December 2003 - cypherpunks-legacy

Re: firewalls and CKE
by Marcus J. Ranum 17 Dec '03

17 Dec '03

Brian W. McKenney writes: >I missed the jist of the original message The gist of the first message was that software key escrow is here, and it is the greatest thing since the discovery of fire. :) Granted, it's nice that someone has found a way of convincing the government to let them export good crypto, but in this particular application it makes no sense. >For the firewall-to-firewall encryption >scenario, the data recovery component (DRC) may be a machine that >intercepts (in real-time) the traffic and then decrypts the data (recovers >the data). The interception of encrypted data makes sense for this type of >communication since the data is not really stored on the firewall (it is >wrapped/unwrapped quickly). [the intercepted packet may be copied and then >decrypted] That's completely brain-damaged if you think about it for a second. Let's suppose I have a file and it is unencrypted. I FTP it through my SKE-equipped firewall to the Paris office. My file gets transparently encrypted as it is broken into packets and sent across the 'net. Then - what - someday I need the file back so I get the escrowed key and reassemble the file from raw packets? That's dumb! I dunno about you but I'd just recover the clear file from a backup tape. :) Firewall-to-firewall encryption is a link-layer security technology. It encrypts data in transit: before it leaves and after it arrives you *already* have a clear-text un-escrowed version of the data. If I have a corporate requirement to "escrow" my telnet sessions then I'll use a version of telnet that logs keystrokes. But I can't see any reason (unless I'm a spook) to de-archive, de-escrow, and reassemble a telnet session for archival purposes. It gets worse since all the "escrowed" packets will be mishmoshed in with DNS queries (all "escrowed") and NFS packets and lordy knows what else. If it came to having packet records, why not simply log all packets *before* they get encrypted at the firewall, while they are still in the clear? Easier, no? At least LOTUS' "key escrow" approach is openly designed for the spooks and doesn't pretend to add value to the end user. I appreciate that TIS has made a successful deal with the devil to export some strong encryption, but it's unfortunate that they're showcasing it in a way which makes absolutely no sense at all. It's a shame, because basically we're seeing smart people doing technically goofy things in order to comply with some ridiculous laws. mjr. ----- End of forwarded message from Marcus J. Ranum -----

1 0

Crypto CD UpDate
by Bholiday 17 Dec '03

17 Dec '03

Well given the somewhat enthusiastic response to my last post, I think I'll be safe enough in going ahead with plans for the CryptoCD. Thanks to everyone who responded, and I apologize that I can't address each of you individually. Some points... Copyrights: Obviously care will need to be taken to avoid publishing copyrighted materials, or publishing materials in violation of their distribution agreements. More later. Size/Contents/Etc: The media and cost of writing the disks is the same for 50megs as for 500. If I/We can put together 500 megs of content, I will gladly put 500 megs on a CD, however this will honestly require some assistance by the crypto community. Authors: OK, I had a number of authors suggest inclusion of their package on any forthcoming CD. I intend to have several machines hitting the net for aprox. 8-10hours a day over the next few weeks to gather up files for inclusion; however to speed things along it would be really great if authors could MIME or UUE their package and mail it to me, along with a return email address, and preferably a snail-mail address also. If you do send something for inclusion PLEASE include a breif note stating that you give permision to distribute the package as part of the CryptoCD package. If there is a license included in the package already (GNU, etc) you can just state that the package can be distributed according to the included license. I will include ANY package sent to me by an author, provided that space is available, however if the program(s) seem unfamiliar or questionable, I may put them in a Contrib directory with a strong disclaimer. If you ARE NOT a software author, but you think something should be included, send me email (privately, not to the list). Include a URL for the file, or better yet, include the file in MIME or UUE format. Or be really nice and snail-mail it. The first person to send me any particular file or group of files (not a URL) will be duly thanked in a CREDITS file on the CD. This is your chance to be famous for absolutely no reason at all. If you don't want to be famous just say so and I'll forget I ever got email from you. Errata: I'll be putting up a web page in the next few days which will have daily status updates (oh boy) including an LS-lr of the CD-so-far. Once the page is up, you'll want to check it if you are thinking of sending something for inclusion. I NEED URLS! If you know of a great FTP site, Please, send the address to me. I'd like to be able to offer a really comprehensive archive of as much material as possible, at a break-even price. The amount of assistance the people reading this list are willing to provide will be directly impact the quality and quantity of content on the CD, and also how quickly I am able to have the CD available. Any assistance would be truly appreciated. Ben ------------------------------------------------------------------------------ Send Mail To: bholiday(a)trader.tlx.net (prefered) bholiday(a)apollo.tlx.net (prefered) ncognito(a)gate.net (bad idea -- remailer and list mail could cause mail to be deleted without being viewed) Gate net has an absolute quota of around 12 megs, so mail sent there may bounce if I get bombarded. Apollo and Trader allow me unlimited space, and are prefered. If you want to be really nice to me, put it on floppy and mail it to me - My Snailmail address is available on request. If you snail-mail materials for inclusion, I'll pay shipping for any CD's you buy.

