December 2003 - cypherpunks-legacy

Re: NT's C2 rating
by Rick Smith 17 Dec '03

17 Dec '03

Regarding the comment: >> Basically, I'm now questioning the C2 rating of Windows NT. The >> entire security layer is modular to the Kernel. As a modular >> driver, it can be removed, rewritten, and replaced. C2 is no big deal. It means you have the typical security measures that can be disabled or bypassed by a trojan horse. You're not doing serious protection till you put in mandatory protections like what appears in B or A level systems. The big deal is that few vendors have tried to get NCSC evaluations. Rick. smith(a)sctc.com secure computing corporation

1 0

New Encryption Software-Encrypt Image & Text Files (fwd)
by wendigo＠pobox.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thought y'all might find this interesting ... if not funny. : Press Release from Antelope Productions, Inc : : Subject: New Encryption Software; Quick@Crypt : : : Antelope Productions, Inc. is releasing our new encryption package : called Quick@Crypt that has several advantages over any other : encryption software available on the market. Now more than ever, : there is a need for security in transferring sensitive information : through the Internet and networks worldwide. There has not been a : universal way for people to send all types of files easily, : inexpensively and securely through the Internet or networks UNTIL NOW. : All other encryption software available on the market requires a : separate license for each site (the sender as well as the receiver). : With Quick@Crypt you may freely distribute the decryption program. : Only the encryption side requires a licensed copy of Quick@Crypt. : There is also no limit on the password size and there is no : restriction on overseas use. : : You will find pricing of Quick@Crypt a real bargain, given the : pricing and functionality compared to other available encryption : packages. Our price is only $99.95 plus $5 shipping in US plus state : sales tax in Texas, New Jersey and Florida. Quantity discounts are : also available. : : Installation is performed easily on any Windows or Windows 95 system. : Memory requirements with as little of 2 MB of RAM (I tried it on a : Tandy portable with 2 MB!). We also have a version to work in DOS. : There is a floating toolbar that always remains on top of your current : open window. Quick@Crypt's floating toolbar gives you four options. : 1. Encryption-You have a user friendly screen to select the drive, : directory and files that you want to encrypt. Chosen files for : encryption are grouped together and compiled into a single executable : file with an assigned password you enter. There is no limitation on : the password size. Overseas distribution of the encrypted files is not : restricted. File encryption often takes less then ten seconds. 2. : Decryption- Allows you to select the drive, directory and file you : want to decrypt. The password is requested once you select the : encrypted file. Decryption is performed in Windows or Windows 95 with : the freely distributed decryption module. Decryption module is sent : to each receiver with no licensing requirement. Decryption of the : executable file may also be performed at the DOS prompt with no : additional software. 3. Help- A user friendly system for all of : Quick@Crypt's functions, along with an index and glossary. 4. Exit : : For more information, wholesale quotations, or ordering, please email : your requests to schek(a)airmail.net (Walter Chek), Subject: Quick@Crypt : < Inquiry> : - -- Mark Rogaski <wendigo(a)gti.net> 100,000 Lemmings GTI GlobalNet System Administrator Can't Be Wrong! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVMsog0HmAyu61cJAQHGGAQAxa1n7zXlD49TH7SlQTRGlRdEp2QGmvTt Vcdp/9VrbXqNIhSHQC5yxT7rc7SDOS2mvyFx9kz4rraiBOEMt5wZpGHkExpXMFHS T8mrHHrONEUjLDiiGZSLWtCPTjd0OZ4Qp/251OJxT8kZ9P/Sdmx3NueG6dlMFMpm m5qz167wK3M= =0+8d -----END PGP SIGNATURE-----

