December 2003 - cypherpunks-legacy

Re: CONTEST: Name That Program!
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:45 AM 1/30/96 -0500, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: > In fact, I'd settle for getting onto 10% of the machines, although I > suspect I could get onto more like 80% without raising a sweat. You've alleged that Macs and Unixen should be about as easy as Windows machines to crack with your CardShark. I disagree - most Mac users I know have been using virus protectors more consistently and reliably than DOS/Windows users. However, if their virus software only stops known viruses, rather than anything modifying critical resources, you might get away with it for long enough to surf some numbers. Unix is a much tougher case - while there have been a couple of viruses, they don't spread very well, even when everyone uses the same binary formats. B2 helps, of course; B1 configured reasonably should also work. ... >Case closed. Your argument would hold a lot more weight if you could >convince me that the average Internet consumer was going to rebuild his >UNIX kernel every few weeks. I suspect a machine that gets rebuilt every week may be _more_ at risk :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

2 1

[flippant reply] Re: [rant] A thought on filters and the V-Chip
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:26 AM 1/29/96 -0500, you wrote: >The cypherpunks relevance of all this is that it should soon be possible to >create completely mediated environments for ourselves and our children. >Through the use of implants and real-time VR processing, it will be possible >to edit our "interface" with the Real World such that unpleasant aspects are >edited out. We will be able to change the attire, hair, facial expressions, >voice, and even smell of those around us to conform to our own esthetic >desires. Likewise with our physical surroundings. Safety may discourage >making a complete transformation in one's surroundings, but one can >certainly soften the edges. Meanwhile, rose-colored glasses are available, or scratched-up hard contact lenses if that's the reality you'd prefer .... Bill, who spends an hour or two wearing headphones on the train several days a week.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: your bogus post
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 10:08 1/30/96, watson(a)tds.com wrote: >On Tue, 30 Jan 1996, Paul Graham wrote: > >>... >> A company capable of doing such irresponsible things is not one >> that we would trust with users' money. >> ... > >Some of you must have missed the superbowl ads where people and frogs >were getting frozen to beverage cans, and movie actors moved the grand >canyon with a horse. I think that there is a MAJOR difference between the two types of Marketing. The Superbowl adds are not designed with the intent to imply that what is being shown is Reality (how many viewers would think that what was being shown was a REAL [as opposed to symbolic] effect of the product?) while the FV is intended to play on the technical ignorance of the reader/audience and give a false [or at least slanted] view of reality.

1 0

EFF Compromises, as described in "Wired"
by tcmay＠got.net 17 Dec '03

17 Dec '03

If Eric Hughes can break his silence to comment on the FV "discovery" of keystroke-capture programs (funny, I've had a couple on my Mac for years, for error recovery), then I guess I can break my silence about "Wired" articles. This afternoon I sat in a bookstore and skimmed the article on what happened at the EFF, about the Digital Telephony compromise that was approved by the EFF board (our own John Gilmore was reported to have been the sole negative vote), and about how the EFF was effectively "chased out of town" as a result of trying to be a political entity. I can't comment on this outlook, as I am nowhere near the inner circles of the EFF. But it underscores a belief I have: that if you play _their_ game, they have already won, and you just don't know it. What's the alternative? Get them to play _your_ (_our_) game, and maybe they won't win. I'm still a member of the EFF, but the more I read about their problems, including a $200,000 debt, the more convinced I am that the Cypherpunks model is a better place to devote one's efforts and hopes to. We're still going strong after almost three and a half years, with no debt (no assets except ourselves, of course) and no "relocations" from Boston to Washington to San Francisco. So, maybe we're doing OK. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: more RANTING about NSA-friendly cpunks
by Bruce Baugh 17 Dec '03

