December 2003 - cypherpunks-legacy

[NOISE] Employers need pseudonymous off-shore remailers
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Today, I tried to find out what it takes to hire someone who is in the US on a student visa (F-1) as a consultant or part-time employee. The person is an expert in his field. I don't know anyone available with a similar proven track record. I thought, no problem, there are INS exceptions for foreign experts. So I set on a quest to find out what it takes to get the INS to grant that person a work permit. The process is simple. All I have to do is ask the California Employment Development Department for a labor certificate, give that to the INS together with an application and the required fees, after which they'll issue the permit. Getting the certificate takes usually eight months, processing the application about four months. So the whole process takes about *a year*. I was stunned. Here I am willing to hire someone to work on a product that will generate taxes in the US, and the bureaucrats are asking me to wait a year. These people have lost any touch with reality. Not that *I* would do such a thing, but an off-shore pseudonymous remailer, with payment in ecash might go a long way... [Disclaimer: Speaking only for myself, not for my employer] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Why NSA is afraid that ITARs will be thrown out in court
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:45 AM 3/26/96, jamesd(a)echeque.com wrote: >At 12:23 PM 3/25/96 -0800, Timothy C. May wrote: >> Besides, I think the best way to overturn the >> ITARs is through a court challenge; as I have noted, even the NSA's lawyers >> felt that the ITARs would not withstand court scrutiny. > >Note that the spooks have carefully avoided a full bore court >showdown. They harassed Phil until the statute of limitations >caught up with them, but never brought it to trial. If we had >no further legislation, and the courts broke ITAR, we would >be home free. No plausible legislation could give us that. Someone said he had missed my reference to this, and wanted to know more. So, I'll also pass it on here again. In the summer of 1994 I got a call from Carl Nicolai, the inventor of the "PhasorPhone," an audio-scrambling phone that was suppressed with a Patent Secrecy Order (ordered by the NSA). This was around 1980-81, and is covered in Bamford. He told me a bunch of things, including this: Carl and his lawyer got access to papers inside the NSA building, though they could not make copies. They found memos from NSA staffers saying that the ITARs had never been tested in court and would not likely survive a full Constitutional test and that it would thus be best if court cases were avoided. I passed this information along (if memory serves) to Lee Tien, representing Gilmore in various cases, and to Phil Karn. (One of them, I don't recall which, posted a message a while later saying that such documents had been found....I don't recall the details, but this was probably around fall of 1994.) Whether this NSA paranoia has anything to do with the final decision on the Zimmermann et. al. matter is unclear, but it is likely that a very strong challenge to the ITARs--maybe the appeal by Phil Karn is such a challenge, maybe the Bernstein case--will result in big chunks of the ITARs being thrown out. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Edited Edupage, 24 March 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 26-MAR-1996 19:24:26.78 To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" CC: Subj: Edupage, 24 March 1996 ***************************************************************** Edupage, 24 March 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** >ONLINE TRADING >Lombard International Brokerage in San Francisco and Pawws Financial Network >in New Jersey are two brokerage houses that have opened Internet trading >services, allowing customers to monitor their portfolios and retrieve >corporate and financial information from brokerage databases or through >links to other Web sites. "You're seeing the culmination of the information >brokerage -- with customer service, advanced analytical tools, and news >available at one place and one time on the most incredibly productive medium >that ever existed, the Internet," says Lombard's CEO. By incorporating a >Java applet into their Web design, Lombard's Web site refreshes its >information every 30 seconds so that intra-day trading charts are >automatically updated. The Pawws trading system, a tailored version of the >Security APL cash-management system, is used by several other investment >houses to display their wares. "Why should we spend time and money to tell >people how to get a modem to work? We provide brokerage -- not technical -- >services," says one user. (Information Week 11 Mar 96 p64) And discount >broker Charles Schwab & Co. will begin this May to allow its customers to >trade listed and over-the-counter stocks, get real-time quotes, and access >account information using the Schwab site on the World Wide Web. (Atlanta >Journal-Constitution 22 Mar 96 F3) They're using _Java_ to do this? >PORN IS A GOLD MINE FOR IDT >Tiny IDT Corp. has found a way to differentiate itself from the >run-of-the-mill Internet access provider. It pitches its service to porn >aficionados, with ads like: "With IDT, I access *all* Internet services. I >said *all* Internet services -- get that smirk off your face." In fact, its >service and pricing are similar to everyone else's, but its subscriber base >has grown six-fold to 65,000 in the past six months using this approach. >"IDT is looking for a marketing niche, and given how we think the primary >Internet audience is -- lonely 20-something and 30-something males -- why >not aim that niche at them?" says Gary Arlen, an Internet consultant. (Wall >Street Journal 22 Mar 96 B4) An interesting way to differentiate oneself. I would suggest that anonymnity (i.e., C2) would be a logical add-on. >NETSCAPE TO GET IN ON THE PHONE-BY-INTERNET ACTION >Netscape co-founder Mark Andreessen says that within six months the company >will build into its Navigator program voice software (which it calls Insoft) >for making low-cost long distance calls via the Internet into its Navigator >program and that long-distance phone companies increasingly won't be able to >justify their rates for telephone service. (Sydney Morning Herald 13 Mar 96 >via Individual Inc.) Any possibility that Netscape might build in some form of cryptography? I realize ITAR rules would make this problematic, but perhaps some sort of out-of-country deal for putting in the hooks for PGPhone could be done. -Allen >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage Graham Greene (assuming that your name is Graham Greene; >if it's not, substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu and in the body of the message type: unsubscribe >edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.)

