December 2003 - cypherpunks-legacy

Re: Netscape 2.0b1J still core dumps on Java
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

On Fri, 13 Oct 1995, Jeff Weinstein wrote: > I'm not sure what you are getting at. Are you saying that you've > tried running Netscape's Java on SunOS and it doesn't work? If that > is the case, then it is a bug that will be fixed... Uh, I must have been asleep and read your comment as Netscape 2.0 Java did not run on SunOs...Perhaps you can understand my confusion when it says at http://home.netscape.com/comprod/mirror/unix/ : "The IRIX and Sun Solaris versions of Netscape Navigator 2.0b1 include Java support." With no mention of SunOs. But looking at the ftp sites, I do see the 20b1J for SunOs4.1.3. Yey! -Thomas

2 1

what are these people selling????
by an116512＠anon.penet.fi 17 Dec '03

17 Dec '03

why is the cp meeting sponsored by sun? so we can hear a sales pitch on java? --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

3 2

NYT Markoff Article and one person's response
by fc＠all.net 17 Dec '03

17 Dec '03

I sent the following letter to the editor of the NYT expressing my personal view of the article. Perhaps others on this list should send letters expressing their viewpoints as well. Dear Sir/Madam: I have been reading, with great interest, the responses from security experts all over the Internet to John Markoff's October 11 article titled "Discovery of Internet Flaws Is Setback for On-Line Trade", and I thought your readers might like to know what real experts in the field think about Mr. Markoff's article. While the most recent announcement by Professor Brewer was generally taken as a positive step from American academia in catching up to the rest of the information security world, it is hardly a breakthrough, or even a novelty. To get a perspective on this, an average of about 10 new vulnerabilities of this magnitude or larger are discussed on Internet forums every month. The "CERT" team at Carnegie-Mellon University has published more than 10 similar types of attacks so far this year, the Internet forum "8lgm" publishes an average of more than one per month, the "BugTraq" Internet forum tracks and shows fixes for about two similar holes per month, and the "cypherpunks" forum uncovers several holes in cryptographic and other systems each month. The idea portrayed by Mr. Markoff that businesses rushing to the Internet are largely unaware of these risks is also quite naive. A recent Computer Security Institute study showed that one in every five enterprises has reported suffering an Internet security incident. Most experts believe the reality is much worse and that many who responded "no" either refuse to admit it or simply don't know. Over 50 percent of companies connected to the Internet provide high-risk features such as FTP and WWW to all employees, and 39 percent have no firewall to limit attacks from the Internet. According to several published papers, about 10 times as many attempted attacks are detected when firewalls are in place than are detected when they are not in place. Since the Internet was first introduced, many of the American Universities that have been so active in developing information technology have essentially ignored the security issues. Their ignorance of these issues has produced literally hundreds of protocols that are now in use by millions of computers from all over the globe and which, because of their insecure designs, are inherently difficult to secure. Thousands of individuals from all over the world have spent their spare time, often on nights and weekends, helping other people by developing and freely distributing new security technologies. They have been finding security problems and solving them for many years, most often without recognition or renumeration. They have been trying to tell the people developing these protocols about protection problems and have been widely ignored, with a few notable exceptions, by the American Universities. I personally think that it is a travesty that a relatively minor contribution by a few people at Berkeley gets front page headlines while the ongoing contributions of thousands of volunteers goes largely unrecognized. If you want the real story about electronic commerce and security issues on the Internet, listen to the people who are doing the work every day. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Insecurity Section of the Internet Handbook
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

