December 2003 - cypherpunks-legacy

Re: NOISE - AARMs (fwd)
by Dave Emery 17 Dec '03

17 Dec '03

> David Lesher writes: > > > But there has been an easy defense against such for decades. > > You run ordinary phone wire from the transmitter + antenna X meters > back to the bunker or whatever. Then you talk from there. > Another division of a company I did some consulting work for makes a box that goes between the transmitter and control head of a current generation tactical UHF satellite terminal (LST-5 TACSAT) of the type used by US military commanders in the field. It connects the control and talking part of the radio with the transmitter and antenna via up to a mile of optical fiber cable with no metal conductors. As you can imagine, it is hard to use RF sniffing techniques to find the command post at the other end of the fiber. Dave Emery die(a)die.com

1 0

DRAFT agenda for DC net-conference in early May
by Declan B. McCullagh 17 Dec '03

17 Dec '03

I recently saw a DRAFT agenda for a day-long Net-conference to be held in early May, hosted by Congressmen Jack Fields and Rick White. Panels include Future of the Internet, Electronic Commerce, Intellectual Property, Law Enforcement and Encryption, and Education on the Net. Highlights include a POSSIBLE luncheon address by The Honorable Newt Gingrich. Thought DC-area cypherpunks might like an advance heads-up. -Declan

1 0

WhoWhere.com v. that stanford.edu loon
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several people asked for an update, so here it is. WhoWhere.com has been provided a dump of the password file that they may never have seen before, and they will be purging all 27,128 addresses therein from its database. Of course, many of those addresses may also be available from other, publicly available sources, and the Stanford community has been made well aware of whowhere.com's service (for user entries), so I expect that thousands of these addresses will return soon. I am confident that the Parsec folks are now acting in good faith, and that they are now sensitive to the relevant privacy and ethical issues. Myself, I'm cognizant of the hypocrisy and foolishness inherent in my position, but hey, we do what we can with what we got. Until the system is fixed, I gotta defend my people the best I can. I'm still reasonably serious about that "Hack Stanford Privacy" thing. If there is an easy way for outsiders to glean our whole kerberos namespace (outside of other major universities interconnected via AFS, and we'll get that fixed Real Soon Now), I want to know about it. - -rich [not on cypherpunks, so please Cc any responses] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYWLdo3DXUbM57SdAQF9fAP+Pw4ra8Q5JfDy/DnmfrDauP5/4x+sH+SY qOwGk+GDgKW1p9yO+31OhuLsatPK5sXDGjTtwseRZXZXizylGmwQtgs2g9gQMxNR feZLyo0WBVnYw600ppms7nfay0uqEjM25nw/z+HDrUZ7VlWuAXZ/yctqLadiO3P8 +vCGbDfSQWA= =dP6F -----END PGP SIGNATURE-----

1 0

Re: Freedom and security
by Scott Schryvers 17 Dec '03

17 Dec '03

At 11:08 PM 4/28/96 -0700, you wrote: > >>No. "Those who sacrifice security for freedom, will have neither" is >>not consistent with Franklin's statement, nor is it true. Security and >>freedom are antithetical, and worse than that, security is always an >>illusion. But you can have your illusion, as long as you keep it out of >>my life. Censor yourself if you wish, but don't censor anything I might >>want to look up. >> >The Internet may once have been one of those small close knit communities, >small enough not to require law enforcement - although even then it had >rules that had to be followed. But that Internet is gone, and it will >never return, because now its the biggest city in the world, and the >history of the change from pastoral communities to urban life, to the >development of nation states and power blocs is also the history of crime. >And as the Internet grows, so will its security problems. > >My position is to seek a balance between the freedom of the individual and >the security of the community. My argument is that when the security of >the community is threatened by the freedom of the individual, the community >will always prioritise its safety. "When the security of the community is threatened by the freedom of the individual?!" >From what socio-political ideology do you run your group? >Good government of course means >maintaining individual freedoms *and* maintaining community security. I >actually disagree that they are antithetical. On the contrary they are a >balance that any society has to find. Where individual freedom takes over >you have the urban jungle where predators consume prey. Where security >takes over you have the totalitarian state. Neither is necessary nor >inevitable. By the way government serves best when it serves least. Remember that. >We are simply concentrating on the problem from two different angles. My >concern is to maximise community safety while protecting individual >freedom. Your angle is to maximise individual freedom while protecting >community safety. There is IMHO very little difference between the two. No there is a major difference, I feel society is served best when each individual has the freedom to defend and protect themselves apposed to what you want us to do in essence you want us to lay down those liberties to an outsied group who are supposed to protect us. The internet is not a city, it is a computer network that spans the globe. What you are asking for in analogy is not a cop walking a city street but fucking U.N. tanks driving through neiborhoods enforcing rights by way of brute force. >From what I have seen of what your group does you are as hypicritical as law enforcement in your techniques and attacks on others. Often unwarranted and justified in the name of some supposed higher ideal. PGP encrypted mail preferred. Scott J. Schryvers <schryver(a)radiks.net> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzFX9usAAAEH/2r2eovPAoYZbxzmfJ1DW7yjjdVnckXjUVKU/zZNAUV/IjzF GDEq040wbAG1rFHDYoBOjjJTOGWMFuZ9apqoAvvI7Q4NAmVrNif0Rp8q/j4jib13 dlAA4Q0nvJZ5YNw4sf4r0iug76+9i0WpIZoP60DEB8BTuyCP55+nsbe7Ii3xLRyq ThZ2fhNqK2hD/rFugXK29Ynyzuc6TuFfu78kVOsYUUbQpplXyaLjhGKN94pZ5jox x7/wvqmBoH9E3rnaIPY9vOwy3kvMmCTlkjhlCzMXZHDn0e3UHWAax2mUTMttRzzi +SUv45h6ua+eSwUkA8uojojn/JiPOKIPwPk3hq0ABRG0KFNjb3R0IEouIFNjaHJ5 dmVycyA8c2Nocnl2ZXJAcmFkaWtzLm5ldD4= =58dK -----END PGP PUBLIC KEY BLOCK-----

