December 2003 - cypherpunks-legacy

Re: [noise!] (fwd) Re: FYA/I: Who'd have gaussed it?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:55 PM 1/23/96 -0500, Robert Hettinga wrote: >Just in case you wanted to know how dept... > >Cheers, >Bob > >--- begin forwarded text > >Date: Tue, 23 Jan 1996 11:21:54 -0500 (EST) >From: Paul Picot <ppicot(a)irus.rri.uwo.ca> >To: Philip Stein <pstein(a)measurement.com> [stuff deleted for space] >Use a coil *around* the building. This makes the problem just >within the realm of the possible, though horribly impractical. > >I'll spare the collected minds and spool spaces of the technomads list the >details, and reduce this to a recipe: > >Collect the following: > >- 20 miles of 0000-guage insulated copper wire (about 32 tons worth) >- five standard 20 MW gas-turbine power plant generators (about 20 tons ea.) >- fuel for about 10 minutes of operation (about 4 tons) >- five standard high voltage transmission rectifier modules for the above. >- one standard 69,000 volt, 10,000 amp transmission-line contactor set > >Wrap 1000 turns of the wire around your target. This makes a bundle about >18 inches in diameter. Wire your generators and rectifiers to yield >70,000 volts DC, and connect them via the contactor to the coil. Suppose, however, the goal was NOT to erase the media, but simply to reset (temporarily crash) the computers inside. Please recalculate based on: 1. A 72,000 volt, 0.8 microfarad capacitor, fully charged. 2. One turn of, say, #16 wire around the building. 3. A (sacrificial) improvised switch constructed by forcing a sharpened point through a thin, insulating layer of polyethylene plastic sheet against a conductive plate, which eventually (and catastrophically) arcs through the remaining fraction of a millimeter to produce an exceedingly low-impedance contact in a microsecond or so. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQWb3/qHVDBboB2dAQF0YgP+M8pc9nYzp0fwBblcd6TNC3kDt88NZbpy WiyeCxfW8tx8KNgniERKMIRrCFXfciUew9Bs1orX3CdJeDgUG2ByiLoSbGcco3Jm Vtw4MIVhhyITOhF2ocZBsReutm5WonnZlj+0upxgzYOwC0NyXR5jtHmsUMksa9Sq jy0mW2rdLxw= =1GMF -----END PGP SIGNATURE-----

1 0

re: [local] Report on Portland Cpunks meeting
by jim bell 17 Dec '03

17 Dec '03

At 04:26 PM 1/23/96 -0800, Alan Olsen wrote: >>This begs the question, "How would you conduct an efficient key signing >>given what you have learned?" I am in the process of organizing one and >>would like to get input as to the best way that this should take place. >>Should people bring key fingerprints and public keys on floppy? Would it >>be nice to be online and grab public keys off of a key server? How would >>you conduct a nym signing? > >The things that I learned was that instructions should be sent to the >participants well in advance. > >Key fingerprints should be brought on paper becuase it is not always assured >of having a computer there to read the disk. (We had a lap top that was >refusing to read disks effectivly. We had to use on of the Habit's >computers.) ...which, of course, had been infected the night before by a black-bag job by some NSA operatives with a "fiddle with PGP and make the key signatures come out wrong" virus... <G!> Paranoia strikes deep...

1 0

Re: Philip Zimmermann and the Press
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Immediately after posting my message on press queries re AU and PZ, Perry Metzger's post hit. On Jan 23, 1996 20:46:37, '"Perry E. Metzger" <perry(a)piermont.com>' wrote: > >I contacted Phil about the neo-Nazi attribution in the British >press. He has apparently contacted the newspaper and it appears that >they are probably going to print an article retracting their >statement. I've asked him to comment here but I don't know if he will. > >Perry > I wrote in the previous post that I do not think that AU adopted a responsible method of getting answers to his questions. I think that Perry did. Of course the question by both people was (in a limited sense) the same. So was the importance of the question. But the method that Perry adopted was much more responsible. I suspect it is also more likely to elicit an answer to the question. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