1 0

[ADMIN] PGP Announce List Update
by Dave Del Torto 17 Dec '03

17 Dec '03

>>>>>>>>>>>>>>> Calling All PGP Fanatics! (of varying degrees) <<<<<<<<<<<<<<< ADMINISTRIVIA: The signed message below is what someone sending mail to <pgp-announce-info(a)lsd.com> would eventually see. Please pass it on to your significant others, so to speak. FYI, I'll be in Boston at CFP96 from 26 Mar - 2 Apr, so no list-admin-business will likely get done during that period. Expect more news soon after my return about PGP 3.0 and other exciting developments. [ cue music: "Jaws" theme ] USUAL SUSPECTS WITH PGP ANECDOTES SOUGHT: Anyone who has an anus-clenching anecdote, an amusing remembrance or just an aprocryphal Jonah+Whale-tale about their experiences with PGP is encouraged to send it to <pgp-stories(a)lsd.com> for inclusion in an upcoming anthology (authors will be credited). Now's your chance to recount for all Posterity the adventurous days gone by when you were dropped behind enemy lines (Vienna, VA?) with only a laptop, your trusty educational PGP freeware and your McGyver-esque ingenuity. Do it soon, though if you want your name up in electrons: disk space is limited. ;) dave -----BEGIN PGP SIGNED MESSAGE----- "The Official PGP Announce List" Greetings. The PGP Announce List is a special-interest mailing list established to distribute first-line, official news and information about PGP (Pretty Good Privacy [tm]) from the development team led by Philip Zimmermann to interested parties worldwide (no cryptographic code is included in any of the posts). Please read the instructions below to join the list. The list is hand-maintained to help ensure that the list is received _only_ by those persons who specifically ask for it and that it contains official information only. All posting is moderated, and includes items about new PGP releases, legal developments, policy and legislative news, related software add-ons and scripts, co-development projects, software updates, domestic (USA/Canada) distribution notes, worldwide developments, etc. If you have an item to submit, do not send it to Phil: send it to <mailto:pgp-announce-owner@lsd.com> Forwarding of pgp-announce is encouraged and appreciated, but you *must* copy the entire message (including any PGP signature blocks) or we'll send lawyers to your door with rubber hoses and bad attitudes. ;) To obtain PGP for your platform (and from your geographic location worldwide) and see what all this darn excitement's about, point your web broswer at this page: <http://www.csn.net/~mpj/getpgp.htm>. When obtaining your copy of PGP, please respect all applicable export restrictions for your safety and the safety of others. For generic PGP questions or help using the software, mail the smiling PGP Help Team volunteers at: <mailto:pgp-help-humans@hks.net> with a well-documented question in something approximating the English language AFTER consulting the documentation that _always_ accompanies a valid PGP release archive. The Help Team will answer any level of PGP question, ranging from crypto-beginners on up to super-paranoid-cypherpunk-developer types. dave PS: Feel free to redirect the instructions below (including the PGP signature) to anyone you know who is interested in news about PGP. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Verbum sapienti satis est. iQCVAwUBMVXBmaHBOF9KrwDlAQERlQQAuob5u5pTYPD/X786hivrZSIzhiYlGLZw Z7hkzXAnRJkvYTcGskq6CFBGVPFjVpM4TvYY0Lkk5nCAHWVosbZH/yfx9qeSfSn7 WscppurpHHPd3CFRGGyROjqttDPl8zTZL4xMZtLCx04yMl5D8bfuHbHvG0tneaju y6xPAddXFv8= =j80g -----END PGP SIGNATURE----- INSTRUCTIONS ................................... cut here .................................. -----BEGIN PGP SIGNED MESSAGE----- .................... "How to get ON the PGP Announce List" .................... [1] <mailto:pgp-announce-request@lsd.com> [2] SUBJECT: Your Name <your(a)email.address> / \ UNquoted (") Full name \ Address in <angle-brackets> please, NOT parentheses. The Body should be left EMPTY (as in nothing, zero, null, void). Please don't put the word "subscribe" anywhere in your msg (killfile fodder). People who can't manage to follow these instructions probably shouldn't be trusted with crypto stuff anyway, right? Once a *correctly-formatted* request makes it past the evolutionary-check-filters, the actual subscription process is higher-primate-managed and list membership is updated when announcements are mailed. This list aspires to be the lowest-volume mailing list on the entire Internet, so you will NOT receive instant verification of your subscription (except for the exquisitely rare admin/test msgs and the announcements themselves). If you follow the instructions above EXACTLY, you're subscribed (and if you don't, you're not). Variations (eg. leaving out the <brackets> on the address or letting your auto-signature mechanism get out of control) will cause the bozo-filters to bit-bucket a request automagically. Sending multiple requests accomplishes nothing other than irritating the cage-cleaners. Send banana peels and/or complaints to <mailto:pgp-announce-owner@lsd.com>. SUMMARY: (GOOD/YES/CAN-FOLLOW-DIRECTIONS) TO: pgp-announce-request(a)lsd.com SUBJ: Your Name <your_address> BODY: (BAD/NO/CLUELESS) TO: pgp-announce-request(a)lsd.com SUBJ: Joe Billy Bob Bozo [jbbb(a)cant.read.directions.com} BODY: Howdy! Kin yew SUBSCRIBE me to yer list? I also has a question... .................... "How to get OFF the PGP Announce List" ................... If you wish to REMOVE yourself from the distribution list, or to CHANGE your listed address (which netiquette is greatly appreciated by the minions who shovel the bits and watch the mail-bounce errors collect, BTW), please format your request as follows: (ADDRESS REMOVAL) TO: pgp-announce-request(a)lsd.com SUBJ: REMOVE Your Name <your_address> BODY: (ADDRESS CHANGE) TO: pgp-announce-request(a)lsd.com SUBJ: CHANGE Your_Name <OLD_address> = <NEW_address> BODY: ............................................................................... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Verbum sapienti satis est. iQCVAwUBMVXBZqHBOF9KrwDlAQGvXgP+ISnuRfAvTIrev2EC5ro+8TNIwDMKg2rh 5U+NyHBx8JWESco15phTDm/f7Cm6rVjuzalWrKogfdV/UZCXuMDaYzoYz0IXcm0F Ax4PS6+Yt9cMojV87PP0Y0IVlMn7/s1cQx6em7WqjWeXdII0uZ8Sn3dZL+X4/cAH ECH31ZJ+ceA= =8Y9c -----END PGP SIGNATURE-----