1 0

Calling other code in Java applications and applets
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:22 PM 4/29/96, sameer(a)c2.org wrote: >> >> Java applications can't save files to disk or use data files on >> disk. > > Uh, yes they can. It's the applets that can't. And I believe that even applets can read and write data files on disk IF THE APPLET ENVIRONMENT PERMITS this. Netscape and similar environments at this time of course _don't_ let this happen, but this is a choice (as I understand it) made at this time and perhaps for this version of the respective pieces of software. (As I understand it, an explicit decision not to allow file i/o, for some obvious though not necessarily permanent reasons.) Certainly the InputStream and OutputStream classes handle file i/o for Java applications--if not applets in general, and presumably not with Netscape 2.0. I can imagine future developments which will allow browsers or similar environments to have full file i/o capability. (Sure, there are dangers. There are always dangers in running code gotten from others. These are recurring problems. I expect lots of flavors of solutions, from signed classes to "playpen" holding tanks (which allow file i/o, but only within some constrained environment), and so on.) By the way, I had a discussion at a party with several Sun folks and other Java programmers, and they agreed that external code (C, for example) could be called, even by an _applet_, if arranged. For example, various underlying graphics routines in the AWT (Alternative Window Toolkit) package are of course using underlying code written in various other languages, code that has been reasonably optimized for speed. "import java.awt.*" makes this code available to applications, and (I believe) to applets within Netscape-type environments. (I suspect there's a simple chart someplace showing what will run under what constraints.) The interesting thing here is that a crypto package, perhaps with speed-optimized underlying routines in C or even hand-coded machine language, could be released. It might be that patent holders (not that I am endorsing this) could license such packages to users. Thus, import java.bignum.* import.java.entropy.* import java.rsa.* import java.digicash.* ... (Such packages may need approval by Sun, etc., and formal integration, a la AWT. But certainly there is talk of replacing AWT with something else, so changes and additions are clearly possible.) Lastly, I don't believe that discussing the implications of Java justifies the claim that "males are posturing." To me, discussing Java, virtual machines, security issues, and advantages/disadvantages is what the list is about, at least as much as the other topics we so often discuss. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: On computer face recognition:
by geeman＠best.com 17 Dec '03

17 Dec '03

At 09:39 PM 4/29/96 -0400, you wrote: ><< "Results were successful (else why write about it?" >> > > > Another believer in the tooth fairy. Send this kid to the "Real World >Academic Life" bootcamp, please. No (sigh) I'm not a believer in the tooth fairy, nor a kid. I take the time and trouble to post to the list something of bona-fide value and interest and all you can do is snipe at some side-comment, tongue-in-cheek at that? I see we're not talkin' bout a 1-percenter here, are we? Let's see if you can't do something more useful next time. > >Note that I am not making any comment on the success of this particular >work. Probably because you haven't a clue. > >