For zoetrope, and others curious about the Insecurity section of the Internet Handbook, we pass along this Yellow Pages advert-insert comp sec teaser from SAIC -- with only dribbles of cryptography. The puffery appears to be artfully fattened and out-of-date. Like most security porkers, SAIC sells its nitrated sec services dearly (security by deep pockets of the fearful engorgers) while feigning Net public-spirit to mask IP search and steal. In a telling slight, SAIC does not cite outturned- pockets, beef jerky Cypherpunks. _______________________________________________________ URL: http://mls.saic.com/library.html [which links to the listed contents] SECURITY LIBRARY The SAIC Security Library contains security-related infomation and programs from around the Net. SAIC does not verify or endorse such files or any use thereof. Notices and Upcoming Events [Not included here] Advisories and Alerts Newsgroups Documents Programs Other Security Sites _______________________________________________________ URL: http://mls.saic.com/alerts.html SECURITY ADVISORIES AND ALERTS Alerts * Sun Security Alerts * CERT - Computer Emergency Response Team * ASSIST - Automated Systems Security Incident Support Team * AUSERT - Australian Security Emergency Response Team * NASIRC - NASA Automated Systems Incident Response Capability * DDN - Defense Data Network * FIRST - Forum of Incident Response and Security Teams Advisories * 8lgm Advisories * Bugtraq Archives, threaded * CERT Advisories * CIAC - Computer Incident Advisory Capability _______________________________________________________ URL: http://mls.saic.com/docs.html SECURITY DOCUMENTS These documents are from the Net and cover a wide area of topics concerning computer security. They are for the education and legitimate use of computer security techniques only. All non-FAQ documents are in PostScript format unless otherwise noted. ______________________________________________________ Frequently Asked Questions * Basic Computer Security * Firewalls * Setting Up Anonymous FTP * What To Do If Your Machine Is Compromised * Security Patches * Vendor Contacts * Pretty Good Privacy (PGP) * #hack FAQ * Cryptography FAQ _______________________________________________________ Firewalls Introductory Papers * Internet Firewalls - An Introduction (August 1994, 221K) * Keeping Your Site Comfortably Secure: An Introduction to Internet Firewalls (Undated, 1.8M) General Firewall Documents * A Network Firewall (June 1992, 374K) * A Toolkit and Methods for Internet Firewalls (Undated, 185K) * Proper Care and Feeding of Firewalls (November 1994, 121K) * A Network Perimeter with Secure External Access (Undated, 268K) * An Internet Gatekeeper (Undated, 149K) * Thinking About Firewalls (Undated, 109K) * X Through Firewalls, and Other Application Relays (May 1993, 430K) _______________________________________________________ WWW Security * Security and the World Wide Web (June 1994, 10K HTML) * NCSA on Mosaic Security Issues(December 1994, 1.6K HTML) * Shen: A Security Scheme for the Web (Undated, 1.7K HTML) * Using PGP/PEM Encryption (Undated, 7.6K HTML) * Secure HTTP (Undated, 2.2K HTML) _______________________________________________________ Intrusion Detection * A Software Architecture to support Misuse Intrusion Detection (March 1995, 250K) * An Application of Pattern Matching in Intrusion Detection (June 1994, 674K) * Algorithm for Distrubuted Recognition and Accountability (Undated, 209K) * A Pattern Matching Model for Misuse Intrusion Detection (Undated, 191K) * AI Approach to Intrusion Detection (June 1994, 168K) * Intrusion Detection In Computers (January 1991, 12K text) * USTAT - A Real-time Intrusion Detection System for UNIX (November 1992, 1.3M) _______________________________________________________ Improving your UNIX Security Technical Tips * Setting up Sun Security (March 1992, 7K text) * Miscellaneous Security Tips (October 1992, 23K text) * CERT Generic Security Tips (July 1992, 17K text) * UNIX Site Security Handbook (July 1991, 253K text) Finding and Fixing Your Security Problems * Improving the Security Of Your Site By Breaking Into It (Undated, 51K text) * Finding Holes in Your System (October 1993, 16K text) * Improving the Security of Your UNIX System (April 1990, 274K) * Becoming An Uebercracker to Stop Uebercrackers (December 1993, 9K text) _______________________________________________________ The Internet Worm * A Report on the Internet Worm (November 1988, 16K text) * Technical Report on the Internet Worm Incident (September 1991, 173K) * The Internet Worm Program: An Analysis (December 1988, 283K) * A Tour of the Worm (Undated, 166K) _______________________________________________________ Tales of Computer Attacks and Countermeasures * Five Incidents At Columbia University (Undated, 93K) * "An Evening With Berferd" (Undated, 82K) * Internet Attack on Texas A&M (1993, 294K) * "There Be Dragons" (August 1992, 185K) * Computer Break-ins: A Case Study (Undated, 94K) * System Admin Horror Stories (1992, 148K text) _______________________________________________________ Networking TCP/IP Security * TCP Wrapper Security (Undated, 59K) * A Weakness in the 4.2BSD TCP/IP Software (February 1985, 27K) * Security Problems in the TCP/IP Protocol Suite (April 1989, 107K) * Network (In)Security Through IP Packet Filtering (September 1992, 123K) General Networking Documents * Architecture and Implementation of Network-Layer Security under UNIX (Undated, 124K) * Information Security And Privacy In Networks (Undated, 809K .tar file) * Paving the Road to Network Security (May 1994, 162K) * NFS Tracing By Passive Network Monitoring (Undated, 170K) * Addressing Weaknesses in the DNS Protocol (August 1993, 