eventually be lifted, because of the impracticality of GAK, >abuses, wide-spread security problems caused by added complexity or >hackers stealing the master keys, ineffectiveness, sympathetic courts etc. >The sooner it comes into effect, the sooner it goes away. But eventually could be 2047 (or 2097)... I'm 40 now. I'd like to live to see the day. This situation starts to unpleasantly remind me of Heinlein's "If This Goes On...". ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Info Foes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://www.ndu.edu/ndu/inss/strforum/z1106.html Strategic Forum THE REVOLUTION IN MILITARY AFFAIRS Martin Libicki, CDR James Hazlett, et al. [Excerpts] DISCUSSION I: STRATEGIC CHALLENGES Those who assess future strategic challenges tend to look to Asian countries, and to categorize competitors as peer, regional, or niche. Asia and the Nation-State Most conference participants believe that, over the next twenty years, the fulcrum of world politics will continue to shift from Europe and its peripheries to the Asia-Pacific region. The period of European dominance produced innumerable wars as various countries challenged each other for power, resources, and sovereignty. With the formation of the European Union and the dissolution of the Warsaw Pact, great power rivalry in particular and the nation-state in general are fading somewhat in importance. The nation-state remains strong in Asia, however. The last fifty years have seen considerable economic progress as various nations have made themselves richer by grasping the secrets of rapid industrialization. This trend, which started in Japan in the 1950s and 1960s, spread to the Tigers in the 1970s, ASEAN countries in the 1980s, and China and perhaps India in the 1990s, has left no Asian country unaffected. Economic growth, however, has not made the nation-state obsolete. To the contrary, the nation-state has been instrumental in creating the internal and external conditions for economic growth. European history suggests that countries, once they taste wealth, will struggle for power. Will Asian countries follow that pattern or demonstrate new models of what the nation-state is capable of? ... Types of Competitors One taxonomy of future threats suggested at the conference is to classify potential competitors as peer, regional, or niche. A peer competitor could challenge our military across the board. A niche competitor would be incapable of doing so, but would strive to inhibit or defeat U.S. intervention by developing capabilities such as primitive weapons of mass destruction, sensor blinders, physical terrorism, information system attacks, psychological operations, or hostage maneuvers. ... DISCUSSION II: OPERATIONAL CHALLENGES Considerable evidence suggests that commercial access to information -- GPS readings, space-based imagery, and Internet data -- could be transformed into military advantage thereby levelling the playing field between ourselves and our potential opponents. Other dual-use technologies, for instance, those that would permit remote piloting of aerial vehicles, permit commercial technologies such as electronic video photography to act as powerful military tools accessible to all (RPVs are made in more than thirty countries). Technologies That Level the Field Does the proliferation in information technologies necessarily negate our current military lead? Information-based warfare creates new vulnerabilities for industrial-age institutions slow to adapt. Because most U.S. logistics facilities and command nodes are not well hidden, they are vulnerable to precision strike. The widespread availability of overhead imagery coupled with GPS integration into weapon systems-- no more than a few years away for countries such as India--poses a serious threat to which our improving defensive measures (e.g., anti-tactical ballistic missiles) will provide only a partial solution . Our own counter-C2 operations are complicated by the rapidly falling cost of bandwidth and redundancy. Even if 90 percent of a bit flow can be interdicted, the remaining 10 percent may suffice for operational uses. Rapid expansion of cellular nodes, particularly through exploitation of commercial space assets, may make targeting and communications denial difficult or impossible. Multiple channels of electronic access will also complicate psychological operations and countermeasures. With the advent of the global information infrastructure, a clever adversary could take advantage of open information systems to enhance its own communications, information, navigation, intelligence, and operational support: examples include GPS, one-meter imagery, weather data, and even CNN. Every year more information with potential military use can be gleaned by anyone from the Internet without leaving fingerprints. How easily can a country's access to the global satellite communications networks be blocked? The coming global information infrastructure will have many points of entry. It will also be difficult to curtail certain services (e.g., global navigation) without denying them to U.S. users or even our own national security establishment. Technologies that Keep Us Ahead The United States, nevertheless, retains an edge in two important areas: space and systems integration. Space systems are relatively difficult to build and although many potential middle-income adversaries can borrow space services from third parties, fewer can own satellites, and far fewer can launch them. Thus the United States will retain a clear edge in the size and sophistication (timeliness and interpretation) of space capabilities, in their adoption and adaptation for military uses, in their augmentation or adaptation for the particulars of future contingencies, and in the assurance of their continuity. The distinctions between data and information, and between information and knowing could also favor U.S. forces. There are vast differences between, for instance, access to meteorological imagery and determining, for instance, that a locus of operations is likely to be fogged in 24 hours hence (a distinction relevant to the Falklands campaign). The art of operational planning is not acquired automatically with the acquisition of computers. Similarly, as sensors proliferate in type as well as numbers, data fusion is likely to become more decisive in future conflicts. ... POLICY RECOMMENDATIONS Two conference threads merit further examination: * U.S. defense policies that make it more difficult for potential competitors to threaten their neighbors and hold off the United States at the same time may be worth pursuing for that fact alone. * If militarily relevant information technologies are everywhere, sophistication at using them may be a better predictor of how challenging a competitor may become for the United States. Therefore, in addition to worrying about how large future foes are (and sizing our own forces accordingly), we should also focus on the potential sophistication of our foes (and develop doctrine accordingly).

