December 2003 - cypherpunks-legacy

Re: [NOISE] Barring access to Netscape
by Herb Sutter 17 Dec '03

17 Dec '03

At 14:26 12.01.1995 -0500, Robert A. Rosenberg wrote: >If you want to see one way of locking out Netscape users, check out this >URL which points at a Web Page that will not allow access by Netscape Users Just a personal note... while I am strongly in favour of security, this seems rather petulant and knee-jerkish. JeffW: Please add a configuration option to let users override the "Mozilla" ident, so that they can continue to use Netscape at all sites. I personally won't use the override, though; if a site is going to insist on trying to frivolously exlude me as a user based on nothing but the browser I choose to use, they aren't serious anyway. >(the guy is ticked off at them trying to establish their own standards) - The _market_ establishes standards (been proven time and time again). His reaction sounds pretty childish to me, but YMMV... Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

2 1

Windows95 "Security"
by Laszlo Vecsey 17 Dec '03

17 Dec '03

Where is the password data file kept?

2 1

Filtering Net Commercials
by Jeff Simmons 17 Dec '03

17 Dec '03

On December 1, Timothy C. May wrote: > One patch I'd pay money to have is one which intercept the "commercials" > Netscape blasts out at us and replace them with something else (maybe > nothing, maybe a "quote for the day," maybe something from a > user-selectable file of items). > > I understand that Netscape is collecting money for these "commercials," and > that they control what is sent out. So, any such patch to intercept/remove > these commercials would have to be done locally. Can this be done? This is from a post to cypherpunks back in September. Given the current situation, maybe a re-posting is in order. (If not, flames to my address please, the list has enough to worry about.) I just checked, it's still at the ucsb.edu site. - - - Begin forwarded message - - - On the subject of HTTP proxies, [SEVERAL FWD'S DELETED, ENTERTAINING SUBJECTS RETAINED] Subject: The agents/advertising arms race heats up Subject: OH YEAH BABY, FILTER ME HARDER >From: Axel Boldt <boldt(a)math.ucsb.edu> >Newsgroups: comp.infosystems.www.announce >Subject: SOFTWARE: Filtering ads out of popular web sites >Organization: Univ of California at Santa Barbara, Dept of Mathematics >Approved: www-announce(a)boutell.com >Message-ID: <44ercn$nhl(a)holly.aa.net> Several popular web sites have recently turned to putting advertising gifs on their pages. NoShit is a tool that filters these out so that you don't see them - in fact, you don't even download them in the first place, thus saving time, money and brain capacity. NoShit is implemented as a set of patches against Cern httpd to turn it into a "filtering proxy server". This means that the proxy maintains a list of URL templates together with corresponding filter scripts. When a document is requested form the proxy that matches one of the templates, then the page is piped through the corresponding script before being presented to the client. This works together with caching, if desired. The idea is to run your own personalized NoShit proxy server and point your browser to it. The proxy does the filtering; the browser doesn't even know about it. This scheme works with every browser. I have written a ready-to-use library of filter scripts for a couple of well known, ad-infected sites, including Yahoo, Lycos, Netscape, HotWired, CNN, Infoseek and NandO Times. You can change these or add your own very easily. Locations: <URL:http://math-www.uni-paderborn.de/~axel/NoShit/> (Germany) <URL:http://emile.math.ucsb.edu:8000/~boldt/NoShit/> (California) Enjoy, Axel - - - End forwarded message - - - -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