Re: Crippled Notes export encryption
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Dan Weinstein wrote: > On Tue, 23 Jan 1996 10:39:03 -0500, perry(a)piermont.com wrote: > > > >Set up development shop overseas for the crypto plug-ins. > > > >The solution is obvious and easy. > > > >By the way, I really think Netscape should simply ship Jeff and other > >people to the Amsterdam office or wherever else seems reasonable and > >do all the crypto work from there. It will save trouble and > >hassle. U.S. citizens wanting full 128 bit over the net would then get > >it from Netscape's overseas download sites. No one anywhere in the > >world would be forced to use crap. > > Wrong, this would be a violation of ITAR. David Chaum is doing it, why can't Netscape? I agree that it's probably technically a violation. I think that the real thing that's stopping Netscape is the golden government handcuffs, they don't want to piss off a big customer. thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

2 1

No Subject
by mixmaster＠vishnu.alias.net 17 Dec '03

17 Dec '03

Speaking of the security of networks, and the entertainment value of possible hacks... <snip> Uri Geller offers $1 million to spoon benders on World Wide Web Starting February 29, professed psychic Uri Geller will be offering $1 million to anyone who can bend a spoon on the World Wide Web. The spoon will be sealed in a transparent safe and shown by live video feed on his Web page at http://www.urigeller.com. He says he's tired of skeptics constantly asking him to proove his mental abilities, which he can't do on command, so he's looking for someone who -can- perform on command. You won't be able to just hit the page and stare at the spoon for free, though... This golden opportunity will cost $4.50 a glare. </snip>

1 0

Journalistic Questions: Re PZ. [NOISE]
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 24, 1996 02:02:41, 'djw(a)vplus.com (Dan Weinstein)' wrote in response to a series of questions I asked of Anonymous User over PZ:: > >Phil Zimmerman doesn't owe anyone an explaination of his politics. > There are many times and areas where people may "owe" an explanation of their politics. I strongly suspect, however, that the issue raised by the German (?) journalist was not likely one of them nor was the original query by AU. I was not bothered my AU's desire for accurate information on PZ's politics. I was bothered my my inference of how AU was going about getting that information, particulaly given the prejudicial aspects of asking questions on the topic to the entire cypherpunks list. I did not want to assume that my inferences of AU's behavior were automatically accurate. Thus, I posed the questions to AU directly. Could I have posted the questions to AU in a private message. Yup. Do I think this would normally have been the proper method? Yup. But I decided to follow AU's method, particularly since my questions to AU were less damaging of his reputation than his questions to PZ. In other words, since AU decided to ask public questions, so would I. Let me illustrate another way of getting answers to questions where the issues behind the questions are important but the very questions asked can be prejudicial. I was working on a story that involved how the U.S. press treated political forces behind the large anti-war demonstrations during the Vietnam War. Part of the reason for the story involved the heavy red-baiting in the press during the Korean War and immediately after it. The Vietnam War seemed to be treated in the almost opposite fashion by most of the press. That is, that real involvement by certain left groups was kept out of the press. (I ignore here the claims by ignorant rightwing forces with much to be ignorant about who routinely pronouced "Hanoi Jane" Fonda as *the* communist antiwar leader.) My researches indicated that the Socialist Workers Party and the Communist Party USA played a far greater role in the large national marches than the daily media credited (or, if you wish, damned) them for. My researches further led me to conclude that Fred Halstead headed the SWP anti-war effort and Gil Green headed a similar effort for the CPUSA. I confirmed the SWP and Halstead, and I confirmed the CPUSA. But I had not confirmed Gil Green. How to proceed? One way was the way that Anonymous User seemed to adopt. I just ask a large number of different people if Green did. I was uncomfortable with that method. First, even suggesting that somebody is a member of the CPUSA tends to injure their reputation if they are not members. Second, the people I asked may not have known shit about whether Green was, or was, not the leader. So, I did some more research, got Green's home phone number and gave him a call. At this point, Green did not owe me shit. He could have easily told me to "fuck off!" I told him who I was, what I was researching, why I was researching the story, and provided enough information for Green to know how I got his home phone number. He asked me a few questions that permitted him to get some confirmation of the material about me I had just spoken about. Did I owe Green answers to his questions? Under contract law, no. But I think at some point along the line I had at least *some* obligation ethically to answer his questions. In any case, I answered his few questions sufficiently for him to invite me over to his apartment and I got the information I wanted in the course of about a two-hour interview. That I think was a responsible way of getting the answer to my question. It was responsible to my editor, responsible to my readers, and responsible to my (potential) source. I do not think it likely that AU behaved in an equally responsible manner. But neither had anything to do with what PZ did, or did not, "owe" people. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 06:56 PM 1/23/96 -0500, Ben <adept(a)minerva.cis.yale.edu> allegedly wrote: >Because this has Cpunks relevance in the use of crypto, I'm going to keep >it on this list... > >> remain relatively secure. However, I am I'm not saying that adding >> firewalling capabilities would make the system invincible. I *am* >> saying that it would provide the system with more security than it >> currently has and would help to reduce (not eliminate) some risks >> associated with networking. > >But what does it mean to add 'firewalling capabilities' to an O/S? By >definition, a firewall is supposed to stop the spread of 'fire' by being >the sole mechanism for the interchange of packets. Essentially, adding protective mechanisms that would filter incoming network connections (incoming to the O/S) rendering potential risky connections harmless or rejecting them. Steve Bellovin has a very well-written paper called "Security Problems in the TCP/IP Protocol Suite" which addresses a number of these. If memory serves correctly at this late hour (midnight), then it can be ftp'ed from research.att.com and it is in the /pub/dist/smb directory (or somewhere around there). >If you're referring to making a hardened OS that can protect itself >through the use of well written code, memory protections, etc. then, yes >by all means add it to your OS, but these shouldn't be luxuries in that >they're thought of as 'firewalling' features. Rather these things should >be compulsory in the development of OS's. > I agree with you 100%. Eventually, I think the market will demand it and the vendors will have to begin delivering hardened O/S's. >> Of course, it would be terrific if the vendors would produce Operating >> Systems which are secure AND usable. (I think the market will eventually >> demand this from vendors, but this probably won't happen in the next year >> or two.) > >Even if OS's could be secure(lets not get into Orange Book here) they >would need constant updating. Most users have problems printing, let >alone installing patches and tweaking afterwards to deal with conflicts. Good points. As stated above, the systems should be secure AND usable. >And you can't expect IS to micromanage the corporation's entire fleet of >machines. True. However, the systems can be monitored for compliance to Corporate Security policies and the non-compliant (read insecure) systems can be quickly brought back into compliance - frequently using automated scripts. NOTE: Implementing a high level of Information Security should be as user-friendly, as non-intrusive to business operations as possible, and as cheaply as possible. (Yes, it is possible to achieve all three objectives). >This would be nice, and would be a good start, but like I said above, >these things shouldn't be considered to be luxuries. Rather they should >be compulsory. That doesn't mean that they will obsolete firewalls by >any stretch of the imagination. I agree with you 100% Nice posting, BTW. (And not just because I agree with you). 8^) >Ben. >(I'm starting to think Frank may have been right to move this to >firewalls. I think I'll crosspost this message too) >____ >Ben Samman..............................................samman(a)cs.yale.edu >"If what Proust says is true, that happiness is the absence of fever, then >I will never know happiness. For I am possessed by a fever for knowledge, >experience, and creation." -Anais Nin >PGP Encrypted Mail Welcomed Finger samman(a)suned.cs.yale.edu for key >Want to hire a soon-to-be college grad? Mail me for resume > Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