406K) * Countering Abuse of Name-Based Authentication (Undated, 243K) * An Architectural Overview of UNIX Network Security (May 1993, 50K text) * NIS Security Warning (December 1991, 7.5K) _______________________________________________________ Trusted Systems * The Orange Book (August 1983, 264K text) * Understanding Configuration Management in Trusted Systems (March 1988, 138K text) * Understanding DAC in Trusted Systems (September 1987, 87K text) * Understanding Facility Management in Trusted Systems (June 1989, 106K text) * Understanding Trusted Distribution in Trusted Systems (December 1988, 55K text) * Understanding Audit in Trusted Systems (July 1987, 56K text) _______________________________________________________ Newsletters * COAST Newsletter * Privacy Forum * Cipher - Electronic Newsletter of the IEEE Technical Committee on Security and Privacy _______________________________________________________ Miscellaneous Documents * Security Term Glossary (Undated, 70K text) * Open Systems Security - An Architectural Framework (June 1991, 300K text) * Password Security: A Case History (Undated, 36K) * Extracts from various security articles (Undated, 61K text) * Coping with the Threat of Computer Security Incidents (June 1990, 102K text) * Threat Assessment of Malicious Code and Human Threats (October 1992, 231K) * Tty Security - a Tty Session Manager (Undated, 98K) * Electromagnetic Emanation Eavesdropping (1989, 45K text) * GAO Report on Internet Security (June 1989, 104K text) * ACM SIG on Security, Audit, and Control _______________________________________________________ URL: http://mls.saic.com/programs.html SECURITY PROGRAMS These programs are from various locations around the Net; SAIC does not verify their functionality and/or consequences of use. All programs are for assumed legal uses and education. Unless noted, all programs are intended for UNIX platforms. Local (load directly to disk; gzip tar files unless noted) * COPS - Bulletproof your system from intruders * Crack - Password cracker * Cryptography File System (CFS) - Encrypted filesystems for SunOS * Internet Security Scanner (ISS) - Checks UNIX sites for vulnerabilities * ifstatus - Checks interfaces for promiscuous mode * probe_ports - Finds open ports on UNIX systems * Secure-Sun Check - Shell script to check several common SunOS vulnerabilities (no compression) Remote * Arpwatch - Ethernet monitor, keeps track of ethernet/IP address pairings * Chalance - Intercept-proof password authentication * chrootuid - Run network programs in a mininal environment * CBW - Code Breaker's Workbench * Courtney - Identifies the use of SATAN * Dig - Sends domain name query packets to name servers * DNSWalk * Drawbridge - A bridging filter from TAMU * Kerberos - Provides secure networking * MegaPatch - Large number of SunOS patches in one bundle * Netlog - TCP/UDP traffic logging system * PGP - Pretty Good Privacy * Portmap - Portmapper replacement, with access control * SATAN - Checks computers/networks for security vulnerabilities * Securelib - Protects RPC daemons * screend - Filters IP packets * Smrsh - Sendmail restricted shell * Socks - Allows Internet access to firewalled machines * SRA - Secure RPC Authentication for Telnet and FTP * TAMU - Texas A&M Security Tool Package * tcpdump - captures protocol packets from networks * TCP Wrapper - ACLs for network services * Tiger - Scans your UNIX system for security problems * TIS Firewall Toolkit - Firewall package from TIS * Tripwire - Watch for system file changes * Watcher - Watches your system for security problems _______________________________________________________ URL: http://mls.saic.com/sites.html OTHER SECURITY SITES Cryptography * International Assoc. for Cryptologic Research * Cryptography Web Page at UMBC * Cryptography Export Control Archives * Lawrie's Cryptography Bibliography * RSA Data Security, Inc. * Quadralay's Cryptography Archive * Cryptography, PGP, and Your Privacy * PGP Web Page Firewall Vendors and Information * Harris Computer Systems * Sun Microsystems (SunScreen) * Trusted Information Systems * Cohesive Systems * Sea Change Corp. * Raptor Systems * Greatcircle Firewall Server * Virtual-One Network Environment Corp (V-ONE) * CheckPoint Software Technologies Ltd. * Firewalls.R.Us Security Gophers * InterNIC's Computer and Network Security * NIST Security * Security, Audit & Control (SIGSAC) World Wide Web Security * WWW Security Mailing List Archive * WWW Security at Rutgers University Intrusion Detection * Intrusion Detection Systems Archives (threaded) PC Security * Safetynet, Inc. Various Security Sites * Computer Security Research Lab at UC Davis * Computer Security at chalmers.se * Harris Computer Systems * Szymon Sokol's Security Site * The Uebercracker's Web Site * COAST Project and Laboratory * Computer Underground Digest Archive * Security News Clippings Archive * EINet's Computer Virus and Security Page * Crimelab * Phrack Magazine Home Page * TANSU's Security Reference Index * Digital Equipment's Secure Systems Index * Bellcore Security Products * Texas A&M security tools * ftp.win.tue.nl * NIST Computer Security Resource Clearinghouse * Christopher Menegay's Security Page * Security Papers at Johns Hopkins University * Dartmouth Security Tools * CERT FTP Archive * Computer Systems Consulting * Computer Systems Consulting (Local Files) * MIT's Athena Project * Yahoo's Security and Encryption Page * NIST Computer Security * ALW Unix Security Information * ALW's List of Unix Security Programs * ESNet FTP site * Bennet Yee's Security Page * Various security FTP pointers _______________________________________________________ Send questions and comments to Webmaster(a)mls.saic.com.