9 13

Sun patch pulled (was Re: HP & Export of DCE)
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I noticed that Sun's latest libc patch (101759-04) is empty. Previous versions contained the complete U.S. version of libc, including the tres-dangerous DES and crypt functions. In the current rev only the README remains, presumably because: EXPORT INFORMATION: This patch includes code which performs cryptographic functions, which are subject to U.S. export control, and must not be exported outside the U.S. without prior approval of the U.S. government. Prior export approval must be obtained by the user of this patch. So, you might ask, what fixes is Sun not distributing??? (Rev 04) 1190985 gethostbyname() can trash an existing open file descriptor. 1182835 portmapper silently fails with version mismatch by PC-NFS client 1219835 Syslog(3) can be abused to gain root access on 4.X systems. Yup, that's right. The syslog hole that was so well publicized by CERT will remain open indefinitely because the ITAR makes it illegal for Sun to distribute the fix! So did HP and Sun spontaneously, simultaneously develop crypto awareness, or is some gummint dweeb whispering threats in their ear?

3 2

Re: National speed limits and expansion of federal power...
by Chevelle 17 Dec '03

17 Dec '03

It was only months ago that they passed a bill raising alot of speed limits to the 75mph range. Chevelle At 06:06 PM 3/27/96 -0500, Deven T. Corzine wrote: >At 11:47 PM 3/26/96, Jim Bell wrote: >>They just recently repealed the national 55 MPH speed limit. Even though it >>was repealed by law, in the same way it was passed, plenty of people have >>argued that the Federal government has no jurisdiction in this area. Those >>arguments are absolutely valid, even if they were ignored. The danger in >>giving the government implicit authority in areas not mentioned in the >>Constitution is that it is not clear how far such justification extends. > >Actually, the national government didn't even *pretend* it had jurisdiction >here. Instead, they used an indirect approach -- they passed laws which >denied some of the existing highway funding to states with higher speed >limits than 55 MPH. (Later this limit was raised to 65 MPH, given some >additional restrictions such as proximity to population centers.) > >Any and all states were perfectly free (in theory) to ignore this "national >speed limit" and set any limit or no limit at all. In practice, no states >exercised this hypothetical freedom, because they had already grown dependent >on highway funds provided by the national government. Thus, through indirect >pressure exerted through the funding mechanisms, the national government was >able to usurp perogatives which were clearly in the domain of the states. > >The national government has expanded greatly in size and powers in times of >war and national crisis. In particular, FDR spearheaded the massive growth >of the national government in response to the Great Depression, and it has >continued to grow ever since. More and more often, the national government >usurps traditional state's roles, even in situations of unquestionable state >jurisdiction such as national speed limits. The elastic clause was one key >tool used for this expansion. > >Another key tool is the commerce clause, which has been seriously abused to >secure new powers for the national government. I don't think I'll go into it >right now... > >>If the government can limit us to 55, then why can't they limit us to 40-bit >>keys? > >The national government didn't impose 55 MPH speed limits on us, the states >did it under national pressure. As for whether they can legitimately limit >cryptography use and technology, we don't have any clear answer yet, in any >legal precedent. Of course, most of us hold the opinion that cryptography >should be considered Constitutionally protected as free speech, but politics >get involved when these things get decided... > >Deven > >

