December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I believe the debate about the Leaky bill can essentially be summarized as: A. If the bill is interpreted in light of the Bill of Rights, et al, then we don't have anything to worry about, and it's a good bill. B. If it's not, then it's a bad bill. I would like to remind people that the US judicial system, while not as always mistaken as some believe, is not particularly noted for not making serious errors in this area. For instance, regarding the forfeiture scheme, quite a few competent lawyers have examined civil forfeiture - used for _any_ crime - and found it to be a violation of the Bill of Rights. Moreover, it is the contention of many lawyers - such as with the ACLU - that the whole ITAR scheme should have been thrown out long ago as unconstitutional. That it has not been so may be taken as an indication of how the _politically appointed_ judges on the Supreme Court, et al, are likely to make mistakes. I would also remind you of the ratings given by the American Bar Association to quite a few current judges on the Supreme Court, which may be taken as a reflection of their competency. -Allen

1 0

C2 rating of NT
by Mark Aldrich 17 Dec '03

17 Dec '03

Date: Thu, 21 Mar 1996 08:09:14 -0500 (EST) From: Mark Aldrich <maldrich(a)grctechs.va.grci.com> To: owner-cypherpunks(a)toad.com Subject: Re: your mail On Wed, 20 Mar 1996 owner-cypherpunks(a)toad.com wrote: <snip> > > Basically, I'm now questioning the C2 rating of Windows NT. The > entire security layer is modular to the Kernel. As a modular > driver, it can be removed, rewritten, and replaced. > > So, what makes it secure? What gives it the C2 Rating? How would > one go about getting a C2 rating? Politics make it C2. The DoD mandated, years ago, that all their OSs had to go to the C2 level of trust. Further, they had also mandated POSIX compliance in just about every procurement that they had to publish in CBD. Well, they then proceeded to ignore their own policy and they bought MS DOS all over the damn place because everyone wanted the stuff just like they have at home. You can't play DOOM on SCO UNIX, ya know... So, in order to not look like a bunch of incoherent IRM loosers, they effectively forced the C2 and POSIX compliance stickers onto Windows NT even though everyone (including some nameless NCSC personnel with whom I've spoken) clearly state that C2/POSIX and MS Windows NT is an oxymoron. Now everyone can claim to be running C2 and POSIX systems, even though, by admission of MS, you can't have NT configured for both at the same time. Duhhhhhh... ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

protection on IoMega ZIP drives
by Joseph L. Moll 17 Dec '03

17 Dec '03

This is in regard to the now popular ZIP disks, the removable 100MB cartridge for PC's/MAC's. Anyone have any idea how secure the ZIP disk is once it is "protected?" I know that the disk will refuse to be mounted without the passkey, but what is really happening here? Best Regards, --- Joseph (Joe) L. Moll mailto:jmoll@acquion.com Network/Communications Engineering http://www.acquion.com phone:864-281-4108 fax:864-281-4576 Acquion, Inc. Greenville, SC USA -- Specialists in Electronic Commerce

5 4

(X:x)e$ 's other use
by Gary Lee Jeffers 17 Dec '03

17 Dec '03

(X=:x)e$ 's other use. My dear fellow Cypherpunks, I believe that secret e$'s other use has been overlooked: That is, e$ would be a sound money replacement for the corrupt currency that every large state in the world currently pushes. Especially if e$ can be redeemed in something of real value on demand. As some of us know, the U.S. Fed State's Federal Reserve Notes are corrupt currency. The corruption is at 5 different levels: 1. They are DEBT currency - they are lent into existence and it is mathematically impossible to pay off this debt. If you borrow $100, then where do you get the interest - say 8% since all FRN's are borrowed into existence?. This turns the great majority of Americans into victims. If you want freedom for your citizens, you do NOT allow monopoly DEBT currency. Note: bankruptcies & good counterfeiting are the only ways. 2. Fractional Reserve Banking. That means that the bank can lend out several times the money that it actually has. I believe that that is currently 8 times but that is a rough estimation. 3. Fiat money. That means that FRN's are backed by nothing more than the willingness of banks to redeem them with other FRN's. 4. Private banks with monopoloy privledges issue the currency. The Federal Reserve is a private (non-U.S. State) institution with the mono- poly on U.S. currency manufacture. The U.S. Treasury prints the currency for the Federal Reserve. Other major states have similar arrangements. These major banks are properly called Central Banks. To turn your currency ownership over to a private Central Bank is monstrous! If the people knew what was going on, the U.S. Federal State would be destroyed along with the hidden ruling class. 5. The Legal Tender Laws. These laws force the acceptance of FRN's in the U.S.. "This money good for all debts public and private". Note that the book DREAMS COME DUE made the distinction between money and currency. The author used the word money for real money and the word currency for false money. It may be the author's private distinction. I suggest that Iran did us a good turn in making and passing billions of dollars worth of uncatchable hundred dollar bills: they allowed the retirement of billions of dollars of debt for the American people without forcing Americans into bankruptcy. In a debt currency economy, good count- terfeiting is GOOD! It adds superior counterfeit to the mass of "legiti- mate" counterfeit. kind of improves the pool :-) Secret e$ offers the possibility of ridding ourselves of the slavery of private monopoly money issue. It would also give us a choice in what currency that we would like to use. Another possibility is that due to its high quality, it would be used during depressions and would possibly even break depressions. Its extremely FLUID nature might also be a pro- tection against depressions. It would be a TRUE MONEY and would give the people the advantages of true money. Let me emphasize: we do not current- ly have REAL money nor do the people of the other major States. We do not know what real money is like. Another possibility exists with secret e$: that several different kinds could exist. They would all be convertible into each other, of course. Major differences?: Different redeemablity schemes, etc.. Secret e$ offers more that just the freedom of private transactions (as great as that is). It also offers us the power and freedom of true money! Central power is stolen freedom. THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY. The United States "Federal" Government - We'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