3 2

OneTimePasswd (not Pad)
by Laurent Demailly 17 Dec '03

17 Dec '03

Hello, I'm about to implement an OTPasswd (mostly like s/key) scheme to my www browsers/clients/proxy, but I was wondering is the mere principle of storing H^n(S) and requesting H^(n-1) from peer (H beeing your favorite one way strong hash function (MD5), and S your seed+secret passwd) could possibly be patented somehow and thus preventing using a similar scheme without getting a license (from bellcore?),.... if there are any usage conditions/restrictions?,... Also, can one compute the amount of information (if any) leaked by the method, ie, an attacquant who would have all the H^i i={a...b} (by snooping for instance) would have is job easied, and by 'how much' to find S? (or H^a-1) . is there any studies on that for H=MD[45] ? (and what is the status of free use of MDx btw ?) ps: I just an a thought that maybe the last P in elementrix POTP would be Passwd and not Pad... it could still be quite interesting to have H^n(S) (maybe variant with large n) used has 'secret' keys between parties, you'll get lots of plus against standard attacks, provided that there is no problem with know the function H^n for several (possibly large) n... hmmm why this hasn't been implement ? what obvious flaw am I missing ? dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept Soviet NORAD SDI $400 million in gold South Africa plutonium KGB

2 1

FT on IT Standards
by John Young 17 Dec '03

17 Dec '03

The Financial times today has four-page insert on the complexity and difficulty of developing international standards for all types of products. There is a passing mention of the Internet security issue. An article on standards for IT confirms Perry's oft-made points about the slow pace, protracted angling for market share, and the by- pass of standards by market go-getters who foster messes. Here are quotes on the last point: Paul Callahan of Forrester Research: "When a company owns a market they can determine the pace -- a company in its early stages of domination can move the ball forward swiftly -- such as the Internet Web software provider Netscape. Netscape didn't spend a lot of time with standards bodies -- it simply joined forces with MasterCard to co-develop Secure Courier, much as Microsoft enrolled Visa to develop its STT, Secure Transaction Technology. Only afterwards are the overtures made to standards bodies. That's commerce, and it's the way things are in the real world." Henry Ryan, convenor of the Iso-IEC JTC1 ad hoc working group on GII: "People ask, 'Can you afford to wait for standards?' I'd turn it round. If you don't, you suffer in the long term and end up with an unholy mess. If people do their own thing then the benefits -- and the problems -- may not be concentrated in one sector of the industry. We're finding that with the convergence of technologies, such as the superhighway, it isn't enough to develop standards for the IT sector, telecommunications, or consumer electronics individually."