2 1

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

:: Subject: HP ships full DCE internationally As I sit, somewhere not in North America, I can see a CD-Rom from Hewlett-Packard, which I've had since last year. Recently I received the following letter. I've attempted to retype its contents accurately. ---------8<--------8<--------8<--------8<--------8<--------8<--------8< [HP Logo] Hewlett-Packard Company Software and Information Delivery Operation, SST 690 East Middlefield Road Mountain View, California 94043 415/968-9200 Dear HP-UX Support Customer, Hewlett-Packard has uncovered a bundling problem in the DCE-Core fileset that is on the October HP-UX Application Release 10.0 s700/800 Application CDs. These products were bundled such that they are not compliant with U.S. Government export regulations. The part numbers for the affected CDs and products are listed below. If you have updated your systems using these CDs or for the products listed on the October HP-UX Application Release Media, please update your system with the enclosed January HP-UX Application Release 10.0 s700/800 Application media, and destroy the October media. If you have not updated your systems with this media, please just destroy the October Application Release media and use the new enclosed Application media. If you require a replacement for the October HP-UX 10.0 s700/800 Application CD that has this bundling problem corrected, please contact your local support office to request shipment of the new CD. Hewlett-Packard apologises for any inconvenience you may experience due to this bundling issue. Sincerely [signed] Charles Henderson Software Information and Delivery Operations CD PART NUMBERS --------------- 24998-11710 SE application s700 10/95 24998-11711 SE application s800 10/95 B3782-10054 Trade application s700 10/95 B3920-13614 Trade application s800 10/95 PRODUCT NUMBERS --------------- 10.01 800 B3191A DCE CORE SRV MEDIA/DOCU INTL 10.01 800 B5162AA DCE 9000 Executive Client 10.01 800 B3519AA DCE QUICK START KIT INTL S800 10.01 800 B3923AA CICS/9000 Bundle Media & Manuals, Int'l 10.01 700 B2921A DCE Core Services International 10.01 700 B5162AA DCE 9000 Executive Client S700 10.01 700 B3519AA DCE Quickstart 700 Bndl Int'l Document P/N: 5964-5231 ---------8<--------8<--------8<--------8<--------8<--------8<--------8< Excuse me, I just have to go and destroy that CD :-)

1 0

Re: (X:x)e$ 's other use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 22-MAR-1996 05:45:53.77 >Digital cash, if people can be convinced to trust it, will be a wonderful >thing because of its security, convenience, and anonymity features. I'm >sorry, but I just don't buy this "corrupt currency" schtick. While corrupt isn't quite the right word, the dollar is a politically-influencable currency. And the politicians tend to press for higher inflation and lower unemployment, because that gets them elected. The Fed has done an actually rather admirable job of standing up to the pressure (compared to how they might have behaved), but that we've got real inflation testifies to that they haven't been completely successful. Moreover, the banks that are in the Federal Reserve network have a motivation to have low interest rates for what _they_ get charged, despite this inflating the currency... thus, they've got some motivations to mismanage things. -Allen

1 0

Re: WSJ on Big Java Flaw
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:58 AM 3/26/96 -0500, John Young wrote: > Java was originally touted by Sun as a secure language. But > at least two other flaws have already been discovered in > the technology, including a less-serious problem uncovered > by the Princeton team last month. Sun's Ms. Mueller said > the problems have been correctable details in the way the > Java code is written, not problems with its basic design. Having worked on a secure OS, with a small security kernel etc. etc. etc. I realize that even those systems have bugs. The Java people will work out their bugs. Others will read their code and find more bugs. (It is to Sun's GREAT credit that they are releasing their source under a not very restrictive license.) Eventually, in several years, Java security will be ready for prime time. Of course, for really valuable things, or the really paranoid, you shouldn't connect your computer to a network. The top dog certificate key in SET is handled this way. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by mike＠fionn.lbl.gov 17 Dec '03

17 Dec '03

On Mar 27, 3:13am, Timothy C. May wrote: > Americans are typically thousands of miles away from those speaking > Japanese, Mandarin, Tagalog, Polish, Italian, Dutch, Spanish, Hindi, > Talegu, and the hundreds of other languages. It is not at all clear what > language Americans should pick as a "second language" to study. I don't really disagree with the conclusions drawn by this poster, or with the quasi-economics argument he makes. However, I must say that the above is completely wrong. MOST Americans live in large urban areas, & as such are within seconds/footsteps of people whose native languages are not English (or who don't have a single "native language", but several!). There are probably _hundreds_ of languages spoken in the San Francisco Bay Area. The school districts here routinely report double digit languages in the school age population. There are 3 Spanish language channels (& another 2 ... "multiple choice") on my tv cable system. That anglophones choose to tune them out, or to not even notice the Noah's ark around them, says something about this culture.

3 2

Re: So, what crypto legislation (if any) is necessary?
by Rich Burroughs 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) wrote: [snip] > Jim's argument (?) could be turned in all sorts of ways: "Your Honor, there > is nothing I can find in the Constitution that says I can't drive on the > left side of the road at 125 miles per hour." Indeed, there is nothing > laying out detailed traffic laws. And so on. [snip] Or a right to privacy, for that matter. It's not stated anywhere explicictly in the Bill of Rights -- the courts have patched together a legal framework for it. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb Protest the CDA - Join the EFF's Blue Ribbon Anti-Censorship Campaign! See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon

1 0