17 Dec '03

At 12:41 PM 1/29/96 -0800, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: >when you choose to be in fear of it, the bureacrats win. On the contrary. Fear is a right and proper response to irrational demands made by people with lots more force and public support than me. Fear becomes bad only in our response to it. If I get scared into inaction, _then_ the bureaucrats win. If I take the fear as motivation to improve my own security and reduce my dependence on the whims of others, then the bureaucrats lose. It is fear of the risks I run in an unsecured state that motivates me to work on my own privacy, and to pass the info I learn on to others. But fear, in this case, is merely the acknowledgement of the vast potential for harm. Denying it is just foolish. >sheep on the planet, all the way up to the head sheep TCM, who writes >long explanations of why the police state is inevitable and nothing >we can do will stop it, You must be reading an alternate universe's version of Cypherpunks - check to make sure that your quantum stabilizers are in order. In _my_ universe, Tim May is a prominent advocate for freedom and self-government, who has written well on why the collapse of the police state (and all states) is inevitable, and what we can do in the meantime. Side note to list owner: perhaps we need a majordomo hack to check this cross-universe traffic problem. It seems to be becoming increasingly common. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

This morning I read with bemusement (and amusement) the announcement of FV's discovery of keystroke capture programs. Bemusement because we discussed these in a Cypherpunks physical meeting a couple of years ago (and on the list, too). Many of us even have them installed deliberately, for error recovery. Amusement because it looked like much ado about nothing. Then I went out for the day--contrary to popular belief, I do occasionally leave my Internet connection and venture outside--and happened to read the local newspaper. There, in a major new story by Simson Garfinkel, was the FV story plastered all over the newspaper. FUD, indeed. But, it occurred to me, this is just part of the larger syndrom. Simson's article was practically written from the FV press release. While he interviewed some "security experts," clearly the timing of his article (this morning) and the announcement by Nathaniel of his discovery (this morning) suggests the cozy relationship involved. The larger syndrome is that software deals, alliances, mergers, and problems are all based on hype. Nathaniel Borenstein issues press releases, Sameer Parekh issues press releases, and maybe even I would issue press releases if only I knew how to. Every day the business news is dominated by stories of alliances and partnerships between Microsoft, MCI, Intel, Apple, Sun, Verifone, DirectTV, Newscorp, Sprint, AT&T, BT&T, CT&T, and all the rest. And a lot of it is hype, posturing. Much of the supposed future will never emerge (anyone remember Satellite Business Systems?) Journalists seem to love this, because the press releases write the stories. Companies like it, too, because they can get free newspaper space. Everyone is scratching each other's back. And those wacky Cypherpunks, with their t-shirts and their strange ideas, are always good for a quick quote, too. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Handy WWW anonymizer proxy *and* translator!
by Rich Graves 17 Dec '03

17 Dec '03

Not only does it prevent the nasties from logging where you're coming from, but it also translates to Canadian on the fly, eh? -rich ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 00:32:36 -0500 From: John R. Covert <covert(a)covert.enet.dec.com> Newgroups: alt.revisionism, alt.politics.white-power, alt.internet.media-coverage, alt.censorship, comp.org.eff.talk, soc.culture.german Subject: Re: Simon Wiesenthal Center Did Not Attempt to Censor Internet In article <declanmDLzvJ8.8MK(a)netcom.com>, declanm(a)netcom.com (D B McCullagh) wrote: >If the German government forces Deutsche Telekom to block access to web >servers at Carnegie Mellon University, MIT, and Stanford University, it >will be slicing off communications with three of the most respected >universities in the United States. It will be interesting to see if they do. At first, I refused to believe that they would do it to WebCom. I just thought I'd mention another technique for dealing with this problem. It doesn't require dedicating disk space to specific sites; instead, it relays through to any site you specify. For an example, see "The Great Web Canadianizer" at http://www.io.org/~themaxx/canada/can.html To thwart censorship of specific sites, people who have a bit of bandwidth to spare could set up cgi scripts like this one (without the text modification the Canadianizer does -- that's its hack). (Zundel's stuff is no less offensive after the Canadianizer adds a bunch of "eh?"s and "hosers" and changes all the "-ing"s to "-in'".) /john