1 0

NYT on Crypto Issue
by John Young 17 Dec '03

17 Dec '03

The New York Times, March 25, 1996, p. D5. The key issue for the Net is not smut, it is the use of encryption Growing fears that Big Brother might decide to read your E-mail. By Denise Caruso The current uproar over the Internet is about smut and what can be made public on the global computer network. But the next public-policy tangle will be about what we're allowed to keep secret. Earlier this month, a bipartisan group from both houses of Congress introduced versions of legislation called the Encrypted Communications Privacy Act of 1996. This bill, which outlines the proper use of encryption technologies for privacy and security, is by far the most critical piece of Internet legislation yet introduced. Encryption uses a mathematical key to scramble and unscramble digital messages so they can be read only by their intended recipients and not by human or electronic snoopers. Legislation about this powerful technology is especially important when viewed in light of two laws already on the books. One of these, the Digital Telephony Act, signed into law in 1994, allows Federal law-enforcement agencies to update the telephone network with the most pervasive surveillance equipment in history. The other, the freshly signed Communications Decency Act, bans "indecent" material from the Internet. It is a law that many legislators seemed to feel was on shaky ground even as Congress was passing it. A constitutional challenge to the law is currently being heard in Federal District Court in Philadelphia. Though the encryption bill as written is receiving qualified support from industry and civil libertarians, some worry that changes made in committee could make the bill too restrictive, completing a triumvirate of Big Brother legislation that would give law enforcement the ability and rationale to monitor all the electronic messages of citizens, leaving little or no recourse for private or secure communication. Such restrictions threaten to suffocate the Internet. As new users and businesses flock daily to the Internet, their need to protect confidential business data and messages becomes a key issue in making the Net safe enough to be useful. Computer security experts say that many of today's problems on the Net -- minors getting access to pornography, security breaches of corporate data, the need to prove one's identity -- could be solved by using encryption. Today, using encryption of any kind is still perfectly legal inside the United States. Historically, it was mostly used to protect secret military communications, so the technology is still classified as munitions -- the same threat to national security as a boatload of artillery shells. Thus any products containing encryption are subject to strict export controls. Law-enforcement and national security officials say that widespread use of strong encryption would enable terrorists and organized-crime syndicates to communicate with impunity. They say export control is the only way to keep this genie in its bottle, at least when it comes to foreign, not domestic crime. In addition, security experts have persuaded the Clinton Administration to propose an encryption method called "key escrow" that would give the Government access to information even after it had been encrypted. Key-escrow systems generate a decrypting key that is held by a trusted third party. When law-enforcement agents show up with a court warrant, the trustee hands over the key to unlock the message. So far, the Clinton Administration's proposals, which include a key-escrow system called Clipper have been universally reviled by both civil libertarians and the computer industry, which claims it stands to be deprived of up to $60 billion annually by the year 2000 because of export controls. They argue that any country today can make and sell encryption products stronger than what can be legally exported from the United States and that people won't use a system like key escrow because it has a built-in security compromise. One defender of key-escrow policy is Dorothy Denning, a professor of computer science at Georgetown University and a consultant to the military industry. She argued in a letter to Senator Patrick J. Leahy Democrat of Vermont -- one of the sponsors of the new legislation -- that such a system was vital to public safety and security. James Barksdale, president of the Netscape Communications Corporation, whose popular Web-browser software has built-in encryption capabilities, called Ms. Denning's solution a "stopgap measure." "Key escrow is an unworkable idea, and we do not support it," Mr. Barksdale said. "Key escrow will be defeated just like Prohibition was defeated by bathtub gin -- all it took was a big bag of sugar and a long weekend." Policy watchdogs like the Center for Democracy and Technology and the Electronic Frontier Foundation, both outspoken advocates for privacy rights and due process, agree that the bill is headed in the right direction. It does not dictate the use of a key escrow system, eases export controls for "mass market" products (like Netscape's), prohibits any restriction on the domestic use or sale of encryption, and provides a "personal use" policy for American travelers who use encryption while outside the country. But the bill is sure to face a fight as it moves through the House and the Senate, and the key-escrow and export-control proponents marshal their experts. David Farber, a professor of computer science at the University of Pennsylvania and a board member of the Electronic Frontier Foundation, says encryption policy always turns into "a religious discussion" between those who fear terrorism and those who want to live without fear of constant surveillance. But, he adds, if you take privacy discussions to the people, their attitudes are pretty clear. " If you ask the American public what they think of national I.D. cards, for example, a huge percentage are opposed to them," he said. "Why? They're not hiding anything. They just don't want the Government to have that type of power." [End]