1 0

Re: airport security
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:16 AM 10/14/95 -0400, Bob Bruen wrote: > The US is merely trying to catch up to what the Europeans have been doing >for over a decade. In fact, the US still has a way to go. You ought to pass >through Heathrow in London some time to see what real airport security looks >like. The US security changes are a recent response, starting after the >World Trade Center bombing and being stepped up on a continuing basis. >Today you need a picture ID to board with your ticket. Tomorrow...? We have >lived in relative safety compared to the rest of the world, but I think those >days are over. I remember back during one of the previous FAA panics over terrorism. I was at the Portland airport discussing the measures with an FAA inspector. He explained why they had to have all the searches and stuff to stop anyone from blowing up the plane. I pointed out to him that if anyone wanted to do that, they would just lay off a line of mortars from the hills overlooking the airport across the river. He got very quiet and very worried... You cannot stop someone who is determined to do terrorist acts. And the more the government stomps down on descent, the more various groups will get pissed off and perform terrorist acts, which will cause them to crack down even harder. (And on and on and on.) They forget that the imposition of order increases the escalation of chaos. What does this have to do with crypto? Not a whole lot, other than it will be one of the first thing to be outlawed in the futile attempt to stomp out unauthorized communications. Gotta watch the proles every minute... "Welcome to the global village!" - Marshall "Number 6" McLuhan | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Re: Anguilla Cypherpunks Meeting
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 PM 10/13/95, s1018954(a)aix2.uottawa.ca wrote: >Really? I thought except for incomes taxes, US laws only apply in American >territory as opposed to applying to American people wherever they are (as >I heard Germany's does). It depends on what is meant by "outside the country." The law forbidding travel to Cuba, for example, is not enforced by U.S. cops outside the country, but upon reentry to the U.S. Ditto for other laws, such as those affecting aid and support of countries we don't like, and the laws about trading with the enemy. >What if you were a dual citizen (US/Canada in my case)? For the purposes of crypto laws (and many other laws, truth be told), Canada is treated as a smallish northern state in the U.S. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Bugs Bounty?? ... shhh ... I'm huntin wa'bits ...
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> Netscape Announces Bugs Bounty with release of Netscape Navigator 2.0 beta > > Program harnesses power of the Internet to help Netscape refine Beta > versions and ensure highest quality software. Or at least this was the headline on the announcement from http://www.netscape.com > MOUNTAIN VIEW, Calif. (October 10, 1995) -- Netscape Communications > Corporation (NASDAQ: NSCP) today introduced the "Netscape Bugs > Bounty", a program that rewards users who help Netscape find and report > "bugs" in the beta versions of its recently announced Netscape > Navigator 2.0 software. > The beta versions of the popular network navigation software are available > today for downloading on the Internet for free evaluation. I was immediately overjoyed when I read that first paragraph. The sheer delight and mention of rewards -- whether its frequent flyer points or just simple little gold stars and pats on the head -- motivates me to just go out and do it. Go out and do whatever the offeror needs, so I can collect my nice juicy reward. A win/win situation. But something about this announcement seemed a little "too" polished ... (maybe it's just seeing how the last "Netscape bug situation" was spinned, ... I don't know). But I decided to read on, wanting to find out how Netscape "rewards" users who bring them "bad news". It was a slow afternoon, and I had just finished listening to that odious Dominick Dunne on Larry King. What the hey, I thought. Let's read on and discover more about the Bounty from Netscape. > The contest begins with the beta versions of Netscape Navigator 2.0 -- > available for Windows, Macintosh and X Window System operating environments > -- that are on the Internet today. FULL RULES FOR THE CONTEST will be > available on Netscape's home page at http://home.netscape.com. As the > rules will explain in detail, users who are the first to report a > particular bug will be rewarded with various prizes depending on the bug > class: users reporting significant security bugs as judged by Netscape > will collect a cash prize; users finding any security > bugs will win Netscape merchandise; and users finding other serious bugs > will be eligible to win a choice of items from the Netscape General Store. Gee this was sounding, really really good. But that FULL RULES thing was highlighted on my screen (I was running Lynx 2.2 at the time ...), so I had a quick little old jump over to the FULL RULES. And with just a <cr> I was off ... and rule-reading before the big hunt ... The rules started off ... > We're in the process of building a series of new technologies, such > as Java, into Netscape Navigator 2.0. Navigator 2.0 will usher in a new > way to use computers and networks, as well as create new opportunities > for people to build applications. Wow, I said. New opportunites to build applications ;) New ways to use computers. New ways to use networks. All ushered in by Netscape. That all sounds really, really GOOD!! I was eager, and ready for all of this newness. > We're eager to make sure that our new product is as bug-free as possible. > To that end, in addition to our internal testing, we're now offering prizes > and bounties for certain types of bugs found in the beta versions of > Navigator 2.0 starting with the beta versions listed at the bottom of > the page. Oh good. Finally a company that's interested in making a product as bug free as possible. And Prizes and Bounties!!! Joy!! Joy!! My adrenaline began