December 2003 - cypherpunks-legacy

mailing list
by myrkul＠limestone.kosone.com 17 Dec '03

17 Dec '03

please add my address to the mailing list.

1 0

RE: Random Number Generators
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 PM 1/17/96, Kurt Buff (Volt Comp) wrote: >If you're going to work with hardware to get really random numbers, why not >go to the back of any of several PC-type magazines, and order the radiation >detector board that someone is hawking? Can't really do any better than >that, can you? Counting cosmic ray hits and noting their time differentials ^^^^^^^^^^^^^^^ >should be just what the doctor ordered, right? Almost all of the counts in simple radiation detectors are from earthly sources, not from cosmic rays. For Geiger tube counters (not very common these days), the main counts are for gamma rays and for beta particles (if a beta window is included). For solid-state detectors, most of the counts are still betas and gammas, even though solid-state detectors (e.g., PIN diodes) are certainly _capable_ of detecting alpha particles. The reason is that alphas are very nonpenetrating, so alpha detectors for intentional use must have extremley thin (and hence fragile and expensive) windows or protective layers. Basically, it makes little sense to count alphas when a rough radioactivity measurement is sought, as with cheap detectors. Solid state detectors specially set up with alpha sources in proximity to the detector are possible, but are a specialty item. RNGs based on thermal noise and natural radioactivity have been discussed on our list at least a dozen times (multiple posts each time), so I suggest further research be done there. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Attack Simulator
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Internet Scanner Software Checks Network Security Atlanta, Jan. 17 -- Internet Security Systems has released version 3.2 of its Internet Scanner software. The company said the program is an "attack simulator" that tests your organization's network for security holes. ISS said Internet Scanner 3.2 has enhanced reporting capabilities and added tests for more than 130 security vulnerabilities, including the recently revealed Microsoft File Sharing bug. "Our added focus on Microsoft security holes stems from our customers' rapid adoption of TCP/IP (Transmission Control Protocol/Internet Protocol)-enabled Microsoft Windows NT and Windows 95," said Chris Klaus, founder and chief executive officer of ISS. According to Don Ulsch, a security consultant affiliated with the National Security Institute in Westborough, Massachusetts, The movement to Windows 95 created a whole new set of security concerns for network administrators. "Similar to virus scanning software, a security scanning tools' value to a corporation declines quickly unless it can detect the latest security holes. In the security arena, every upgrade is crucial," said Ulsch. New features of Internet Scanner 3.2 include added reporting capabilities including hyperlinks that connect to CERT advisories and vendor World Wide Web sites to pull down patches and information regarding network holes, and addition of Linux as a supported platform. The company said that will allow easy scanning from laptop PCs. The additional tests added to the new version include the Microsoft File Sharing bug, the TelnetD bug, the Stealth Scan, Finger Bomb, and misconfigured Linux NIS services. The company said its customers who have current maintenance contracts can now electronically download the updated version from the USS Web home page at http://iss.net. Internet Security Systems, tel 770-441-2531, fax 770-441-2431

1 0

Re: A weakness in PGP signatures, and a suggested solution (long)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Rich Graves <llurch(a)Networking.Stanford.EDU> allegedly wrote: > > An easy short-term partial solution would be to modify mailcrypt, bap, or > whatever front end you use to automatically put the current date and (a > shortened form of) the To: or Newsgroups: header into the PGP signature > Comments: line. I wrote: > > A good idea, and one I was about to implement for BAP, but > doesn't PGP itself stick a timestamp into the signature? > When I verify a signature it says "verified, signed at > XXX time & date.". Whoops! I misunderstood. The fix I am considering is putting some information inside the *body* of the message, probably at the end just before the signature. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMP2Bj/WZSllhfG25AQHxWwP/bHmOcuAPAHdCShaeZhpLYQPJEJWyApuV EQhA/k1TSxmowH0cPff1rBZw4+2HFzfKiWHgBO12lf6gO+ihVGq/7GAJuwEVmMb6 aNKhSRESmb2YgV8/luj401KnknSP1x3xC56wzE1mhIiN8LOtav2J+rxM398DTzEc 8mzb7dETBRU= =ZDiw -----END PGP SIGNATURE-----