1 0

Re: Crippled Notes export encryption
by nobody＠replay.com 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)piermont.com> writes: >> >By the way, I really think Netscape should simply ship Jeff and other >> >people to the Amsterdam office or wherever else seems reasonable and >> >> That won't work -- they gotta hire non-US persons to do the work. > >There are plenty of good foreign crypto people. One of them already has implemented SSL...

1 0

Re: Crippled Notes export encryption
by Herb Sutter 17 Dec '03

17 Dec '03

At 20:32 01.17.1996 -0500, Perry E. Metzger wrote: > >Alan Pugh writes: >> infoMCI (sm) >> Lotus-Security - Lotus Announces Compromise for Export of Strong >> Encryption > >So, Lotus thinks they can fool people by back-dooring in key escrow, eh? > >Time to break out the artillery. > >Perry Careful... what would YOU have done, with your customers demanding stronger crypto today and you unable to legally give it to them? Again, folks, try to remember that this is NOT key escrow... international Notes customers are no worse off than before, and a darn sight better off against everyone besides Uncle Sam. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

15 24

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:13 1/23/96, Thaddeus J. Beier wrote: >David Chaum is doing it, why can't Netscape? I agree that it's >probably technically a violation. I think that the real thing >that's stopping Netscape is the golden government handcuffs, they >don't want to piss off a big customer. The people working on crypto for Chaum aren't US citizens. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0