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.alias.net> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono nymrod) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 25 Mar 96 6:46:51 PST remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com *+***-*++*** 8:38 100.00% ecafe cpunk(a)remail.ecafe.org #####*#-*#*# 2:14 100.00% hacktic remailer(a)utopia.hacktic.nl ************ 9:26 99.99% portal hfinney(a)shell.portal.com #-**###*#-## 5:13 99.99% pamphlet pamphlet(a)idiom.com ---+++++++++ 2:25:16 99.99% haystack haystack(a)holy.cow.net ##***+**-### 5:03 99.98% exon remailer(a)remailer.nl.com ++**+++--*** 29:20 99.98% c2 remail(a)c2.org -++++******* 22:36 99.97% nemesis remailer(a)meaning.com +********++* 24:47 99.97% shinobi remailer(a)shinobi.alias.net -+#++*-#*### 3:46 99.88% lead mix(a)zifi.genetics.utah.edu +*++++**++++ 34:01 99.86% tjava remailer(a)tjava.com ####*###* *# 1:08 99.73% extropia remail(a)extropia.wimsey.com ----------- 6:14:43 99.64% alpha alias(a)alpha.c2.org +++++ +++++ 51:14 99.64% nymrod nymrod(a)nym.alias.net ***++*++++- 31:12 99.56% gondolin mix(a)remail.gondolin.org --.-_____.- 45:37:44 99.50% gondonym alias(a)nym.gondolin.org --.._____.- 45:54:23 99.49% flame remailer(a)flame.alias.net -------.--- 5:31:19 99.38% penet anon(a)anon.penet.fi _.._._.._ 45:39:57 99.03% alumni hal(a)alumni.caltech.edu *-+##* * ## 24:59 98.83% vishnu mixmaster(a)vishnu.alias.net *--++++++- - 3:51:29 98.62% treehole remailer(a)mockingbird.alias.net -++-- ---+++ 4:35:40 98.58% spook remailer(a)spook.alias.net *- ++++**** 29:38 98.48% ncognito ncognito(a)gate.net ##* +*#*# # 1:37 98.08% vegas remailer(a)vegas.gateway.com * **___.-* 19:25:45 97.30% amnesia amnesia(a)chardos.connix.com --- ----- - 2:17:13 96.25% mix mixmaster(a)remail.obscura.com ...+-+--+- 8:02:48 94.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

shellback.com remailer PGP test
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've gotten PGP functionality added (I *think*!) to the RemailerBot software, and would like to ask folks to send a PGP-encrypted message or two to remailer(a)shellback.com Here's the public key for it... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzE0kfEAAAEEALf5sIOqMfEAFi3geJ6aofyaCRy1ZJt8D91QBqPPeU1X3ond BoIcEcfaMf7s3cOBaiEl7rKFMYqEpL08G7FFelQxc1WRvsR5XtTN+xFB3j0RPNON vMxju5j6anjPVb2RMnowSYqNKUWIEYd4Soa7L+ZWpaHgLSGkhb6Ex2tu6LdpAAUR tCFSZW1haWxlciA8cmVtYWlsZXJAc2hlbGxiYWNrLmNvbT6JAJUDBRAxNJK/xWtO /Jg7MBkBAfiVBACk6dDtebwemmY2+nxK+WD46a0Uj/lwpXLGzJvixdYGo4mwYG2/ LUw/23xBNxLIvPCFR8Qvt9zguyPdMWAp07I64ZlL6yv9Co3DETtTLB8wBdPce6Wx CLswIWAQ3MSLOmgVB35TzOYrYf5RzYtNKktCl3YDa9mxV4sug9xAx5uxvw== =9EvL - -----END PGP PUBLIC KEY BLOCK----- Many thanks..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVbN2MVrTvyYOzAZAQHi6QP+L+weAV1HrfNRNYgBjbcsSpcFpxa2yXoY hXvzgooGJHFNT3CfqaDt68InoF58Y4CrMTpsg7YgL5SqKTLqm9gqNk5bT9krN+K8 KonCbd4uH4MVo2HQOhQdCMTyoVu6oCXVbBWO8Q3ltl5q+o4rxgG5BDs0IBrGWd8J yIdjYPNjPVo= =dbJR -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: CDA Court Challenge: Day #2 (fwd)
by Vincent Cate 17 Dec '03