Netscape, Mosaic, and other goodies.
by Laszlo Vecsey 17 Dec '03

17 Dec '03

> > > The field is User-Agent. However, blocking access to users of Navigator > > > isn't a particularly useful thing to do. If you must do something, why > > > not modify your GET handler to add a header to the start of all html > > > pages informing people of the problem, and suggesting alternatives. > > > > Great idea! I'm sure there is a cypherpunk on this list willing to write a > > patch to NCSA HTTPd to get the job done, in a configurable manor of > > course so that a template.html would be 'inserted' at the top of every > > document sent out to the specified browser. Any takers? > > No need. Simply add > > <meta http-equiv="Refresh" content="1;URL=netscape-warning.html"> > > to the start of your page. Netscape browsers will be redirected. Are you sure Netscape browsers are the only ones that currently implement this tag? Other browsers will be implementing it soon enough I'm sure. I think the only fool-proof way of doing it is at the webserver. Anyway, isn't 5 million bux a little too much for the government to give Netscape for the security improvements? I would think that for less than a million a group of programmers could be rounded up to create a stable multi-platform web navigator with VRML, MPEG, Audio, Postscript, and a zillion other features built in. :) It's funny how one day we are raving about how great Netscape is, and the next day we hate them. If we aren't pleased with a particular piece of software, instead of argueing about it we should just go and make one that we are pleased with. Using the many libraries available such as MPEG, GIF, JPEG for example and releasing it under the GNU agreement is the way to go. Or perhaps we should just back the original browser, NCSA Mosaic. With some improvements it could once again be the best browser on the net. I suppose I'm not clear about the implications of these eskrow keys... just because the government is supporting it, and Netscape will be implementing it doesn't mean that we have to use it. Is it against the law to encrypt data (using your own method) and send it over the Internet? I don't think so. ...

2 1

Re: "Got a subpoena?"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Thu, 30 Nov 1995, sameer wrote: > >> > >> > What about a court order to (a) start comprehensive logging, and (b) not >> > tell anyone under penalty of ______ . > >I am unaware of any authority for such an order. >> >> Aren't court orders part of the public record? I don't quite > >Yes, but court orders can be sealed pending further order of the court. Okay, maybe with your qualifications you can answer this. It has always mystified me why "the authorities" think they can engage in wiretapping without informing the person wiretapped that this has occurred, despite the fact that there was apparently never any precedent for this practice before the "wiretap era." In addition, I would like to be able to figure out a method to allow the de-facto disclosure of such activities, and to in fact force the phone company to do so, if they are asked to tap my or anyone else's phone. It occurred to me that even if there was a prohibition on explicitly revealing that such a tap exists, it should be possible to require the telephone company to certify that no tap exists, and to require that this certification will be followed by an explicit and immediate de-certification message the moment the phone company is unable to maintain such certification. The receipt of such a letter/fax/email will indicate that a tap has been placed, despite the fact that it will not say so. >EBD > >Not a lawyer on the Net, although I play one in real life. >

2 1

Re: WTO an even worse possibility as Inet regulator.
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, attila(a)primenet.com did the list a service when he sent his message, "WTO an even worse possibility as Inet regulator." Basing the message "on an article from the (London) Finan- cial Times," he states that a very credible white paper is circulating for the WTO to establish an internet CZAR to regualate the Internet... and he asks: personally, the Feds and the FCC are bad enough --now they want to have a **global** bureaucracy play god -??? That 11 29 95 Financial Times newsstory is headlined: Global regulator urged for information highway Who's doing the urging? The Royal Institute of International Telecommunications Policy put out a report written by a Shell man and a think- tank woman. As regards encryption, the RIITP people ...point out that issues such as...encryption...have global rather than national aspects. Then they contradict themselves: "Encryption, for example, raises tricky and emotive issues connected with...national security and cannot be treated simply as a business problem." Whatever works! They "encrypt" the ultimatums of the New World disorder in any...key. At the very end of the newsstory: Global Superhighways, Chatham House, 10 St James Square, London SW1Y 4LE I'm guessing Global Superhighways is the title of the RIITP report. As for Chatham House... In 1919 [a group of young men who became the dominant influence in British imperial and foreign affairs up to 1939] founded the Royal Institute of International Affairs (Chatham House) for which the chief financial supporters were Sir Abe Bailey and the Astor family (owners of The [London] Times). Similar Institutes of International Affairs were established in the chief British dominions and in the United States (where it is known as the Council on Foreign Relations). --Carroll Quigley [Clinton's mentor]. Tragedy and Hope. A History of the World in Our Time. Macmillan, 1966. P 132. RIITP is probably a front for RIIA. I conjecture, though, that the real publisher of the report has his house in Washington. I agree with jamesd(a)echeque.com who writes: The main threat to freedom is still internal, rather than external. Looked at from the inside, of course. Cordially, Jim