to flood. Every neuron was piqued. I was ready to read on. This was slowly turning into as satisfying a hunt as any one I'd ever been on, even though we were only hunting for little old Bugs, and not big cats. None the less, it sounded like a fine afternoon of sport. Especially after Dominick Dunne. > This contest begins on October 11 and ends when Navigator 2.0 ships > release versions on supported Macintosh, Windows, and Unix platforms. > If the release date for the final version varies by platform, then the > contest will continue until Netscape has released final versions of > Netscape Navigator 2.0 on all 3 platforms. > > For questions regarding this contest email "contest_questions(a)netscape.com" > All questions and notifications will be handled via email. Netscape may > choose to respond to your questions individually, or as part of a > generalized response. Netscape will strive to respond as fully as > possible, but can not guarantee a response to all questions we receive. Hmmm, I thought. This is odd. Here I am potentially reporting a very important problem, to Netscape, and the company is saying that they might not even choose to respond to questions. I began to wonder whether Ford could have ever gotten away with not responding to queries about their products. Especially defects. I wondered what would have been the reaction if Ford decided not to answer mail that inquired about the wee little problem with their Pinto's. But this was a different industry. This was software. Internet software. The hottest, sportiest, new-fangleddy dandiest stuff around. Not responding to mail, but of course!! They're busily harnassing the power of the Internet to deliver software that's bug-free. They can't be bothered with small things like customers. They want bounty-hunters. But no need to let the glow fade so fast. I'm sure that they'll just be swamped with mail ... now let's get to their "proactive reward program" (although I don't know how you reconcile running a contest to improve your product with ignoring mail ... must be some newfangled modern hip-hop do-op bee-bop communications graduate theory thingy, that I just don't quite know how to parse.) > Anyone who finds a severe bug (as defined by us) that hasn't been > previously found and can be reproduced by us will be entered in drawings > for prizes from our GENERAL STORE. Hmmm, a severe bug (as defined by them). Is this like a Level One?? I wonder what that would be. But let's get to the meat of the matter, what are the prizes that Netscape is offering to harness the power of the Internet while they ignore and don't (selectively) reply to email. > Netscape will conduct 2 drawings and will award 50 prizes in each drawing, > for a total of 100 prizes. 50 will be nifty Netscape Mozilla mugs and 50 > will be snazzy Netscape polo shirts. We'll award either a mug or a shirt, > our choice, to the submitters of each of 100 bugs drawn randomly. <cough> ... 'scuse me ... a nifty Netscape Mozilla mug?? 50 of them do you say?? Let's, see. Last time I checked a single share of Netscape Communications Corporation (NASDAQ: NSCP) was trading for about $60 plus change. I calculated the wholesale cost of the mugs at approximately $1.20 each, which would bring the total mug promotion budget (50 * $1.20) to the equivalent of one single share of NSCP. Gee, that certainly motivates me. But then again, there's those snazzy Netscape polo shirts. ;-) Shame that Netscape isn't Microsoft. I'm sure that other vendors might at least offer the Great Powerful Internet Bugs Hunters.a choice between the snazzy shirt or the nifty mug? But I guess most of the shirts and mugs weren't reserved for the Bugs Hunters. They were probably in de press kits. > We'll conduct the first drawing when we ship Beta 2 for all platforms > and the second drawing when we release the final version of Netscape > Navigator 2.0. > > If you find a Security bug that hasn't been previously found, and can > be reproduced by us, we'll contact you via email and offer you your choice > of any item in the Navigator products or Bazaar section of our General > Store. Wow, I thought. I was stupified. If I found one of the Security bugs, I could get a copy of one of the Buggy Products absolutely FREE!!! Gratis!! What man could turn his nose up at that kind of offer. This lil old rest-stop cum cafe, the one that's putting out the bounty offers on the info-highway ain't like no little greasy spoon where you stop for chile and then get CHARGED when you find a cockroach on your spoon staring you down eye to eye. Heck no, this is a CLASS operation. Dinner's on the house. > And if the security bug you find is severe as defined by Netscape, and > hasn't been previously found, and can be reproduced by us, we'll write > you a check for $1000. Now we're really talking ...If you find a really, really severe bad problem, we'll reward you with the equivalent of 16.5 shares of Netscape. A veritable REWARD OF REWARDS!! > No purchase is necessary. All entries become the property of Netscape, > and may be modified, revised, edited, incorporated into Netscape products > and otherwise used at Netscape's sole discretion. Oh, oh ... incorporated into Netscape products??? This is sort of a non-consensual waiver of all of your rights by participating in this contest?? Now this made me want to stop and cogitate for a lil bit. I thought ...