2 1

Re: PGP Shell Integrity
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:13 PM 1/29/96 -0800, you wrote: >Firstly, if this is viewed as "Noise" rather than "Signal", please accept my apologies. Looks like a real technical discussion instead of a flame - obviously the wrong list :-) >The matter at hand concerns my concern over my inability to check the > "integrity" of a PGP windoze shell written by Michael R. Lyman at Aegis Research Corp. > >I worry that since the shell has access to my secret ring that it might > be sending it somewhere without my knowledge. I don't know that package, but most of them act as wrappers around DOS PGP rather than filtering keystrokes or doing PGP internals. There are several risks - getting your secret ring, getting your passphrase, getting the RSA parameters without the passphrase itself. Obviously, having your secret key ring file leak is not good, but the fun parts _are_ IDEA-encrypted using your passphrases, so it's not too much of a risk. Having the passphrase or the raw keys stolen would obviously be worse. DOS/Windows is _not_ a secure operating system, if you believe that there's more than one person in the universe. (DOS doesn't believe that, so in some sense it's perfectly secure. :-) Nathaniel Borenstein's recent postings are a good reminder that keystrokes can be stolen, easily, in that environment. >The freeware was, according > to Mr.Lyman, developed "Project Manager, Forward Air Missile Defense, > United States Army Missile Command". That gvt. affiliation gives me > considerable pause as regards back doors and other ways my secret ring > and pass phrase could be compromised. > >Does anyone have any familiarity with this freeware? I do not think > I am being paranoid.. just careful. Lastly, if I am not a programmer, > what sort of inspection can I perform on the software to make sure it is not "bugged"? Without source code, if you're not a programmer, the things to look for are circumstantial evidence - is the copy of the program you got off the server PGP-signed by the purported author? Or by any programmers you trust? That doesn't tell you the program is trustable, but it does tell you if it's a fake replacing the real thing. Is the real thing trustable? (Well, probably...) There's also the problem of leaking your key back to the Bad Guys, but that's easy - the program could leak it out in your PGP messages (either obviously, as a second recipient, or in subtle nasty ways like playing with the system clock on timestamps.) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Sad state of affairs
by bofur＠alpha.c2.org 17 Dec '03

17 Dec '03

It's a pretty sad statement of how poorly this list is functioning when the RC2 source can be publically released but people would rather sling mud over glorified keystroke trappers and rant about Nazi deathcamps. Our friends at the NSA must be pleased with the slow death of this group. Sadly, Bofur. -------------------------------------------------------------------------- Bofur bofur(a)alpha.c2.org PGP available from PGP key servers Key fingerprint = 81 0C 8F 88 0A 4F 67 3F ED 52 DE 3C 55 34 26 25

4 4

Re: Opinion piece in NYT; responses needed
by andreas＠horten.artcom.de 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "Rich" == Rich Graves <llurch(a)networking.stanford.edu> writes: Rich> Is DT going to block TCP port 80 and UDP ports 7000-7029 Rich> from every machine in the world? We'll see. I told the Admin of dfn.de nicely that his routing seems to be broken. If he responds with pointing to the Zuendel site, I'll send him the other URLs and ask him to stop routing to these sites as well. Andreas P.S.: I need some fodder. Anyone else mirroring the site? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAgUBMQ3XXUyjTSyISdw9AQEvgQP+MyHBlF7JmcIBHEceFCxECnyMbuPHBnPa MvoHGdLZwIxWmEpa8YwTHb06mQ5J3oO2AiWNWLgw480krWGV10R8bhMIOBP51Htz 7Odl6S1S1NLtxE/yyzkSH4D4AukFT4BrMviPWVDGnArGwS8XioTyyxhYC4JKyjfu ahrCdu9nha8= =SWyn -----END PGP SIGNATURE-----

1 0