December 2003 - cypherpunks-legacy

spam detector algorithm?
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've been mulling over algorithmic/computational ways to spot spams for some time now. I think I might've come up with a way to represent messages (and compare representations) that would be useful to remailer operators who don't want to let spams (where "spam" == many messages with identical or very similar content) through their remailers. Any such technique will really only be useful at the last remailer in a chain, at least until people start sending encrypted spams (and there doesn't seem to be so much incentive for sending those). My proposed method is this: break the body of a message down into a list of words (with their frequencies). Eliminate words in that list which aren't in the "standard dictionary" (which ideally will contain many of the words used in the messages but doesn't need to have all of them). Alphabetize the list of words which remain. Plot a point in 3d space for each word in that list where its X coordinate is its position in the alphabetized list, its Y coordinate is its position in the dictionary, and its Z coordinate is its frequency (of appearance in the original text). This should produce a curve which "describes" the original text; messages which use many of the same words as the original (and don't use any new words) and have similar usage counts should produce similar curves. My assumption (which needs some testing) is that even moderately intelligent auto-spams (e.g., which assemble canned sentences into paragraphs or canned paragraphs into messages) are going to be similar enough that they'll eventually generate similar curves as other messages - the order in which the words appear doesn't matter (and isn't preserved). I'm also assuming that adding enough words to change the curve's shape would make the resulting messages nonsensical or wierd enough that they're unlikely to be useful for people who want their spams to get read. Evildoers solely interested in generating volume without coherence can just quote libertarian/objectivist texts (ha, ha, just a joke for all of you people who keep slamming "commies") or pick words/characters at random. I'm assuming - and this may be an erroneous assumption - that it's feasible to algorithmically describe and compare curves/lines in 3d space. My math is weak and spotty, but I think that's college-level (high-school, even?) math. It seems like one might compare equations which describe the curves for similarity (e.g., one curve might be x=2y+1 (in 2d space) and another might be x=2y+1.2, where "y=10" initially for each), and also compare the areas demarcated by the lines for similarity. My reason for including word frequency as a third dimension is to dampen the effect of an intelligent spammer throwing in a few early "A" words (e.g., "aardvark abcess absolute") or "Z" words to skew the curve. Any thoughts about this? Interesting? Stupid? Like I said, my math is weak. My intention is to try to cobble up a 2d version of this to see how it runs but I thought I'd see if anyone can point out why it can't work, or if it's useful enough that someone with a better math background than I've got wants to take this idea somewhere better. One side effect to the deployment of spam detectors may be that the remailer pinging services will need to move to using encrypted packets. It'd be possible for the remailer operators to identify and specially handle reliability measuring packets but that seems broken. Ideally, they should be indistinguishable from ordinary remailer messages. At least until money is involved, nobody's likely to give them special treatment - but even relatively small charges for remailing would make it more attractive for a remailer operator to try to skew the results of the pinging services so as to direct more traffic to themselves (my remailer recently hit Raph's Top Three again and that always brings a big traffic hit - it'll probably drop out again pretty soon and things'll be slow again. If I was getting $.10 for every message, though, I might care more about keeping it in the top 3.) My initial plan would be to include code in a spam detector which simply MD5's messages which don't seem to have identifiable words, and watches for a repeat of those hashes in, say, the last 100 messages seen; this would force someone who wants to send an encrypted spam (or uses a spam-detecting remailer to reach a non-detecting remailer) from encrypting once and sending 1000 times; they'd have to encrypt 1000 times to send 1000 times, which may be enough of a performance drain on them to make spamming less attractive. My impression is (speak up if I'm wrong) that requiring encryption for the ping packets wouldn't be an enormous burden on the pinging services because the new generation of software sends fewer pinging packets such that the CPU time required isn't an issue. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHnYyn3YhjZY3fMNAQFnAgP/fBEaa7SObeu9wyqMCO6OW8rEraOtmxRG ynWeZVVvrtHgwuaS0NlhU4IMHVj/Laks4n6bbEbNRktfl/F5+HBvova52JQhoUkb 7EjEsRh57OwXHuVxJl/zODIH+qNd9lZP6+Tv7Vk2/SXVj3oRFD1jIZBUx6rBBZvf ZOaimDcSemw= =LjFV -----END PGP SIGNATURE-----