2 1

Re: Netscape gives in to key escrow
by Jonathan Zamick 17 Dec '03

17 Dec '03

>And thus we return to my original point, which is that it will depend on >what is said/disclosed. If every copy of GAKscape had a banner, bigger >than the Netscape "N" which said, "The government can read every message >you send using this software no matter what you do" then I think >consumers will be hard pressed to say they weren't warned. I don't mean to be inflamatory, but it isn't much of a point. They aren't going to put such a banner up because that would limit their business. The goal of Netscape (though I don't single them out), any corporation that would profit from business of those who seek encryption while still allowing GAK, and the government, is to limit the public's awareness of the size of the hole. If they let people know the extent of the hole, then they'll use products w/out it which blows profits from companies involved, and doesn't benefit the government who want it in common use. >I disagree. Almost nobody read the fine print on the back of a note you >sign when you buy a car or otherwise take out a loan, but the provisions >are generally enforceable ... Ignorance is not necessarily an excuse. The question is whether there was false representation of the security of the product. 1. The general knowledge of encryption and secure electronic financial transactions is significantly lower than that of more standard transactions. 2. Applying for a loan or buying a car involve actively going out, negotiating, signing contracts, etc. It will be much simpler to simply stick your vital info into a 'secure' browser. 3. The choice of browser to use will be done, based on representations by companies about the security of their product. If Netscape doesn't explicitly state in direct terms when accessing the browser that the GAK is a potential security risk, then they will be sued. Simply because someone will get blamed. Since they (or again any company that incorporates GAK.. I really don't want to target Netscape in specific) will make the threat sound as insignificant as possible, and not bring it to people's attention (and they can't afford to do so) when (not if) it is breached they will be taken to court repeatedly. > >EBD Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

2 1

Re: Barring access to Netscape
by Frank Stuart 17 Dec '03

17 Dec '03

>If Netscape really does go the GAK route, I will unilaterally >do this to the Cypherpunk Archives (or something similar, like every >request flashing up briefly and then client-pulling the GAK pages). After talking to a couple of people, and playing around some, this seems to be a better choice. That way, you can actually send information (including a list of where to get other browsers) instead of just garbage to netscape users. Is anyone aware of browsers other than Netscape that do client pulls? A simple filter to do (and undo) this would still be useful, I think so that users can easily fix all their documents. Fortunately, that would be very easy to write. >I've been told that many media-types go to the archives whenever c'punks >make the news. How much of an effect do y'all think it'll have if they >can't do it with Netscape? > >Shouldn't be too hard to hack this into Apache. That's not a bad idea either. Hopefully, Netscape will post a retraction (soon!) and none of this will be necessary. Frank Stuart | (Admiral Grace) Hopper's Law: fstuart(a)vetmed.auburn.edu | It's easier to get forgiveness than permission.

3 2

Re: Netscape gives in to key escrow
by Jonathan Zamick 17 Dec '03

17 Dec '03

>I they tell you about it and you buy it anyway -- tough luck. > > >Same with the cars. Would *you* buy Pinto with explosives in it???? >(leaving aside the "inherently dangerous" argument for the moment on the >products liability claim). > >EBD Hmm. The key point is that almost no general users will have a clue what actual security is, and what GAK is. They _might_ understand the risks of having an explosive in their vehicle (but can just as easily argue it wasn't properly designed if it went off improperly.) Regardless of what they'd know about their vehicle, they can easily claim to had the risks associated with GAK improperly represented, Netscape misleading them with deceptive claims of security given this potential hole etc. I'm not saying whether or not this is the case, but we are very much in a legal period where individuals are in fact expected not to need common sense, and corporations are responsible for cleaning up after consumer stupidity. It is certainly true that given the general state of education regarding crypto, the average consumer can easily say that regardless of warnings about GAK, that they weren't properly informed of the risk. With all the hype around security, Netscape and encryption people will be under the impression regardless of one little disclaimer tag, that their information is safe. Neither government nor corporations will disabuse them of this belief. The case would be strong against them as a consumer. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

4 4

available news/mail filtering
by Beavis B. Thoopit 17 Dec '03

17 Dec '03

What news and mail filter programs are available? Pointers will be appreciated. If inclined, please give some pros/cons of your favorites. Thank you for your help in this matter.

4 3