December 2003 - cypherpunks-legacy

FV has 91 day lag between sales and payment
by Vincent Cate 17 Dec '03

17 Dec '03

FV seems to be the only Internet payment mechanism that lets buyers quickly open an account and use their credit card to cover purchases. Anyone know of any others? The FV 90 day lag is their main downside in my opinion (though defaulting to not paying if the customer does not answer email is another problem). So FV does not take any risk at all - and a merchant has to have enough extra capital to let 3 months worth of sales sit at FV. Some ideas for ways that they or someone else could improve on this: 1) reduce the 91 days after a merchant had been a merchant for awhile 2) reduce the 91 days when sales were to long time customers 3) verify customers with letters/phone calls when opening the account and then with digital signature on sales - and give very short clearing time -- Vince ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 15:11:02 -0800 From: morehelp(a)fv.com To: vince(a)offshore.com.ai Subject: <960130/vinc0328078> (Lag between sales and payment?) Your question has been answered by a help operator for FIRST VIRTUAL (TM). The operator assigned to your question is op106 (Christopher Arndt), That operator, or someone consulted by that operator, has provided the following answer to your question: ---------------- Hello, We put an escrow hold on a seller's money for 91 days to protect ourselves from buyer credit card charge backs. We realize this can be inconvenient for some of our sellers, but at this time, that is how the system works. Federal Regulation Z of the Credit Card Regulations entitles credit card holders to a 90 period during which they can charge back any purchase. Though buyers are obligated to return the goods, this does not always happen. The credit card company is obligated by federal law to pay the buyer back, and it is the merchant who is left without payment. In our system, because it is First Virtual that has the merchant credit card account, not you, First Virtual is at risk of losing money when your buyers issue charge backs on your sale items. Because we do not conduct any credit checks on a seller, and because any buyer can charge back any charge, if we didn't protect ourselves with this 91 day hold, we could easily fall victim to charge back fraud. But once 90 days have passed, it becomes significantly harder for a buyer to make a charge back. And it is at this point that we feel that the risk of a charge back is sufficiently low that we can deliver your funds to you. We hold your money for 91 days for our protection, but the flip side is that we allow our sellers the freedom of being allowed to sell without having to go through a credit check. Virtually anyone can sell using First Virtual, and this opens up many possibilities for people who otherwise would not be able to sell products through major credit cards over the Internet. Thank you for your interest in First Virtual -- ************************************************************* ...one flew east, one flew west, one flew over the cuckoo's nest... Christopher Arndt First Virtual Holdings carndt(a)fv.com http://www.fv.com ************************************************************* ---------------- You may communicate further with our operator by replying to this message. If you are unhappy with the service you get from operator op106, you may send mail to "helpescalator(a)fv.com". Your original question is included at the end of this message. Thank you for using FIRST VIRTUAL!

2 1

[NOISE][CONTEST][FACTS] don't help much, do they?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Ontogeny recapitulates phylogeny, as the saying goes. I notice a recent surge in posts that have one or more of the bracketed labels above, presumably in an effort to make the filtering job easier for others. However, this rarely works. For one thing, many of the most noisome posts, in my estimation, lack the [NOISE] label. And many of the posts labelled [NOISE] are actually pretty interesting, to me. Some people go overboard in labelling their own stuff as [NOISE], out of some kind of false modesty. And needless to say, the labels usually propagate into later followups. (And, shockingly, some people even prepend the followups they make with the [NOISE] label, thus screwing up threading. I saw this fad for labelling over on the Extropians list. It failed then, and will fail now. For one thing, the labels take up valuable "namespace." It is far better that the 30 to 50 characters of namespace be taken up with good, descriptive thread titles. Use labels if you must, but give some thought to how they just become more roadside clutter, conveying no meaning. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