(but only for a second, of course, cause there were bugs to hunt) and I thought ... and I thought that security bugs were much too important to stop this over such a trivial matter, as negotiating my rights away for the benefit of possibly getting a mug. But there was no time to stop and think. Security bugs were going to be our target. Big Game. Non of that discretionary mug stuff for us ... we can't be bribed that easily ... no sirree, bob. > Netscape is not responsible for late, lost, or misdirected entries. > All taxes on prizes are the sole responsibility of winners. By > participating you agree to these rules and the decisions of the judges, > which will be final > Any disputes concerning this event will be settled by arbitration. Tax on a mug?? Ok ... I think we understand each other now. The budget's tight, and all. The plan really wasn't well thought out, and of course we all know that the IPO didn't do that well, and blah, and blah, blah, blah. Ahh, but a hunt's a hunt. So a hunting, we will go. (Phew, isn't this a long post to the list??? I haven't really said anything about the SECURITY BUG yet, have I?? Sheesh, I'm so, so verbose.) But first, what is a SECURITY BUG, anyway?? What does Netscape's marketing machine consider a REAL SECURITY BUG?? If we know that, then we'll know where to look. Before we get to that ... one last quote from Netscape's spokesman, Homer. > "We are continuing to encourage users to provide feedback on new versions > of our software, and the Netscape Bugs Bounty is a natural extension of > that process," said Mike Homer, vice president of marketing at Netscape. > "By rewarding users for quickly identifying and reporting bugs back to us, > this program will encourage an extensive, open review of Netscape Navigator > 2.0 and will help us to continue to create products of the highest > quality." Gee, don't worry, Homer. The POWER OF THE INTERNET will help you to create products of the highest quality. And the POWER OF THE INTERNET will encourage a real extensive open review. And watch for my new home page coming to a web site near you. The one titled, "I DEBUGGED NAVIGATOR AND ALL I GOT WAS A LOUSY SHIRT." But back to the question of what is a Security Bug?? Because I'm not sure if Marketing is going to agree (in its sole discretion) with what a security bug is (even if it has been hunted down). So at the risk of boring everyone to tears, I'll simply provide some external standards on the matter, just so I don't jeopardize my bounty or my shirt or my mug. Let's start with some Orange Book standards. The Orange Book, DEPARTMENT OF DEFENSE STANDARD, DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA (DoD 5200.28-STD) which we're all intimately familiar with, since it of course sets the standard for everyone from the Small Business Administration to the National Science Foundation, (I think). Anyhow, it makes these points: DoD Directive 5200.28, "Security Requirements for Automatic Data Processing (ADP) Systems," stipulates: "Classified material contained in an ADP system shall be safeguarded by the continuous employment of protective features in the system's hardware and software design and configuration . . . ."[8, sec. IV] Furthermore, it is required that ADP systems that "process, store, or use classified data and produce classified information will, with reasonable dependability, prevent: a. Deliberate or inadvertent access to classified material by unauthorized persons, and b. Unauthorized manipulation of the computer and its associated peripheral devices."[8, sec. I B.3] The concern here is with the latter standard. The unauthorized manipulation of a computer and its associated peripheral devices. And this is where we jump onto the scent of the track of the Security Bug. And this is where we introduce a little old document called pushpull.html. from Netscape's Web site. It's titled: An Exploration of Dynamic Documents. > The Great Idea > > The general idea is that browsers have always been driven by user > input. You click on a link or an icon or an image and some data comes > to you. As soon as people saw they could do that, they wanted to give > a server the ability to push new data down to the browser. (An > obvious example is a stock trader who wants to see new quote data > every 5 minutes.) Up until now, that hasn't been possible. And I can think of many people who would _also_ like to push down data to a browser. But, that's not a great idea. Guess what?? It's not even a good idea. It might even be a bad idea. > Netscape Navigator 1.1 gives content creators and server > administrators two new open standards-based mechanisms for making this > work. The mechanisms are similar in nature and effect, but > complementary. They are: > > Server push -- the server sends down a chunk of data; the > browser display the data but leaves the connection open; whenever > the server wants it sends more data and the browser displays it, > leaving the connection open; at some later time the server sends > down yet more data and the browser displays it; etc. Yes, the client "processes data" and then possibly displays it, while in > Client pull -- the server sends down a chunk of data, > including a directive (in the HTTP response or the document > header) that says "reload this data in 5 seconds", or "go load > this other URL in 10 seconds". After the specified amount of > time has elapsed, the client does what it was told -- either > reloading the current data or getting new data. Hmm. Netscape's clients blindly trust and follows server's instructions and does what it is told to do. If it's told to load a particular document in five seconds. It does that. It dances to the server's instructions. Something which should cause any Security Administrator's hair to stand on end, as the server takes control of the client's machine and "manipulates it". > In server push, the magic is accomplished by using a variant of the > MIME message format "multipart/mixed", which lets a single message (or > HTTP response) contain many data items. In client pull, the magic is > accomplished by an HTTP response header (or equivalent HTML tag) that > tells the client what to do after some specified time delay. > > For server push we use a variant of "multipart/mixed" called > "multipart/x-mixed-replace". The "x-" indicates this type is > experimental. The "replace" indicates that each new data block will > cause the previous data block to be replaced -- that is, new data will > be displayed instead of (not in addition to) old data. > > So here's an example of "multipart/x-mixed-replace" in action: >>Content-type: multipart/x-mixed-replace; boundary=ThisRandomString >> >>--ThisRandomString >>Content-type: text/plain >> >>Data for the first object. >> >>--ThisRandomString >>Content-type: text/plain >> >>Data for the second and last object. >> >>--ThisRandomString-- > > The key to the use of this technique is that the server does not push > the whole "multipart/x-mixed-replace" message down all