December 2003 - cypherpunks-legacy

RE: ITAR double standards?
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May >You're a felon? For real? > Yes. ................................................................. Ah, yes - Tim the Indecent, vis-a-vis X-onomous signatures. Sheut. I thought maybe you'd done something really interesting. .. Blanc

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:13 AM 3/27/96 -0800, Timothy C. May wrote: >There is not a single foreign language I can think of it that would help me >in my goals or help anyone I know. This is the reality of a world dominated >by English-speaking persons and in which all technical people learn >English. I would agree with you, except I started International Caving. When in Hungery, I heard, "Peter will guide you thru the rest of the cave. Don't worry, he speaks good German." Fortunatly, my German was good enough. While in China as a normal tourist, a travel agency in Yichang tried to extort $600 from our group. My wife's (very poor) knowledge of Manderin probably scared the preps enough to get them to lay off. BTW - There are also French speakers on the US border. They don't want to speak english either. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: unsubscrive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:20 PM 3/27/96, David K. Merriman wrote: >Well, at least this one is *vaguely* forgiveable - the 'b' and 'v' keys >*are* next to each other on a keyboard.... A nice theory, but he uses the misspelling in the thread title ("unsubscrive") and in his body message of "unsubscrive cypherpunks." If he mistyped, it happened twice in the same way. (And I try to always check my spelling carefully when I am sending commands to a majordomo-type automatic processor!) "Measure twice, cut once." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: National speed limits and expansion of federal power...
by Chevelle 17 Dec '03

17 Dec '03

It was only months ago that they passed a bill raising alot of speed limits to the 75mph range. Chevelle At 06:06 PM 3/27/96 -0500, Deven T. Corzine wrote: >At 11:47 PM 3/26/96, Jim Bell wrote: >>They just recently repealed the national 55 MPH speed limit. Even though it >>was repealed by law, in the same way it was passed, plenty of people have >>argued that the Federal government has no jurisdiction in this area. Those >>arguments are absolutely valid, even if they were ignored. The danger in >>giving the government implicit authority in areas not mentioned in the >>Constitution is that it is not clear how far such justification extends. > >Actually, the national government didn't even *pretend* it had jurisdiction >here. Instead, they used an indirect approach -- they passed laws which >denied some of the existing highway funding to states with higher speed >limits than 55 MPH. (Later this limit was raised to 65 MPH, given some >additional restrictions such as proximity to population centers.) > >Any and all states were perfectly free (in theory) to ignore this "national >speed limit" and set any limit or no limit at all. In practice, no states >exercised this hypothetical freedom, because they had already grown dependent >on highway funds provided by the national government. Thus, through indirect >pressure exerted through the funding mechanisms, the national government was >able to usurp perogatives which were clearly in the domain of the states. > >The national government has expanded greatly in size and powers in times of >war and national crisis. In particular, FDR spearheaded the massive growth >of the national government in response to the Great Depression, and it has >continued to grow ever since. More and more often, the national government >usurps traditional state's roles, even in situations of unquestionable state >jurisdiction such as national speed limits. The elastic clause was one key >tool used for this expansion. > >Another key tool is the commerce clause, which has been seriously abused to >secure new powers for the national government. I don't think I'll go into it >right now... > >>If the government can limit us to 55, then why can't they limit us to 40-bit >>keys? > >The national government didn't impose 55 MPH speed limits on us, the states >did it under national pressure. As for whether they can legitimately limit >cryptography use and technology, we don't have any clear answer yet, in any >legal precedent. Of course, most of us hold the opinion that cryptography >should be considered Constitutionally protected as free speech, but politics >get involved when these things get decided... > >Deven > >