At 07:25 PM 1/30/96 -0800, Lucky Green wrote: >>I take it its completely legal to set up a Virus ftp site then? > >AFIK, in the US it is legal to set up a virus ftp site. I don't know if >someone has actually done it. Don't count on it lasting. Some European >countries have already outlawed virus (read knowledge) distribution. Anyone interested in visiting a good virus site should point their browsers to: http://www.xcitement.com/virus/ Quite a good site, really. It hasn't been "Netscape Enhanced" yet, so there are no frames and tables and inline A/V, but it gets the job done. They offer a *lot* of virus source code (almost all of it in x86 assembler) and many related resources. Some highlights of the home page are included below. I would recommend the use of something like WebWhacker, which automagically downloads the contents of a web site to your local system and edits the html files to work correctly from your local web browser. It will allow you to replicate the site quickly and easily, instead of clicking on each of the more than 2500 links one at a time. Hope this helps. If you're interested, better get there quickly. (Of course, it's been up for six months now, so it's likely already withstood a substantial amount of negative response. It may be there to stay.) ---- 8< ---- Welcome to the VIRUS Source Homepage! This page contains several virus code generators, a few mutation engines, over 500 virus source files and over 2,100 executable virus files. This material is being submitted for educational purposes only. Play at you own risk. But have fun! The purpose of this page is not to inflame, but to educate, stimulate and confront you with alternative information on the sensitive issue of virus creation and propagation. The only way in which to know the whole of a subject, is by gaining knowledge from every variety of opinion on the subject, and studying all modes in which it can be looked at. Inform yourself by analyzing and studying the source code of actual viruses, read the virus writing & assembly language tutorials. Then consider and examine every variety of opinion on the subject; the anti-virus folks, mainstream society, and most importantly ideas and opinions that are considered radical, reactionary, minority or stigmatized by some other uncomplimentary label. No wise person ever acquired wisdom in any other way... A special note to those of you who would like to see an end to this page: If all humankind minus one were of one opinion, and only one person were of the contrary opinion, humankind would be no more justified in silencing that one person than it, if it had the power, would be justified in silencing humankind... What's New? Last updated on 12/26/95. Message Board Code Generators The 2nd Generation in Virus Creation (46k) Virus Creation Lab (164k) Password: Chiba City Mass-Produced Code Generator (45k) Instant Virus Production Kit (39k) Trojan Horse Construction Kit (18k) German Virus Construction Kit (12k) Mutation Engines Mutation Engine (13k) Mutation Engine Tests (18k) Polymorphic Engine (8k) Visible Mutation Engine (20k) Source Code [A-Z] Executable Files [A-Z] Debug Scripts Over 33 debug script files (184k) Miscellanous Debug.com based interrupt stripper (3k) V-86 based interrupt stripper (13k) VSUMX507.ZIP (96k) - database of viruses. Assembly Language (resources) Virus Writing Tutorials ---- 8< ----

2 1

Active processes monitoring?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I'm running on a first generation 486 ISA 4meg ram Win 3.11 I use realdeal /commercial and wipeswap.exe in an *.bat that launch Win3.11 How can I detect if another process is running on my system? I use MEM /c in a dos window. But is that sufficient? Can a hidden process detect MEM loading and hide itself somehow? Are there others applications like MEM that are not as universal? (here, I guess that such stealth behaviour have to rely on identifying the program being loaded, thus, a less common program has less chance of being fooled) Thanks JFA

2 1

FV, Netscape and security as a product
by Greg Broiles 17 Dec '03

17 Dec '03

NSB's messages have suggested, amongst the fear-mongering, that the real target of the card-shark publicity campaign is not Joe Consumer but bankers, investors, and other "big money" folks; people who care about the large-scale fraud rate of credit card use. (Yes, the rate of fraud affects all consumers, but most people experience it as a relatively small and unavoidable cost lost in the noise of other small costs.) NSB/FV used the Murky News to reach those people the way that some people will rent a freeway-visible billboard to propose marriage to a single commuter. The trouble and expense that the sender was willing to suffer to send the message are intended to cause the reader to take the message more seriously. The rest of us who see the message on C-punks or drive past and wonder "Who is Bonnie, and why is Clyde proposing marriage to her on the freeway?" aren't an important part of the process. But I don't see FV's tactics as being especially different from folks at IBM writing a virus which affects Windows but not OS/2, and quietly shopping it around to scare Microsoft customers, or Ford underwriting an NBC news program which shows Chevy pickups blowing up. (both are hypotheticals.) Sure, it can be done, and perhaps it's not dishonest, and perhaps they can wear the hat of "Consumer Protector Man", but I think it'd come across as less offensive if it weren't presented as a discussion about security. Statements which can be boiled down to "We think our product is superior to our competitor's product" don't mix well with quotes from academics and a "Chief Scientist" signature block. While, as Vin McLellan points out, Simson Garfinkel's articles were technically accurate (modulo the quote from Daguio, where he's quoted as suggesting an "out of hand" transaction, which is likely either a typo or a misunderstanding - dollars to donuts he said "out of band"), they also appeared as part of a marketing process. Netscape and FV have both taken a "security is a product" stance, which is a gross misrepresentation. FV and NSB's materials have done a good job of critiquing Netscape's "security is a product / don't worry, just look for the cute blue key" approach, but would replace it with their own "security is a product / trust the phone but not the net" approach. Both suggestions (and the implication of the Murky News articles, that one can be trusted but not the other) are wrong. Security is never a product. (Not a firewall, not a fancy browser, not PGP, not a gun, not the Club, not an airbag.) FV has tried to productize their approach (out-of-band transfer of credit card number + long clearing time for sellers + negligible per-unit cost for goods sold) but it won't work any better for FV consumers than it does for anyone else who tries to buy something which can't be sold. It's a shame that Garfinkel didn't spend more time/column space on suggestions or observations from the independent people he interviewed and less time on the "hot news - Netscape security broken by a competitor" angle. Are there really any "big money" people left who don't have formal or informal access to someone computer/Internet savvy enough who could have pointed out that the cardshark attack is nothing new? Yes, bad things happen if you run bad software. A two-way link between your computer and the rest of the world means it's possible for bad software to send your data to other people. It's the "Prodigy reads your hard disk/Microsoft Registration Wizard reads your hard disk" scare all over again, with "Prodigy" replaced by "evil untraceable criminals" and "hard disk" replaced by "keystrokes". Duh. We should, however, learn from what FV did right - they wrote software which (apparently) had or can have a real political effect. (It seems to have worked on Garfinkel, anyway). Cypherpunks write code? FV wrote code and got some attention for their otherwise unexciting message. (It seems to be a combination of working code and good user interface - witness the cooing over the icon indicating which type of credit card you're using and the fact that it uninstalls itself.) It's a shame that they won't use their powers for good instead of evil. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