1 0

Digital Signature Inititiative
by Stuart Theodore 17 Dec '03

17 Dec '03

Good afternoon, I am the program manager at Microsoft responsible for putting the digital signature program in place. I am sending this mail in response to a recent mail string sent to these aliases appearing at the bottom. To summarize some important points of the program: * The program creates a certificate authority infrastructure which consists of thrid party non-software affiliated companies such as VeriSign and GTE who will act to grant certificates to allow code to be signed. The policies defining who can be a certificate authority and what it means to be a trusted software publisher will be a matter of public policy(standard). The point being that Microsoft does NOT control who can/cannot sign code. * This approach solves the problem of identity and integrity, and is viewed by MS as complementary to the sandboxing approach used by Java scripting, which we view to be incomplete and unsatisfactory by itself. We believe that Java needs to sign platform dependent Java classes in addition to their sandboxing scheme. * The W3C is creating a working group in this area to develop standards around the policies mentioned in the first point, and the formats of the certificate and signature formats. Microsoft is committed to making this a open, industry, x-platform standard... * regarding the mac question - there already is a version of Internet Explorer for the Macintosh, available for download at www.microsoft.com/ie. Microsoft is has already announced its committment to building cross-platform internet products. I would be happy to answer more questions you may have about this program, inluding proving more information. Stuart Theodore Program Manager Microsoft Corporation Stuartt(a)microsoft.com >I recieved a copy of "Microsoft Interactive Developer" today in the >mail. >In it, it has a preview of Microsoft Explorer 3.0. (Flux by David >Boling on >page 120.) > >Of interest to Cypherpunks is this paragraph (in the section on OLE >support >in web browsers): > >"Since OLE controls could potentially pose a security problem, >Microsoft is >studying how to create an infrastructure to certify them. The idea is >that, >once certified, an OLE control would contain an RSA security signature >indicating that it has passed muster -- the OLE eqivelent if the Good >Housekeeping Seal of Approval! Users of Internet Explorer 3.0 could >specify >whether or not noncertified OLE controls should be loaded and executed >by >the browser." > >As a web developer, I have some problems with this scheme. Giving >Microsoft >access to virtually every OLE control on the Web does not make me more >secure. Sounds like a way to rip off ideas from the rest of the >development >world. If someone has a control that might compete with a Microsoft >product, it could be shelved and/or delayed for "further security >testing". > >Java has a decentralized mechanism for security. No one group controls >what >is a "certified" control and what is not. You write the code and >compile it >and that is that. Furthermore, you are not stuck with Microsoft >approved >platforms. (I wonder if there will ever be a version of Explorer for >the >Mac.) > >I expect the Microsoft plan to garner a bit of resistance from the Web >development community over this one... > >I do not expect to see many OLE crypto apps for the web with this plan. > >--- >Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction > `finger -l alano(a)teleport.com` for PGP 2.6.2 key > http://www.teleport.com/~alano/ > "We had to destroy the Internet in order to save it." - Sen. Exon > > > > > > >