2 1

Re: Crypto CD UpDate
by Henry Huang 17 Dec '03

17 Dec '03

On Mar 26, 21:18, Timothy C. May wrote: > At 10:16 PM 3/26/96, aba(a)atlas.ex.ac.uk wrote: > >The idea of putting together a CD with crypto stuff is an excellent > >IDEA, and one which I very much welcome. > > > >However a question .. are you (Ben) located in the US? If so... > > > >that rules out overseas buyers unless you fancy messing with ITAR... > >Is it possible that you could come to some arrangement with some one > >outside the ITAR fence who has a CD writer (any one reading have one?) > >put together the same CD for those outside the US? ITAR is going to be a mess either way. If the CD is put together outside the U.S., you'd have to only use non-U.S. executables/source (or else put site owners at risk of violating the anti-export language in the ITAR). Of course, a lot of people don't take this seriously, so pick your poison ... > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. > > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. I'd argue that having a slightly out-of-date CD-ROM is better than nothing, because: - It gives you an idea of what sorts of crypto applications are out there, - It gives you working versions of programs without having to crawl all over the Net hunting for one, - If the authors are smart they'll include URL's to an update site in the documentation (or the CD-ROM producer can do it), - Not everyone out there is Net-savvy, or has the time to go trudging around looking for the latest cutting-edge versions of software. Time *IS* money. I'd almost argue that Tim's emphasis on using the Web to get crypto assumes a sort of Net-centric view of how the crypto is going to be used -- similar to reported provisions in the Leahy bill. The idea that people who just want to encrypt personal data might not need the latest versions of everything out there is reasonable -- as long as the latest versions aren't BUG FIXES. In that case, Tim's argument about stale versions would carry some merit. But this is the case for ALL non-Net distributed software; you don't see companies refusing to cut CD-ROMs simply because they're worried their users won't be able to get the latest bug fixes. In the ideal case, they'd do the best they can to make sure that people did, but you have to be realistic. (Of course, if you're cynical, and believe that software companies care more about money than about helping their customers, then it doesn't matter. ;) > (And fractions of a second is too charitable: in actuality, I'd have > to locate the CD-ROM, dismount anything already mounted, mount the > CD-ROM, search it for "PGP," etc. Probably not even faster than > using Alta Vista and downloading.) Um, whatever. If you have a CD-ROM, you'll at least have SOME idea of what software is available on it. Not so with the Web (unless somebody wants to do the equivalent of this CD-ROM and put together a page with a HUGE number of links to crypto programs -- not to mention the protections necessary to avoid violating ITAR, e.g. the anti-export measures built into the PGP distribution site) Plus, comparing the speed of a CD-ROM to a modem is like comparing the speed of a station wagon to a skateboard. CD-ROMs aren't exactly fast, but they sure as hell aren't anywhere near as slow as the water-torture speeds of your average v.42bis modem. > 3. Where CD-ROMs really shine over modem alternatives is, of course, for > very large files. Images, MPEG or Quicktime movies, etc. "Multimedia" being > the operative term. For crypto, this is not an issue. (Except for list > archives, where having a few hundred megabytes of articles might be nice. > However, the absolute KILLER of this idea is the staleness problem mentione > in Point #1: if the archives on CD-ROM lack the most recent month or two, > their usefullness drops precipitously. If the CD-ROM is a year old, and no > updates have appeared, then its archives are useful only to list > historians. I don't buy this. Many of the well-known/widely-used Net-distributed crypto apps haven't put out updates for a LONG time. Even if it was the case that they were throwing out bug fixes every two weeks, my previous comments still hold. (And anyhow, you probably wouldn't WANT to have software THAT unstable in your collection anyway. ;) I'm starting to think that the question of whether this CD-ROM is useful depends on who you're selling it to. People who hang out on Coderpunks, or are "in the loop" as to version updates and crypto sites won't want this. People who want to buy the CD just to be "cool" aren't an issue. The SOHO market (i.e. people who don't normally use the Net, and who ordinarily wouldn't care too much about crypto) seems to be the ideal target. But how do you sell a piece of software to an audience that doesn't know it needs it? Perhaps this could be a chance to spread the gospel, so to speak. However, that would mean the CD would have to be designed around these people -- i.e. for ease of use, etc. These issues have probably been beaten to death a long time ago (e.g. PGP shells), and shouldn't be too difficult to resolve. The multi-platform stuff (DOS/Mac/**IX on one disc) will be harder; you'll need to code a different interface to the CD for each platform. > (In other words, I will almost always go to up-to-date archives on a Web > site rather than dusting off a CD-ROM that was issued several months ago. As would I. But we're "in the loop". Many people aren't. And the real issue being addressed here (getting easy-to-digest crypto to the masses) is a lot more difficult than just pressing a CD-ROM. Ben may need to rethink his strategy on this, in terms of how to most effectively promote this CD to that market. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. Hmm, do I hear a volunteer for writing that Crypto Software Web page? ;) -H

2 1

Re: So, what crypto legislation (if any) is necessary?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 2:08 3/26/96, Shabbir J. Safdar wrote: >We have to wake up and learn from the fight against the net censorship >legislation. This is realpolitik. Congress will legislate crypto, >whether we want them to or not. This is not news anyone wants to hear, >but we have to face up to it. IMHO, Congress *will* outlaw non-GAK strong crypto. It is only a matter of time. >This is actually very important. The Leahy bill forces Joe's Key >Warehouse to only divulge your key when they've been presented with a >warrant that's on par with whatever they used to get your original >communication. That means that Louis Freeh can't issue an >administrative subpoena to get your key, after he's got a judge to >allow the FBI to search your house. They have to get a judge involved >for both parts. It is a widespread myth that wiretaps require warrants. Court ordered warrants are not required for a wiretap. They have not been required since the Digital Telephony Bill passed. That the net, the media, and even attorneys are so blissfully unaware of this, even years after the provision doing away with requiring warrants became law, is one of the finest examples of cognitive dissonance you are ever likely to find. It is too disturbing to believe it, so the mind ignores the facts. Excerpt from the Digital Telephony Bill quote SEC. 103. ASSISTANCE CAPABILITY REQUIREMENTS. (a) Capability Requirements: [...] a telecommunications carrier shall ensure that its equipment, facilities, or services, that provide a customer or subscriber with the ability to originate, terminate, or direct communications are capable of-- (1) expeditiously isolating and enabling the government, pursuant to a court order or other form of authorization, to intercept, [...] all wire and electronic communications [...]. end quote *Other forms of authorization*, other than a court ordered warrant that is, are explicitly allowed. Nowhere in the bill, or anywhere else AFIK, is stated what form these other forms of authorization can take. No limits whatsoever as to what the government can do. "My supervisor approved it" may well suffice. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

