December 2003 - cypherpunks-legacy

Re: Cypherpunks vs. Coderpunks
by Chris Claborne 17 Dec '03

17 Dec '03

At 09:49 PM 2/24/96 GMT, attila wrote: >** Reply to note from Perry E. Metzger <perry(a)piermont.com> 02/13/96 1:29pm -0500 > > [snip] >= The thing that makes Cypherpunks worthwhile is that its a place where >= you could, once, get news updates about GAK, information on the latest >= research into cryptography, organize mass key crackings, discuss APIs, >= talk a bit about the politics of cryptography, etc. >= > sounds like we're having the sme problems as "democracy" --it soon becomes >irrelevant! example: > > I was out of town for 6 days: I returned to find 1056 messages in the sorted > mailbox! yes: 1056 messages which it took close to an hour to delete almost 800 > of them as irrelevant. some you can discard automatically depending on the > author, some by content, etc. but I agree: it is clutter. I spend most of my time here as a lurker but I must chime in now. :) I filter to an unread area and then try to read once per week. I know that I trim off good articles while trying to trim the fat off. If you can't exercise restraint, how about putting "junk" as the first word in your subject. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

2 1

Re: DNS-related problem, and, motherhood 'n apple pie, etc
by mrm＠netcom.com 17 Dec '03

17 Dec '03

I hope people evaluate Java (and all software) based on technical issues, and not based on whether or not you think I'm clueless, brain damanged or a liar. We take the DNS-related problem very seriously; we do understand how DNS works (I did say "apologies for the oversimplifiation"); we never have put our heads in the sand. I do think it's a bit unfair to the Java team to say we put our heads in the sand, since we are deliberately trying to be as open and honest and forthcoming as we can. I mean, we are publishing full source code, which I'm not sure is the case for lots of software that people place a lot of trust in, implicitly or explicitly. As I've said every time I've said anything, every time security awareness on the net is raised, I think it's good for the net. I personally don't regard the internet as secure, and any information I care about I have encrypted on disk. Any information I really, really care about I don't even have on the internet. I do regular backups. I'm not saying this is what everyone has to do. But it's not that hard or time-consuming, and it wouldn't hurt. But people who are in charge of corporate security for their company, or people who have very sensitive or very valuable information on their disks, should consider the many ways that the internt is insecure, not just how some applet could be exploited. Having said that, does that imply that I think it's OK for a Java application to have security holes? Of course not! I hope we can use Java-the-language to build more secure systems than we've gotten used to surviving in the past. Does that mean I'm downplaying the importance or seriousness of any applet-related hole? Of course not! I think it's possible simultaneously to understand the seriousness of a security hole, AND still to say it's a good idea for people to practice safe internet. Marianne Mueller I work for Sun, on the Java team. mrm(a)netcom.com mrm(a)eng.sun.com http://java.sun.com/people/mrm/

1 0

RE: REM_ote
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Alex Strasheim said: >(A useful feature for Netscape might be a facility that checks >periodically to see if a security patch is in order, and displays a >warning if it is.) The Simple Internet Version Control (SIVC, pronounced "civic") protocol does just this. See http://wwwhost.ots.utexas.edu/sivc/spec.html for details. SIVC is popular on the Mac, but I don't know if it's been put up as an RFC. -Paul

1 0

Re: Internet shutdown Feb 29?
by jis＠mit.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >This looks completely, totally, and insanely bogus, but I >need some kind of verification for this bizarre little >piece of mail that somehow ended up in my mailbox. > >Anybody from MIT ever heard of "Kim Dereksen"? Yeah, from several of ISP's and others (including one un-named government organization that wanted to FAX us the message, for security reasons, didn't want to send it over the network). Of course the message is Bogus... it wasn't even e-mailed from MIT (nor did the author try to make it look so). -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTDOksUtR20Nv5BtAQEoUwP/QYtgsYDnzjv/usaBax+pXX3glYLpewMO Fi/cQN5840YigQpA/3klyptyEtA9sj2Vd3CYvGfj0KYqZfRG1mSKecURRBHE7kzq hB2o4fter8Pjp+3bW3APb6DsrCvlkmYcnR+QYBN8oikKkv1+cGYvHl7w6x3LJiiU U5BLXiPc2s0= =98q4 -----END PGP SIGNATURE-----