1 0

re: SKIP source release is out
by markson＠osmosys.incog.com 17 Dec '03

17 Dec '03

> Doug Hughes writes: [ Perry Metzger writes: ] > > >SKIP is a non-standard being pushed by Sun. > > > > Correct me if I'm wrong, but isn't sun trying to make it a standard > > (in competetion with Photuris) ? Doug, you are correct. SKIP is an IPSEC internet draft. Photuris is an IPSEC internet draft. Perry is incorrect in saying that SKIP is a non-standard. Both of the chairs of the IPSEC group have said SKIP is part of the IPSEC working group. Phil Karn (author of Photuris) has also said this. Both SKIP and Photuris are on the standards track. They are, as you indicated, "competing" protocols. > The IETF has many sorts of standards. It explicitly has a way to > standardize things that the IETF doesn't think are a good idea but > which should have the ability to interoperate if you do them. That's true, but SKIP is not in that category. I believe neither SKIP nor Photuris have been declared "mandatory" as of this point. They both have the same status in IPSEC. > My opinion is that it is fairly clear that Photuris is the key > management system people will be using, although it is going to have > to evolve to work with a real network wide certificate database > infrastructure. SKIP isn't going to be the standard. Again, in *your* opinion. No determination has been made that I know of. --tom

2 1

Re: A newsgroup for exposing Usenet pedophiles
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From nelson(a)crynwr.com Fri Sep 19 08:41:11 1997 Received: by bwalk.dm.com (1.65/waf) via UUCP; Fri, 19 Sep 97 11:08:25 EDT for dlv Received: from ns.crynwr.com by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA24849 for dlv(a)bwalk.dm.com; Fri, 19 Sep 97 08:41:11 -0400 Received: (qmail 31458 invoked by uid 0); 19 Sep 1997 12:43:53 -0000 Received: from desk.crynwr.com (128.153.44.67) by ns.crynwr.com with SMTP; 19 Sep 1997 12:43:53 -0000 Received: (qmail 12012 invoked by uid 501); 19 Sep 1997 12:51:04 -0000 Date: 19 Sep 1997 12:51:04 -0000 Message-Id: <19970919125104.12011.qmail(a)desk.crynwr.com> From: Russell Nelson <nelson(a)crynwr.com> To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Cc: steering-committee(a)usenet2.org, freedom-knights(a)jetcafe.org Subject: Re: A newsgroup for exposing Usenet pedophiles In-Reply-To: <suy0ce21w165w(a)bwalk.dm.com> References: <suy0ce21w165w(a)bwalk.dm.com> Dimitri Vulis KOTM writes: I am now filtering out any mail with the word ``vulis'' in it. You were warned. -- -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom causes peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry.

1 0

Re: DigiCash releases protocol specs!
by Adam Shostack 17 Dec '03

17 Dec '03

| By popular request, DigiCash is releasing the protocol specs. | | The specs are available at | http://www.digicash.com/ecash/protocol.html | | Please be aware that the doccument is work in progess. More | specifications, including byte level descriptions of the message | format will be added throughout the weekend. And of course, you'll be including a description of how you generate random numbers for use in keys and blindings? I ask only because I didn't see a place for it on the Digicash site. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

A challenge ...
by jmhayes＠netcom.com 17 Dec '03

17 Dec '03

I've been challenged to try to find a bank account; I win the challenge if I can wire in $100 to the hidden account. Anyone have any good ideas about how to find an ABA number?

3 2

Re: ALERT: On Monday, call Congress to stop Big Brother amendment!
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

At 12:27 PM -0400 9/19/97, Carl Ellison wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 02:47 PM 9/18/97 -0400, you wrote: > >3. Say that you're calling to urge the Congressman to pass SAFE (HR695) > > without amendments. > > Does that mean Goodlatte's original bill, or the bill as amended already by > the National Security Subcommittee? > > I believe you should be more specific in your instructions -- suggesting > that people ask for the bill to be voted against unless it is exactly as it > was prior to the Natl Sec involvement. As each committee gets their hands on the bill, they do their own changes to versions and then they are all merged later before going to the floor. So, no, we're not asking people to urge passage of the SAFE bill with all the awful National Security amendments. It's a good suggestion, which we'll make clearer next time. -S

1 0

Barring access to Netscape
by Ed Carp 17 Dec '03

17 Dec '03

If you want to bar access to your site from a Netscape browser, such can easily be accomplished. If memory serves, every browser, when connecting to a site, exchanges certain information about the client with the server. One can gain access easily to that information. I believe that Netscape uses "Mozilla" as their keyword when exchanging browser-specific information.

4 3

Re: "Got a subpoena?"
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:50 AM 11/30/95 -0500, you wrote: >To use the most obvious example, different remailer operators turn >different levels of logging on. So one operator will say "Yes, I am >obligated to fully comply with your subpoena, officer. Here are the >full logs for the last six months." And another will say "Yes, I am >obligated to fully comply with your subpoena, officer. However, I >keep no logs at all of the mail sent through my remailer. Drag, huh?" Sounds like we need a version of Mixmaster for the logs... | Its Log! Its Log! Its big, its heavy, its erased| alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | <fnord> |

1 0