[NOISE] Employers need pseudonymous off-shore remailers
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Today, I tried to find out what it takes to hire someone who is in the US on a student visa (F-1) as a consultant or part-time employee. The person is an expert in his field. I don't know anyone available with a similar proven track record. I thought, no problem, there are INS exceptions for foreign experts. So I set on a quest to find out what it takes to get the INS to grant that person a work permit. The process is simple. All I have to do is ask the California Employment Development Department for a labor certificate, give that to the INS together with an application and the required fees, after which they'll issue the permit. Getting the certificate takes usually eight months, processing the application about four months. So the whole process takes about *a year*. I was stunned. Here I am willing to hire someone to work on a product that will generate taxes in the US, and the bureaucrats are asking me to wait a year. These people have lost any touch with reality. Not that *I* would do such a thing, but an off-shore pseudonymous remailer, with payment in ecash might go a long way... [Disclaimer: Speaking only for myself, not for my employer] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Sun patch pulled
by Mark 17 Dec '03

17 Dec '03

>I noticed that Sun's latest libc patch (101759-04) is empty. Previous >versions contained the complete U.S. version of libc, including the >tres-dangerous DES and crypt functions. In the current rev only the >README remains, presumably because: > EXPORT INFORMATION: This patch includes code which performs > cryptographic functions, which are subject to U.S. export > control, and must not be exported outside the U.S. without > prior approval of the U.S. government. Prior export approval > must be obtained by the user of this patch. The 101759-?? patch is missing from the Feb 1996 SunSolve Patches CD. However if one pops in the November 1995 Patches CD there is a nice little copy of the 101759-03 patch which also comes with the above warning and the DES enabled libraries. The Patches CD's are openly sent around the world by Sun Support, one CD for all the world. Cheers, Mark

2 1

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:05 PM 3/27/96, Rich Graves wrote: >Undeniably true. I think Tim's point was more, "Who cares? Everyone *I* >want to talk to speaks English." > >One may quibble with the wisdom or morality of such a statement, but if >the second statement is true in your case, then there is no reason you >should have to learn another language. Most upper-income Americans have no >need for esoteric languages. Almost all upper-income Americans have a need >for English. Yes, this is mostly my point. And it is not just me I'm talking about--I don't see a compelling need for 95% of Americans to learn a second language...in fact, I'd rather they learned to speak and read English properly. (All of the America-bashers who were chiming in earlier today with their anti-American jokes...well, here's one for you: "What do you call someone who knows how to speak and write English properly? A European.") I don't deny that Alan Bostick needs to take a class in Yoruba so he can communicate with his neighbor, nor do I deny Michael Helm's point that by not studying Talegu we are denying ourselves access to the world's culture. In my next 25 lifetimes, with the advent of Nanocryonic Revitalization, I certainly will try to learn several of these obscure languages. Father Guido Sarducci has a nice routine in which he describes what happens to our high school Spanish in the several years after taking it. After the fourth or fifth year, all we remember is "Como esta?" (I took German, not Spanish, so my spelling is phonetic, from his dialog.) The point being that very few Americans have any _continuing_ way to use the languages we learn. Which is a major reason they are being dropped by many schools. Even in areas with lots of Mexicans and other Latinos, few opportunities. (Your mileage may vary, but I think this is generally so.) My sister lives near Miami and finds no need to brush up on her Spanish. The educated Cubans and ohter Latinos all speak English fluently, and the uneducated Mexicans and the like she has no need to communicate with. (No doubt some of the politically correct will once again denounce me as a racist. This is not racism, just reality. And to some, the truth hurts.) There is an "information theory" interpretation of learning foreign languages. Where I live, the issue is not that there are not native speakers of foreign languages...the issue is that no single foreign language stands out as being desirable to learn, except for one's personal edification or circumstances. So what languages should schools offer? French and German are not common in California, or the U.S. in general, and the languages of the immigrant communities (Spanish, Vietnamese, Tagalog, Laotian, Korean, etc.) have little use except in communicating with these communities. And they are all busy learning English.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: So, what crypto legislation (if any) is necessary?
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

>My preferred and soon to be permanent e-mail address:unicorn@schloss.li >"In fact, had Unicorn not existed, potestas scientiae in usu est >Detweiler might not have had to invent him." in nihilum nil posse reverti >00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Unicorn = Detweiler = Agent Provocateur

7 7