2 1

PGP
by Chris Grantham 17 Dec '03

17 Dec '03

R U aware of a PGP mailing list? Chris P.S. How do I attach a sig to a Microsoft Exchange message? FOR BEST SECURITY -STEAM ALL PGP MESSAGES! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEvXtUAAAEEALtwrsq7zqQdTDRRpgJeCXYCuA6M49Yp93IE3ScaMwPPi297 EIEbpSyv3ZB9UBjTNHcsPADhfwDs8/yBS4SWW+NF1BwnRLUbNpZ5E6BGxGojQnF4 yC5MKNIuxDgY8FYYpsXWpxWIOJZOf5LY6E4BhZ9fGK/MfuhSvUFD9HN4zM2hAAUR tC1DaHJpcyBXLiBHcmFudGhhbSA8Y2FzcGVyQG9wdGltYS5tbWUud3N1LmVkdT4= =xznQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Encryption Chips
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:52 AM 2/25/96 -0800, Timothy C. May wrote: >At 4:47 PM 2/25/96, "A. Padgett Peterson P.E. Information Security" > >>The nice thing about am implimentation in software is that the code can be >>examined for just this sort of thing *on a randomly selected operating unit*. >>- hard to do with a chip. > >But of course one's compiler may have been subverted, as Ken Thompson >showed some years back. Software implementations are sensitive to different >sorts of attacks than hardware implementations are. These things do not need to be verified at the source level. One could verify the output of the compiler and then publish a secure hash of it. (What an tedious job.) There is infinite regress in these things, but I would tend to trust a program which verified the secure hash of the crypto system if that program was written after I received the release of the compiler I am compiling it with. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Cypherpunks vs. Coderpunks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:41 PM 2/25/96, Chris Claborne wrote: > I filter to an unread area and then try to read once per week. I know >that I trim off good articles while trying to trim the fat off. If you >can't exercise restraint, how about putting "junk" as the first word in your >subject. Ah, but where was the "junk" as the first word of your post? You see, therein lies the reason these labelling schemes almost never work. Few people think there own stuff is "junk," else presumably they wouldn't post it. You can bet your bottom e-dollar that Jim Bell won't label his posts about assassination politics or nuclear bomb high explosive triggers as "junk." Nor that I will label my own stuff as "junk." About like asking people to label themselves as "turkeys" just so we can deal with crowds better. Frankly, I think we waste more time arguing about how to improve the "signal to noise ratio," ephemeral a concept at this is, than it takes to simply delete posts each of us various dislikes. The notion that we can "nudge" other people into only posting the kinds of articles we all want to see is flawed: there is no single type of good article, and one man's "junk" is another man's "gold." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Crypto Export Legislation?
by John Young 17 Dec '03

17 Dec '03

The excerpt below is from the Wash Post article today. Does anyone know the status of the Leahy/Goodlatte bills? BTW, it's been suggested that this article is sufficiently on topic to post to the list in its entirety. Anyone else whose seen it agree? ---------- The Washington Post, February 25, 1996, pp. H1, H4. Scrambling for a Policy on Encryption Exports [Long snip] Industry also is fanning Congress's interest in taking a bigger role in the encryption debate. "Without congressional interest, the administration has no reason to liberalize exports at all," said Becca Gould, director of policy at the Business Software Alliance. "This issue is in Congress's front yard because it affects the economy" as well as U.S. citizens' privacy rights. Sen. Patrick J. Leahy (D-Vt.) and Rep. Robert W. Goodlatte (R-Va.) agree. They plan to introduce bills in the Senate and House aimed at loosening the restrictions on encryption. "The federal government is taking an attitude that's based more in the 1970s than in present time," said Leahy in a telephone interview. "This is a matter that should be decided by legislation," he added. "We're talking about billions of dollars in revenues and thousands of jobs if we're handicapped in our global market, especiaUy if what we're told to do is to build an export encryption program that is so outdated that our 12-year-old computer experts wouJd laugh at it." The bills would do away with export licenses for any encryption technology considered to be "generally available," or "in the public domain." Leahy said that although he, too, worries about national security and terrorism, trying to bottle up technology won't solve the problem. Law enforcement has "got to figure out how to keep ahead ... and surprise, surprise, there will be some times when we won't be able to eavesdrop," Leahy said. Even now, criminals can make calls at pay telephones or avoid detection in other ways. The government shouldn't cripple the computer industry every time a new technology springs up that challenges law enforcement, he said. "What I'm suggesting is that if [the administration] works with the Congress, we'll find a solution," Leahy said. ...

2 1

RE: PGP
by Chris Grantham 17 Dec '03

17 Dec '03

Sorry, that wasn't suppose to be sent there too. Chris ---------- From: Chris Grantham[SMTP:casper@optima.mme.wsu.edu] Sent: Sunday, February 25, 1996 1:38 PM To: 'Thaddeus J. Beier' Cc: 'Cypherpunks' Subject: PGP R U aware of a PGP mailing list? Chris P.S. How do I attach a sig to a Microsoft Exchange message? FOR BEST SECURITY -STEAM ALL PGP MESSAGES! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEvXtUAAAEEALtwrsq7zqQdTDRRpgJeCXYCuA6M49Yp93IE3ScaMwPPi297 EIEbpSyv3ZB9UBjTNHcsPADhfwDs8/yBS4SWW+NF1BwnRLUbNpZ5E6BGxGojQnF4 yC5MKNIuxDgY8FYYpsXWpxWIOJZOf5LY6E4BhZ9fGK/MfuhSvUFD9HN4zM2hAAUR tC1DaHJpcyBXLiBHcmFudGhhbSA8Y2FzcGVyQG9wdGltYS5tbWUud3N1LmVkdT4= =xznQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: REM_ote
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:17 AM 2/24/96 -0800, sameer wrote: >> about your browsing habits. Of course we have never done this, but if we >> were "phoning home" periodically to check for new releases it might raise >> some suspicion among the more paranoid. >> >> I guess we could make it an option... > > I don't think you need to "phone home". Just make it happen >whenever someone hits the Netscape web site. some monstrous percentage >of Netscape users haven't changed the default home page, and even >those who have do go to the Netscape page every now and then. I will point out that we are already trusting our copy of the Netscape browser not to abuse its knowledge of our browsing habits. The best we can do to assure that our trust is not misplaced is monitor its communications, and if it is encrypting, we can't even do that. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0