2 1

Re: Thanks for the keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:00 AM 3/22/96, whitfield.diffie(a)Eng.Sun.COM wrote: > I would like to thank the gentleman, who identified himself only >as a cypherpunk, who fetched my keys out of the door of my wife's car >(I frequently leave keys sticking in the doors of cars), knocked on >the window, and handed them to me. That anonymity was successfully preserved demonstates the perfect forward secrecy of Diffie key exchange. Or something like that. --Tim "Not the Key Master" May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Forward: Essay: Political-economy of the Internet
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Date: Thu, 21 Mar 1996 13:40:53 -0800 (PST) From: "Michael Strangelove" <michael(a)strangelove.com> To: Multiple recipients of list <cda96-l(a)willamette.edu> Subject: Essay: Political-economy of the Internet Here are the first few paragraphs from an essay on the relationship between of freedom of speech on the Net and the "statehood" of cyberspace. I am trying to define the role of values (ethics) in the new culture of online speech and am searching for sources/theories that will help explain the new value system of the Net within the larger context of global media culture. For the complete text of this essay, send the command GET POLITICS in the SUBJECT line of an e-mail message to Michael(a)Strangelove.Com Michael Strangelove The Political Economy of the Internet (Previously published in The Internet Business Journal, http://www.phoenix.ca/sie) -- Revised -- March 12, 1996 Copyright (C) 1996, Michael Strangelove. All Rights Reserved. Comments to the author at Michael(a)Strangelove.Com This document may be forwarded and archived on the Internet, so long as no changes are made to the text, Publishers take note, this draft is part of a book on freedom and speech and the Internet which I am working on -- contact michael(a)strangelove.com for table of contents (for publishers only). Introduction "There is a growing concern that the very existence of the Internet is a threat to the nation-state" (Globe and Mail, Feb 3/96, p. A1). Recently, the headline "Nations see Internet as threat to security" appeared on the front page of Canada's national daily newspaper, The Globe and Mail. Consider for a moment that more than two decades after its "invention" and three years after its integration into popular culture and the business process, the Internet has distinguished itself on two fronts. It remains the only mass media system to escape monopolistic ownership by media conglomerates (with no sign of this changing) and it is increasingly seen, correctly, as a threat to national security and sovereignty. Meanwhile, the business community throughout the world is gradually integrating the Internet into the core of its communication and marketing infrastructure. The inevitable outcome of these trends is that the communication infrastructure (including marketing, customer service, and financial transactions) of the business community is destined to conflict with the information policies of governments. One way of looking at the Internet is to understand it as an emerging nation-state, a state that, with each passing day, becomes more entwined with the fabric of the geo- political balance of power. The corporate world, particularly multinational corporations, and governments are soon going to have to come to terms with the statehood of the Internet. Political theorist Anthony Giddons writes that "significant power, within any type of organization, consists in the capacity to determine or shape policy." This understanding of power -- policy making -- is one that any manager, executive, or bureaucrat can certainly appreciate. Power-as-policy-making sheds light on the type of power the Net, (and more comprehensively, cyberspace,) wields. More precisely, the statehood of the Net is founded on its power to deny existing nations any concrete method to exercise direct, unilateral influence over the "policy" of the Internet. It is quite clear that, congressional saber-rattling aside, no nation has successfully legislated the information policy of the Internet. As a landless nation-state, the Net's constitution, or bill of rights, is its internal information policy -- no one group, community, ideology or nation is universally recognized to have the right to determine what values, art forms, beliefs, or private thoughts can or cannot be expressed on the Net. While this information policy is framed by pre- existing international treaties concerning copyright, thus far this unwritten but very real policy has not been further defined or amended by any individual nation's internal moral standards or legislature. Bear in mind that no significant content has ever been removed from the Net as a result of any one nation's information-policy making process. Indeed, just the opposite is the case -- every attempt at censoring content on the Net has lead to increased exposure of the censored or banned content and its further proliferation throughout the Net. Admittedly, it is theoretically possible for a government to censor material on Internet servers within its borders. Yet all previous attempts at doing so have simply resulted in the censored material migrating to the Net servers of other nations and remaining accessible via the Net to all. The dynamic of regional censorship being undermined by the international Net community is now almost a daily occurrence. This "end of censorship" in the international information sphere is not threatened by the possibility of a global information policy trade agreement on censorship. Any attempt to impose the freedom of speech standards of one nation on another will certainly be interpreted as a violation of national sovereignty. As a new form of borderless state, Cspace (Internet/cyberspace) has demonstrated sovereign power over its internal information policy. The front pages of newspapers around the world are demonstrating a growing awareness of this new political animal. But neither the global body politic nor the corporate realm have come to terms with the extent of the Net's sovereignty and the future impact of this "new wired world order". For the complete text of this essay, send the command GET POLITICS in the SUBJECT line of an e-mail message to Michael(a)Strangelove.Com

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:33 PM 3/21/96 -0800, Bill Stewart wrote: >>From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >>>The Commerce/NSA study did acknowledge that the existence of foreign >>>products claiming strong encryption could have a negative effect on >>>U.S. competitiveness. However, by allowing encryption services to be >>>sold separately from the applications software that uses them, CAPIs >>>will make it extremely unlikely that general-purpose software will be >>>substantially effected by export controls. > >Which side is Dr. Denning _on_ here? At present, software using CAPIs >is not exportable under the ITAR, since the CAPI is a "component of a >munitions system"; is she now advocating legalized export of software >using government-approved CAPIs only? Case in point. I recently had a client ask me to locate a reference implementation of SSL. I fired up AltaVista and quickly found two of them. One was available thru Netscape, and the other was Eric Young's from Australia. Now, in good conscience, do I give them Netscape's non-exportable version, or Eric's already exported version. Of course I gave them Eric's. They were delighted since they can just point their foreign customers to Eric's site and avoid the whole export issue. I would like to publicly thank Eric for making his code available to US sites. I hope that this description, in some small way, helps to overcome the idiocy of not being able to export what is already freely available abroad. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Excluding articles from DejaNews
by Rich Graves 17 Dec '03

17 Dec '03

I just noticed this in their FAQ, dated February 20th: Q: I don't want my Usenet articles to appear in Deja News. What do I do? A: We have implemented a feature whereby if your article contains an X-Header looking like X-No-Archive: Yes your article will be excluded from our database forever. Anyone know if other search engines support this? I think such a standard would be a Good Thing. Of course there will be the odd private archive, and of course some nastyfolks might grep Usenet just for X-No-Archive headers, but this is a good step for casual alt.support - type privacy. -rich