3 2

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:30 PM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >I don't see any reason a C2 or B2 system can't be networked to another >system(s) with the same classification. But that isn't really what I meant. >Can you make a firewall system that is C2 compliant? Isn't this what you >would need in order to connect a C2 system or network to another non secure >network, (i.e. the internet)? Leaving out Red Book details (since back when I last read the Red Book, nobody really had any general solutions to the problems), the problem is that the Orange Book demands that for C-level and above, the operating system must know the identity of all the users so it can track file, process, and authentication accesses, and for B1 and up, it also needs to know what users are allowed to use what security levels and what levels they're actually operating at. 1) It's difficult to do that - you have to trust the messages coming over a wire from the other machine to tell you who they're from, unless you can be sure there's only one user per wire. That means you need a mechanism for trusting the other machine, a mechanism for communicating that trust, a shared or mappable mechanism for identifying users, etc. That takes a certain amount of work even when you control all the machines that your machine can talk to, which you often can't (e.g. on an outer firewall.) 2) To _certify_ a system for general use (as opposed to certifying a specific instantiation of a system), you need to be sure that it will be installed and maintained in a way that will provide that identification and assurance. That's even harder, because you either need cryptographic authentication and session control, or else you need a way to guarantee that the system you're certifying only talk to machines that are administered in coordination with it, in spite of being installed by some Army grunt or military contractor who may RTFM but isn't a security wizard. And in the C2-certification biz, "cryptographic" means "something you got from the NSA", because they're the ones who do military crypto, and they tend not to trust software. Fortezza cards may do this stuff ok.... 3) The networking code becomes part of the Trusted Comptuting Base, which means you have to be able to verify that it can't mess with anything that you don't want it messing with, and if it supports more than one simultaneous user, it's got to be able to keep track of sessions and communicate them reliably to the OS and TCB. That works relatively well for serial-port user logins and maybe uucp. TCP/IP, on the other hand, is typically implemented down in the guts of the OS, partly because IP needs to talk to hardware a lot, partly because it's often easier to do the TCP and IP together, partly for "speed", and partly because it's much more efficient to hand stuff to multiple users from kernel space than to hand it up to a user-space application which then IPCs things back through the kernel to their destination user processes. It also tends to have various pieces running as root, either to access hardware or protected parts of the software, or to make it easier to transfer ownership of information to processes owned by different users. (Yes, this is a Unix-centric view, but other systems tend to do similar stuff.) This makes it difficult to verify that it's clean (hey, parts of it are tough enough to get working really well, much less bug-free), and it's even tougher at higher levels like B2 that want Least Privilege rather than having a SuperUser root that can do everything. Root stuff is just basically dangerous anyway. And B1-level OSs often run the TCB (including root) at System Low to make sure no regular user can mess with it, which makes it hard for root-owned processes to write up to users. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