1 0

Re: HTTP anon proxy pointers
by Jay Campbell 17 Dec '03

17 Dec '03

At 12:00 PM 10/9/95 -0500, Kevin L Prigge wrote: >I seem to recall that someone was working on an anonymous http >proxy a couple months ago. Pointers would be appreciated. Thanks. We had discussed this at the last Bay Area Cypherpunks meeting (BTW, when/where is the next??), and came to the conclusion that it would be technologically simple, but load inefficient, to implement in a large scale at this point. The main problem with anonymous http (or telnet, talk, etc) lies in the sheer amount of information being transferred, and the even larger amount of noise an anonymous site would have to generate to defeat traffic analysis. A mail message is usually under a few K, but with these larger systems you move into the multiple meg realms; to hide a single individual's (ie,) 3K/sec stream, a provider would have to generate many times that in cover traffic. We can force traffic to the user from network speeds to slow down to modem speeds, but that doesn't help the inbound crunch at all. Web sites don't generally generate much inbound traffic, but when coupled with dialups (such as in my case) this could lead to bad service to the local modem users. The good news is, with multiple anon redirectors bouncing traffic between them to further confuse an attacker, the number of users can grow an order of magnitude without any additional load, since the streams are hiding in the midst of other streams and far less random cover traffic needs to be generated. Software-wise, an anonymous http scheme could be implemented with a standard proxy server with remote host access restrictions and log analysis tools to charge the appropriate individuals for their usage (a la anon email postage stamp rolls). Down the road, cover traffic, ecash payment, encryption, and other nifty toys can be added. If anyone on this list is in need of anonymous http right now (even to tinker with it) I'd be willing to set up a free-use proxy, as long as you don't bring our server or our pipe to their knees. Mail me (privately if you wish) with the individual IPs/names of the hosts you'd be coming in from - no blanket domain names, please, unless they're your own personal network. If I see enough interest I'll have a proxy up by next week. Have I missed anything? -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net "Shoot the Fruit Loop" "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Crypto's Role in Evil?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:24 AM 10/10/95, Rob L wrote: >> > We mustn't forget that, until very recently, strong, widespread >> > privacy has been humanity's "default" condition. >> >> Not much privacy in village or tribal life. Even neighborhoods of >> earlier cities weren't very private. Neighbors always knew your business. >> > >Big difference is that your neighbors were usually looking out for you.. >not waiting to catch you doing something wrong.. >Even in the small town I live in, there is considerable privacy even >though everyone knows everyone else.. people tend to keep their noses out >of others business.. of course, if you offer to talk, then its fair game >for the side of the road interrogations <g> Ah, a very astute comment! Indeed, my chief concern--speaking for myself--is not hiding my activities from my neighbors, who, by the way, share my distaste for high taxes, big government, etc., but in ensuring that the various enforcement agencies are not aware of my activities. (And even then, my concern is a bit abstract, as I'm not--take my word--a pot grower, a money launderer, an arms dealer, or a terrorist. I have violated some laws about obtaining necessary permits, such as the ones needed to run a computer consulting firm in one's home, but I don't fear a pre-dawn raid by the jack-booted thugs over this.) Priuacy is mostly needed to protect against the government, or those who inform to the government, because it is manifestly the government that throws people in jail for doing "illegal" things, not one's neighbors. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Java bugs found?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510100145.SAA00403(a)lux.reich.com>, Richard_Reich(a)reich.com (Richard Reich) wrote: > After I noticed the file had been pulled, I recovered its contents from my > netscape cache (thanks, netscape!): > > Netscape was notified on Sunday 10/8/95 by Sun Microsystems that there > is a serious security hole in their Java system [...] So much for guaranteed security. There is one question on my mind. Why do today's programs have to try to do it all? Why the heck does a wordprocessor have to ship with a compiler built in? Not to mention that there seems to be a disturbing tendency to "feature" automatic execution of arbitrary code submitted by third parties. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHntWioZzwIn1bdtAQHqMgGAmc0lpXKiDZPCxZxFmQOKvgwm8Y/RRFca rTfkfyvbdofFklrivaMy+tuuLddZRHo8 =lnto -----END PGP SIGNATURE-----

2 1

Re: netscape mail starts java attachments upon get new mail...
by Rich Salz 17 Dec '03

17 Dec '03

> Java applets can't read /etc/passwd, and can't issue NIS requests unless > they were downloaded from an HTTP server running on the NIS server Oh, you mean like a mirror or local cache? (Sure, Rocky, never happen...) > (actually, they can't do UDP at the moment, so that's out as well) Even with TIRPC NIS is still UDP-only? Has NIS+ fixed this? /r$