17 Dec '03

Declan: > I suggested to our attorney, Chris Hansen from the ACLU, that he > clarify what percentage of newsgroups were moderated. On redirect, > Hansen posed that question to Donna Hoffman of Vanderbilt University. > She replied that most newsgroups are unmoderated. Later, Bradner of > Harvard University added that moderated newsgroups amount to less > than 10 percent of the total. Another point is that the readers decide which moderated groups and mailing lists they like. If a moderator is no good people read other groups. A good question might be "Is it the free market, or a government commission, or Internet authority, that determines who gets to be a moderator?" And then maybe, "Could anyone just make a newsgroup or mailing list and be a moderator?" And maybe, "In the future when it is easier to pay for information on the Internet, is it reasonable to expect the amount of effort that goes into editing and moderating to increase?" The key point that the free market provides editing when needed. The several companies that provide browsers that censor things for kids is the free market "supply" to the "demand" of parents not wanting their kids to see things. If the government really just must get involved, it could subsidize these companies or this type of product. :-) - Vince vince(a)offshore.com.ai PS Some of us even go through the trouble to write a check and mail it in order to get an edited version of cypherpunks called cp-lite. :-)

1 0

RISKS: Princeton discovers another Netscape security flaw
by stevenw＠best.com 17 Dec '03

17 Dec '03

Posted on RISKS: ---------------------------------------------------------------------- Date: Fri, 22 Mar 1996 17:27:56 -0500 From: Ed Felten <felten(a)CS.Princeton.EDU> Subject: Java/Netscape security flaw We have discovered another serious security flaw in the Java programming language, which allows a malicious Java applet running under Netscape Navigator (version 2.0 or 2.01) to execute arbitrary machine code. We have implemented an applet that exploits the flaw to remove a file. Until a fix is issued, Netscape users can protect themselves by disabling Java in the Security Preferences dialog. At present we are not releasing technical details about the flaw. We will announce the full details later; some of the details will also appear in our upcoming paper in the proceedings of the IEEE Symposium on Security and Privacy, to be published in May. Our paper also contains an overall analysis of Java's security. For an advance copy of the paper, send mail to felten(a)cs.princeton.edu. The paper will be available in about a week. [Note that the "security enhancements" announced by Netscape in version 2.01 of Netscape Navigator do not fix this flaw. They fix two separate flaws found last month, one found by us (RISKS-17.77) and independently by Steve Gibbons, and the other found by David Hopwood (RISKS-17.83).] For more information, see http://www.cs.princeton.edu/~ddean/java, or contact Ed Felten at (609) 258-5906 or felten(a)cs.princeton.edu. Drew Dean, Ed Felten, Dan Wallach, Dept of Computer Science, Princeton Univ. [See the CIAC item at the end of this issue for some background on the earlier problems. PGN] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

3 2

DESCRIBE
by suyama＠open.tjsys.co.jp 17 Dec '03

17 Dec '03

undescribe cypherpunks(a)toad.com suyama(a)open.tjsys.co.jp --- $@"!(B $@ElpJs%7%9%F%`!J3t!K%*!<%W%s%7%9%F%`K\It(B $@"!(B $@%*!<%W%s%M%C%H;v6HIt(B $@%*!<%W%s%M%C%H;Y1g5;=QIt(B $@"!(B $@"!(B $@?\;3(B $@IRCK(B $@!J(BE-Mail:suyama@open.tjsys.co.jp$@!K(B $@"!(B $@"!(B TEL 044-246-8477 FAX 044-246-8134

1 0

signing && emacs?
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Has anyone considered adding a PGP signature to emacs local ``eval'' or hook variables? It'd sure be nice to have Emacs just load up a file without asking me if I trust the author. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | If you would seek peace, Potsdam, NY 13676 | +1 315 268 9201 FAX | first seek freedom

1 0