1 0

Re: Information Sent by Netscape during Queries
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jeff Weinstein writes: > > 3) Can we go completely stealth inside of Netscape without a proxy server? > No. Right now you can't disable cookies, you can't disable > referer, and you can't mask your IP address. But on Unix systems, at least, you can make "referer" more difficult for nosy servers to use -- subject to the "applicable laws" where you live. (The license agreement says, "...you agree not to modify the Software ... except to the extent [that] applicable laws specifically prohibit such restriction.") Just back up your Netscape executable, then load it into Emacs (or any editor which can handle arbitrary binary files), search for the "Referer:" string, and change it to an appropriate string of the same length. "MYOB: " sounds like an appropriate string to me... -----//---------------------------------------------------------------- Please note: This message has been anonymized on request of its sender. If you would prefer not to receive anonymous mails from this machine, please contact postmaster(a)bi-node.zerberus.de and say so. For further information regarding this service, please send mail to remailer(a)bi-node.zerberus.de with subject 'remailer-help'.

1 1

Re: CryptoAPI and export question
by Joe Thomas 17 Dec '03

17 Dec '03

On Wed, 17 Jan 1996, Tom Johnston wrote: > Two points: the CSP development kit is export-controlled; and signing a > CSP developed by a foreign vendor is treated as a export -- so the signature > is export-controlled. The *signature* is export controlled?!? What the hell kind of sophistry could the State Department use to deny an export license to a signature? Joe

1 0

Re: Microsoft's CAPI
by Lee Fisher 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)research.att.com> writes: | I attended a meeting at Microsoft the other day at which they | described their Crypto API project. As CAPIs go, it's reasonable | enough; ... As of today, some basic information on "Microsoft CrytoAPI" is available at http://www.microsoft.com/intdev/inttech/cryptapi.htm. It looks like this page has an overview, a 25-page Programmer's Guide, and 5 sample apps which use the API. In general, http://www.microsoft.com/intdev/ is the best place to check for any new for Internet developer-related stuff from MSFT. __ Lee Fisher, leefi(a)microsoft.com, 206.936.8621

1 0

ITSEC?
by Juan D. Sandoval 17 Dec '03

17 Dec '03

does anyone know where I can get info on Information Technology Secure Evaluation Criteria (ITSEC)? I think it is more or less like "the orange book" but in Europe. Thanks

1 0

Re: A Modest Proposal: Fattening up the Proles
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:46 PM 1/17/96 -0800, Steven Weller wrote: >See also _The End of Work_ by Rifkin. It chronicles changing work patterns >from agriculture through mass manufacturing and the service age on to an >uncertain future. Lots of interesting numbers and "look what is already >happening" statements. It also shows that the changes are inexorable, just >as the decline in agriculture based on human and animal labor was. Except when I had Rifkin on the phone on a National Commie Radio talk show he dishonestly refused to admit the fact that -- so far -- employment in the US (total and percentage workforce participation) is higher than it's ever been. A lot of that is the commie belief that a job is something someone else gives you rather than something that you do. It's a bit hard to be without work if you assign it to yourself. And if wants are unlimited then one of the "goods" for which wants are unlimited is labor. DCF "A job he calls it! Reading the legal notices in the Times searching for unclaimed bequests in his name." -- The New Yorker

1 0

PARTY-PARTY-PARTY
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, You are all invited to the party I am having on 10 February. Instead of using old-fashioned e-mail to give you the details, I'm using a Web page donated by co-host Sameer. Check it out: http://www.c2.org/party/masquerade/html By the time you read this, there should be a map on the page. If not, try back in a day or two. If you do not have a browser, send me e-mail and I'll send you an ASCII invitation. Cheers, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1