1 0

Re: Censorship
by nobody＠vegas.gateway.com 17 Dec '03

17 Dec '03

drose(a)AZStarNet.com wrote: William B. F--- er, F. Buckley? The "libertarian" who supports blue laws and prayer in schools wanting to censor the internet? Nahhhhh... (And maybe it's not rational, but anyone with a name like "Arianna Huffington" is not worth taking seriously outside a room full of hundred- and fifty year old WASPs burning Beatles albums and copies of Origin of Species.) [...Sniperoo!...] _Firing Line_ debate Resolved: The Government Has the Right to Regulate the Internet "A current communications controversy fuels the proposed resolution in the latest installment of William F. Buckley Jr.'s recurring series, in which participants debate whether the Internet should be federally regulated. Among those arguing for it with Buckley are Arianna Huffington and Reid Hoffman; those against it include Susan Estrich and John Perry Barlow."

1 0

Martin Marietta Energy Systems' summary of December GAK meeting
by Pat Farrell 17 Dec '03

17 Dec '03

Thanks to John Young, who scanned the snailmail document sent out by NIS&T, I have made the available on my NIST meeting web the document that NIS&T says is: "The enclosed document is an unofficial summary of the December 5, 1995 meeting held at the National Institute of Standards and Technology to discuss the 64-bit software key escrow encryption exportability initiative." URL is http://www.isse.gmu.edu/~pfarrell/nist/dec5sum.html Nothing really new here, the author recorded essentially what I wrote up and posted back in December. But this author has a different viewpoint. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/~pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

http://anarchy-online.dementia.org/book/
by Declan McCullagh 17 Dec '03

17 Dec '03

[I'm not associated with this book except that I helped HTMLize it. -Declan] For Immediate Release ------------------------------------------------------------- A New Book Investigating Sex on the Internet is Pre-Published, Free, via the World Wide Web ------------------------------------------------------------- While the fate of online freedoms is being determined by federal judges in Philadelphia, a contributing writer to Wired magazine has decided to give away his investigative book on the subject. Charles Platt spent six months gathering data about netporn for a book to be published later this year by HarperCollins. According to Platt, "My publishers hoped to rush the book into print. When their plans changed as a result of factors outside my control, I decided the material was so topical and so important, it should be placed freely on web sites." Titled ANARCHY ONLINE, the book is divided into two parts. The first deals with net crimes such as hacking, viruses, and data piracy. Platt includes first-hand descriptions of hackers and pirates and debunks myths created by melodramatic press coverage. Part Two of the book explores free speech online and examines netporn more frankly and in greater depth than has been achieved elsewhere. Platt concludes that although a genuine problem does exist, a "war on porn" will be as unwinnable, expensive, and divisive as the "war on drugs." Part Two of the book contains about 65,000 words and is being placed online in its entirety. It includes transcripts from pornographic IRC chat sessions and sexually oriented Usenet news groups; a look at pedophilia on America Online; a new, damning investigation of Martin Rimm (whose porn study was immortalized in Time magazine); and a reassessment of issues raised by Jake Baker (who faced years in jail after he placed sadistic stories on Usenet). Platt also examines federal attempts to control encryption; the Guardian Angels; anonymous remailers; repressive laws at the state level; content-filtering software; and content rating schemes. There are exclusive interviews with Scott Charney at the Department of Justice, Ann Beeson of ACLU, Louis Rossetto and Kevin Kelly of Wired magazine, anti-child-porn crusader Barry Crimmins, David Chaum of DigiCash, and Phil Zimmermann, creator of PGP. Many other industry figures and commentators make cameo appearances. Platt concludes that net fears have been exaggerated and demands for censorship are unwarranted. "Most people who want to censor the net don't use it and are willfully ignorant of it. They tend to be religious extremists and opportunistic legislators looking for a hot-button issue. I question their right to inflict laws on a community that they don't live in and know nothing about." Platt feels that if widely available methods are used to control access by children, the net can be safer than a day- care center. "My daughter started net surfing when she was 15. Even if children have totally unrestricted access, the net is still more benign than most real-world environments. I believe this is thoroughly substantiated by my book." ANARCHY ONLINE is freely available at http://anarchy-online.dementia.org/book/ Charles Platt is the author of 40 books, ranging from computer guides to science fiction. His novel PROTEKTOR was published this year by Avon Books. He is a contributing writer to Wired magazine and has an article on net censorship in the current issue, dated April. Platt can be contacted at (212) 929 3983 or via email at cp(a)panix.com. -------------------------------------------------------------

2 1