2 1

Re: Patents etc
by Jay Campbell 17 Dec '03

17 Dec '03

>IMHO What's needed is a) a good way of measuring usage and b) a realistic >attitude on the part of patent holders as to the value of their patents. > >A good example of how not to do it is the current mess that governs the >music indistry (which very similar problems with copying and incorporation >of material [sampling] all be it in a context of copyright rather than >patents). > >Ted Nelson did a lot of work on this for xanadu and his ideas on >transcopyright are worth exploring further. One interesting (but maybe off-topic) facet of client-side applets (a la Java) is the fact that publishers can define proprietary protocols and file formats, and change them as often as they want, giving a sort of minimal protection against casual duplication and re-publishing. With a bit more work, the formats could make true transclusions efficient and easy to apply, and help increase the amount of serious/commercial information available to the public. This is nothing new, I suppose... Java (from a user point of view) isn't that much different than IntelligentPad, which from what I understand was the client system the Xanadu people were working with recently. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net "Shoot the Fruit Loop" "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: netscape mail starts java attachments upon get new mail...
by Jay Campbell 17 Dec '03

17 Dec '03

>OBcrypto: in one of the Java papers I saw a refrence to use of RSA >signitures to allow browser users to say things like "I trust Sun >(or Tim May) to write applets that use Foo not to harm me". It >wasn't in the public release of HotJava because of licencing >constrints. Any speculation on whether Netscape will (eventually) >support that feature? If this is the case, my big hope is that Netscape doesn't limit /this/ trust system to a pre-approved set of corporate entities I'll (as a private individual) have to pay $300 for if I want my apps to do anything more than bounce faces around a user's screen. A model allowing multiple entities to put a stamp of approval (possibly with some sort of hash/checksum to match an app in question against an approval certificate) /would/ make things easier for the user, though, allowing them to set up a set of blanket rules instead of pausing and pondering a particular programmer's trustworthiness every new site he visits... a la Tim's Dirt Cheap Java Security Approval Company. Please don't nail me on semantics; I use all above terms loosely. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net "Shoot the Fruit Loop" "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: java security concerns
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

>Sendmail is about 29K lines of C code -- not significantly larger by >my standards -- and has proven nearly impossible to secure. Good point. >Sendmail performs a much simpler task and has not proven secure. I don't necessarily agree. The core java interpreter is simply: while (1) { get_next_opcode switch(x) { } } > ... Marcus Ranum has noted that you can't >trust a program thats bigger than a couple of pages long, and I >believe he's right. Its a useful metric. But the concept of trust isn't defined. If you write in pure Java code (that is no references to any native methods) we should be able to do much better than that. And since Java doesn't have "programs" it just has "classes" and many of those fit on two pages where does that leave us? Would it be reasonable to say that if I want to write a Java class I trust I should keep it under two pages? If I then write another class that uses that class, that is also under two pages have I met the requirement? Can this aggreagate four page Java class be trusted? >As an aside, have you tried breaking your own program? Spend a week on >it some time. Its usually an educational experience and it breaks you >out of the mindset you have fixed in for a while. Many times. >As people have found out, it has proven possible to core dump the Java >interpreter. That means that your implementation has contained flaws >that potentially permitted people to do unplanned things to the state >of the interpreter. I agree. >By the way, I suggest that Sun should offer a large money prize for >the first significant security hole found the Java implementation. Its >a tiny price to pay for security. I don't think the lawyers would let us. Would anyone be interested in a Java daemon that one could send arbitrary classes to in an attempt to subvert the runtime? I once thought this would be a good way to give safe exposure to the system in general. You know sort of "here's a program that can feed classes to a Java runtime on a system which is known to have a file X on it. Try to return the contents of X." It probably wouldn't be to useful beyond that, and it would only validate the classes you have access to, not necessarily the full set in a release. (hence my not doing it given its utility only in testing the core runtime) --Chuck

10 15

Coming Out Party!
by Lile Elam 17 Dec '03

17 Dec '03

Coming Out Costume Party!! @ Bryant's Bend Our wonderful house at Bryant's Bend in Palo Alto, is celebrating (our new housemate) Joyce Fortune's tenth anniversary of coming out as a lesbian. She has since become bi and celebrates bi'ness with the rest of us here at our veggie co-op. Join us in the wonderful celebrations, gaming and frolic. Come in costume as butch or fem (lingerie is most desired). All uncostumed guests will be bounced by our tall african-american femmi bouncer (Go Frankie!). The particulars: When: Saturday Night (October 14, 1995) Time: 7:00 to late Where: 130 Bryant St. Palo Alto CA What to bring: Yourselves, a costume, gay music in cd or tape cassette medium, and any erotic foods and drinks you might desire... We will be providing the atmosphere and some non-alcoholic drinks and munchies.... Directions: From 101: Take the University Exit that heads West. Follow University Street until you reach Bryant St. Make a right onto Bryant St. and follow it to the end. We are the last house on the left hand side and are on the corner of Bryant St. and Palo Alto Way. It's a big tan house with brown trimmings.

1 0

UK key escrow effort?
by Stanton McCandlish 17 Dec '03

17 Dec '03

Anyone heard anything about this? Please email me direct if you have info. TTYL. -- <A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist

1 0