BOAF Sat April 6, Melbourne
by Julian Assange 17 Dec '03

17 Dec '03

____ _ _ _ / ___| _ _| |__ _ _ _ __| |__ (_) __ _ \___ \| | | | '_ \| | | | '__| '_ \| |/ _` | ___) | |_| | |_) | |_| | | | |_) | | (_| | |____/ \__,_|_.__/ \__,_|_| |_.__/|_|\__,_| ------------------------------------------------------------------------------- Birds of a feather ____ _ _ | _ \ __ _ _ __| |_ _ _| | | |_) / _` | '__| __| | | | | | __/ (_| | | | |_| |_| |_| |_| \__,_|_| \__|\__, (_) |___/ Saturday April 6, 1996 (easter weekend) 8:30pm till day light boaf(a)suburbia.net Melbourne Australia (http://www.lonelyplanet.com/dest/aust/melb.htm) Q: who's invited? A: you Q: who will be there? A: a cross-social strata of individuals, occupations and ages. It will be an eclectic evening. Q: no, I mean who will *really* be there? A: now is not the time for potentially dichotomatic simplifications of character, but what the heck... (a) Suburbia users: From magistrates and politicians to convicted computer hackers. We have as users private investigators, writers, programmers, QC's, record producers, musicians, film directors, journalists, policemen, intelligence agents, chess champions, members of obscure religious sects, netball umpires, many, many types of scientists and engineers, security experts, doctors, accountants, bartenders, choral conductors, comedians, nurses, DJ's, military police, drivers license testing officers, farmers, haematologists, herbalists, unionists, lecturers, librarians, linguists, paramedics, basketball umpires, air force pilots, singers, surgeons, system operators, linesmen, TV service men, solicitors, taxi drivers, teachers, unemployed inventors, veterinarians, actresses, aerobics instructors, art directors, athletes, chefs, bank clerks, cleaners, prison officers, dentists, dishwashers, film marketers, housewives, locksmiths, pensioners, radiologists and waiters (to name a few) (b) members of the following Suburbia run mailing lists: Avenue St. Etienne (a musical group) fans. BoS (best-of-security digest) Paranoid system admins, computer hackers, security professionals and a whole bunch of spooks Inside-Source (inside-source) As above, but don't introduce these guys to your sister. LACC (Legal Aspects of Computer Crime) Lawyers, security professionals, police, hackers, certifyably paranoid system admins and political activists (c) Memebers of the: Powerline Action Group Alternative Technology Association Center for Comtempory Photography Ross House Association Australian Public Access Network Association Private Inquiry Agents Association (d) Selected people and organisations that we owe favors to, and who shall remain anonymous. (e) Fans of T. Capody, P.K Dick, Stanislaw Lem, Pushkin, Nabakov, Dostoevesky or Thomas Pynchon. Venue: A computationally secure address in North Melbourne, approximately 10 minutes drive from the city center and 5 minutes walk from the North Melbourne railway station. There will be around 15 Internet ISDN connected PC's and a pro-tem dedicated link to Suburbia. Though, we encourage you to forget all about life as a keyboard interface for the night. Main course meals will be available for around $10 a head. Drinks will be served till 1am. Email boaf(a)suburbia.net for the ADDRESS and DIRECTIONS on how to get to it. You will need to include the number of people you plan bringing and how many of those (including yourself) desire to digest something other than the fascinating conversation. Do not request the address unless you definitely plan on coming, or our calculations and your reputation will go down like a V1. There is NO door fee, but small donations of dollars and/or computer/radio/microwave hardware/cables are encouraged (or you might get a few funny looks) to help cover costs. Music: BYO and we will play it provided it is something people can background if they want to talk. Most techno, hard-rock and pop will end up as a North Melbourne UFO sighting before it gets anywhere near the audio equipment. R&B, Jazz fusion, and Syd Barret (early Pink Floyd) style/derived material will be looked upon a good deal more favorably, but some of us are open minded. Dress: Anything that doesn't get you an indecent exposure charge will get you in the door. 1930's incognito is just fine. ps. the undercover colour of the day is purple.

1 0

LET'S ROCK!!!!
by weinberg＠accessus.net 17 Dec '03

17 Dec '03

Ok, here is the situation. I have a person mad at me in one of my mailing lists. Turns out, this person was the owner of the mailing list! Well now I'm stuck, knocked out of the list. The owner can not see any of my mail, no matter how hard I try. I need some ideas to eather get through to her, or really fuck up the mailing list. Any ideas? WThinker P.S. please E-Mail directly to me. If you can. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WThinker Social Deviant, W.W., and CHIPs expert! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Re: Kid Gloves or Megaphones
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 16-MAR-1996 01:55:32.07 >Depending on the details of Ian's method, I don't think the debate >needs to be taken to the public, or even done - it may simply be a >done deal once the technology's out there. If Mark Twain Bank or >Merita Bank or the Federal <Exonive-Deleted> Reserve wants to offer Digicash(tm) with Payee-Non-Anonymity, they can always make it a contractual >requirement that their payees not use anonymity techniques in return for >being paid. Wouldn't the viability of such a clause depend on the anonymizing scheme in question? If the bank's cooperation isn't needed (i.e., going through a proxy), then such a limit would be empty. -Allen

1 0

Ecash API about to be released
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

With the Ecash API due to be released within a matter of days, I would welcome anyone on this list interested in building applications on top of such an API to contact me. The API will determine the calls to a libecash that DigiCash will provide. Try to send emails that contain "I would like to code..." and please don't send the ones that contain "it would be nice if someone coded..." :-) -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: A funny story [noise]
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

>... someone had left thier keys in the door lock. > So being the good cypherpunk that I am I jumped out and grabbed the >keys from the lock, then knocked on the window. The passenger rolled >down the window and accepted the keys back. Much to my surprise the >passenger was none other than Whitfield Diffie. Let me get this straight. You performed a key exchange with Whitfield Diffie? His keys were publicly available, and you securely transferred them back again? What a concept! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0