at once but > rather sends down each successive data block whenever it sees > fit. And this is the problem. We have a pipe. And we have a server making a decision when it will send the next data block. I guess the server could also decide dynamically what that data block is going to be once it has opened it's pipe to the client. That is way too much trust for a client to place in a server that it doesn't know if it can trust. > The HTTP connection stays open all the time, and the server > pushes down new data blocks as rapidly or as infrequently as it wants, > and in between data blocks the browser simply sits and waits for more > data in the current window. The user can even go off and do other > things in other windows; when the server has more data to send, it > just pushes another data block down the pipe, and the appropriate > window updates itself. Yep, the appropriate window just "updates" itself at the command of the server. A good faith update ... or let's call it a good faith process. > So here's exactly what happens: > > Following in the tradition of the standard "multipart/mixed", > "multipart/x-mixed-replace" messages are composed using a unique > boundary line that separates each data object. Each data object > has its own headers, allowing for an object-specific content type > and other information to be specified. Let's emphasize that what we have is a slave client at one end of a pipe accepting an object-specific content-type from any server. This is not within the tradition of multipart/mixed. And this is a problem. > The specific behavior of "multipart/x-mixed-replace" is that each > new data object replaces the previous data object. The browser > gets rid of the first data object and instead displays the second > data object. > > A "multipart/x-mixed-replace" message doesn't have to end! That > is, the server can just keep the connection open forever and send > down as many new data objects as it wants. The process will then > terminate if the user is no longer displaying that data stream in > a browser window or if the browser severs the connection > (e.g. the user presses the "Stop" button). We expect this will > be the typical way people will use server push. > > The previous document will be cleared and the browser will begin > displaying the next document when the "Content-type" header is > found, or at the end of the headers otherwise, for a new data block. > The current data block (document) is considered finished when the > next message boundary is found. > > Together, the above two items mean that the server should push > down the pipe: a set of headers (most likely including > "Content-type"), the data itself, and a separator (message > boundary). When the browser sees the separator, it knows to sit > still and wait indefinitely for the next data block to arrive. Now let's play with the prior example. Let's say that we utilized different types of objects. I'll use multipart/parallel and application/postscript. >>Content-type: multipart/x-mixed-replace; boundary=ThisRandomString >> >>--ThisRandomString >>Content-type: application/postscript >> >>Data for the first object >> >>--ThisRandomString >>Content-Type: multipart/parallel; boundary=ThisSecondRandomString >> >>--ThisSecondRandomString >>Content-Type: application/postscript >> >>Data for the second object >> >>--ThisSecondRandomString >>Content-type: application/postscript >> >>Deletefile >>Renamefile >>Filenameforall >>File >> >>--ThisSecondRandomString-- >> >>--ThisRandomString-- I think that the foregoing explains itself without me having to draw any more maps, than is absolutely necessary. The first data object sent is application/postscript. The second object is multipart/parallel. And it's where we conflict with federal requirements: > b. Unauthorized manipulation of the computer and its associated > peripheral devices."[8, sec. I B.3] And I think that this is applicable across the entire product line. I wonder if this makes me eligible for a bounty for each product where there is this Security Bug?? That would be very chivalrous of Netscape to offer me that. Then maybe I could get a real computer rather than this crufty old Mac Plus (a yellow one) and my 2400 baud modem... and then, I might just be able to do some virtually real hunting. Alice de 'nonymous ... (doing a bad impression of Elmer Fudd with thoughts of Bugs Bounty in his lil mind.) ...just another one of those... P.S. And yes I brought this whole issue (tangentially) to the attention of netscape.com yesterday afternoon. I think I asked whether they were going to have a formal specification and register their x-mixed-replace with IANA. They haven't gotten to my email yet, (I think). Or maybe, I'm in the Bulk response group. <shrug> P.P.S. I give permission to have this propogate freely through the cyber-aethyr. All other rights are of course reserved. C. S. U. M. O. C. L. U. N. E.

1 0

Re: what are these people selling????
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:22 AM 10/13/95, an116512(a)anon.penet.fi wrote: >why is the cp meeting sponsored by sun? >so we can hear a sales pitch on java? Again, anonymity is used to cloak an ignorant flame. But I'll respond anyway. First, who cares who hosts the meeting? Does anyone think we are so "corruptable" as to change opinions based on who hosts a meeting? Second, we met for our first 15-18 months at the Mountain View offices of Cygnus Support. Did this taint us? Did we all become Gnu hackers? Then we met for about a year at the Mountain View offices of Silicon Graphics. Same question. Third, there is much interest in Java. Positive interest, and skeptical interest. Most meetings have a focus on some topic....this one happens to be a focus on Java. Fourth, Marianne Mueller is coordinating this meeting, and she happens to work for Sun. We should be glad we have a meeting site. (Meeting sites that can hold 25-40 people for an entire afternoon are not that easy to find. Pizza places typically don't get enthusiastic about all-day meetings. Homes are typically too small. And so it goes.) So, come out of your anonymity and stop the mindless insults. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0