3 2

Flaw in FV process (was FV and Netscape slagging each other off :-)
by John Pettitt 17 Dec '03

17 Dec '03

At 05:56 PM 1/31/96 -0500, Nathaniel Borenstein wrote about Jeffs attack: >Your attack would be caught by us relatively quickly because our model >is based not on a single fail-safe piece of security software, but on >*process* security. The overall process is multifaceted, with many >checks and balances. Yes this is all fine and good - but your process does not allow for real time delivery of goods. For example: Somebody wants to buy say micrsoft office from me for electronic delivery (yes they have a lot of bandwidth :-). I can authorize a credit card, fun it by my fraud screen and start shipping in less than 30 seconds. At this point the transaction is done. In the FV model as I understand it I'd have to ship the software and wait for an approve/deny/fraud from the user. If it's anything but approved I'm SOL, I still have to pay Microsoft for the product but I didn't get paid. Solve that process flaw and I'll add FV support to software.net. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

PGP commercial usage
by Dave Roberts 17 Dec '03

17 Dec '03

I have read and reread the documentation that is included with the PGP distribution (although my copy is over a year old now), and am still trying to work out if commercial use of 2.6ui is allowed outside the USA. Could someone elaborate for me, or perhaps point me to some up to date reference documentation. TIA - Dave. Dave Roberts | "Surfing the Internet" is a sad term for sad people. Unix Systems Admin | Get a board, find a beach, surf some REAL waves and SAA Consultants Ltd | get a *real* life. Plymouth, U.K. | -=[For PGP Key, send mail with subject of "get pgp"]=-

2 1

None
by Mr. Boffo 17 Dec '03

17 Dec '03

> Could someone tell me how to quit this list, I just dont > have the time to read anything that is being sent to it. Yes. You can turn your modem off :)

2 1

Ok Fake E.E.rnst!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From: Cecelia A Clancy <cacst9+(a)pitt.edu> >Subject: Ok Fake Ernst! >In-Reply-To: ><9602031850.AA18675(a)frumious-bandersnatch.MIT.EDU> Ho -- bandersnatch is powered up again and transmitting via the pigeon-beshitten attic-lattice of MIT dome! PCB-swilling frumious, the cronkest of Hasse-heads, 23 years hacking a b.s.e.e.

1 0

Turn yourself in!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

The alt.tasteless crowd is currently discussing the CDA, with some predictable results, and some not so predictable... If you wish to participate in mass civil disobedience, follow these instructions: Send a message CC'd to your local media's net address and to justice.usdoj.gov (Department of Justice) which contains something to the effect of, "I wish to turn myself in for the crime of distributing offensive material via the Internet and as evidence, provide the following:" Attach some sort of uuencoded data to your message as "evidence". Make sure that every possible media outlet hears loud and clear that you want every last case prosecuted.

2 1