1 0

Re: Mindshare and Java
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:56 PM 4/27/96 -0700, mrm(a)netcom.com (Marianne Mueller) wrote: >One thing I don't understand, why do you trust signed code? >So you know the code is signed by Jack the Ripper. so what? How do >decide what you want the code to be allowed to do? I think there's >nothing for it but a kind of limited capabilities model built on top >of the authentication mechanism. Some code comes from random sources; signatures there mainly buy you the ability to blame someone if the code hoses your machine, and thus reduces the chance that someone will hose you. But as Java develops, there'll be more commercial code available; I'd trust Java code signed by Microsoft just as much as I'd trust any other Microsoft code I'm running on my machines. Maybe more, given the quality of some of the Microsoft code I'm running now :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: arbiter/escrow agent for hire
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 17:43 4/28/96, bryce(a)digicash.com wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > Black Unicorn <unicorn(a)schloss.li> wrote: >(> "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> wrote:) >> > IIRC, currently Black Unicorn doesn't have any signatures on >> > his public key of others. Therefore, this requirement, while >>understandable, >> > could cause a bit of a difficulty in the current situation. >> >> Please obtain a copy of my current key by finger. > > >Oh please. My respect for Uni's acumen just decremented a >couple of notches. A 2048-bit key, and no signatures? >Rather like a front door with welded plate armor and an open >window, no? We had once had a thread on the list that discussed if it makes sense to sign keys for nyms you have never met. I think it does. Even seeing a driver licencse isn't 100% proof that the name stated on the doccument is the True Name of the person. However, I am firmly convinced that the person using the PGP key pub 2048/4E685D39 1995/03/26 Black Unicorn <unicorn(a)access.digex.net> Key fingerprint = 00 B9 28 9C 28 DC 0E 55 E1 6D 53 78 B8 1E 1C 96 is the same Black Unicorn that is frequently posting to Cyphperpunks. Therefore, I am willing to sign his key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQEPAy91JFIAAAEIALRKcL9qZZnqMn3fuDDxOd8+d2F+rqKB3Ff1U7+9Cp2CGugx zfygey2nBEZQXiXG8fBi44iGAuHNc7TRRkQCr8srMwKXeU1Ue/fe5ACcDGy0H1ki C0YYOuWFY2mtKCiqW3kcXWGFlDf418FbXftqJwSvMiIWIzgtepSWfzl5ApmguHjA lTngdR+R557Cb6mgLV0Vug9yGyqXGeCqIs7Yx5SpakoIRwkkfniGa3m6L8+OgREY bW6MoDPOfUox90xqJsDePB7b11l05I87V28s4FaTYH8CdmtdAun52/hLEAQKMXyz g7jPlSQzpLObZ0OL3eiulHyC0aR4LWieb05oXTkAEQEAAbQoQmxhY2sgVW5pY29y biA8dW5pY29ybkBhY2Nlc3MuZGlnZXgubmV0PokAlQMFEDGFkHEEkJHpt/K8BQEB nXgEAIe4FNcBuzXHT3VR1jfLcL+5vbjSH6Cxv06vEhpV3UpZonpD8C9Y+Mv2YSea iOV5aKf98xgRpGNqxuofkDsQu9fJPJizOaFQFEFJXbjT/NcnzYKBFDX3XyDF45Uq n6OM9t5ysRQOCPMzRlf05tu48qVwpx3qSU4yWDok3F6hQhMuiQEVAwUQL3VAdC1o nm9OaF05AQH/oAgAp/ZME1rM4o2lnKRuI/n+IrrBZVMrB59tzgpDzt0KNoOkIRsE 4YIC1bgZKbcfKYr8ovaH0R2/xGe8V2HPcZZocCNCtQJodOPgwHGwU44E7JSugMTC XsqtRt1Ost7n6X5e0AklQo2bYvTv5ylhrEybZA4Yeg1VYTITMxoTVdG4kKSQ4LWf SV9qGV74kPldNfScTjfw/eP2hnIKvDDlveFgoeJD3/kN0sLkckzVkP+jkygMc2QZ 6h8278cvRjXzGndP+2jm0DrNBF9P8tGka9HSZZwyCDCwSlAdNy4EgYEpWNbFOSUn g02GKEVZ5dz7CYQz3gd40VYYl5/B4Hktj69V+w== =dPns - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYWSfwSQkem38rwFAQE4+QP+Jzh1AJjwCMCDuWZoe5Tf3AaOz/M0x1AV 6VLmy5A2dk4Kqm/40bOd5PPzq6fQJUcke/PRKP55gXoXyFnZrurXBzB+ogpurzH3 +FKfpBEPjfZRvZzDF7/MNUCq7TpgEucIpe0jXNoCg/DxYkl84ZbEPdudnRhUjfaW dE2XgLK+iUk= =LD50 -----END PGP SIGNATURE----- Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:45 PM 4/29/96, Perry E. Metzger wrote: >Scott Brickner writes: >> I don't understand what you mean by "insufficiently powerful". It's as >> expressively powerful as most high-level languages, and computationally >> Turing equivalent. It's lack of power seems entirely in the performance >> arena, which may be solved, eventually. > >Java applications can't save files to disk or use data files on >disk. If you were, for instance, buying two CPU weeks of idle time on >some machines, you would need stuff like checkpointing or the ability >to save intermediate results. Java applications _can_ save files to disk, and read them. Further, even the presently-more-constrained applets can retrieve certain types of files. For example, "getImage" and "getAudioClip" methods. I mention this point for two reasons. First, it says the applet model is not forever and totally blocked from reading disk files. (And I would not be surprised to see additional file retrieval methods "allowed." To be sure, this raises more and more security issues to look at, but TANSTAAFL.) Second, the relevance for providing sources of entropy for Java applets. I haven't looked in detail, but I'll be willing to bet quite a bit that someone has already or soon will run a QuickCam video input, not to mention sound input, in a Java applet, and that this could easily be used as a source of entropy bits. --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Social Transformation, Not Tax Evision
by attila 17 Dec '03

17 Dec '03

** Reply to note from Duncan Frissell <frissell(a)panix.com> 04/29/96 10:28am -0400 = "God fights on the side with the heaviest artillery. These days MarketEarth = has the heaviest artillery." just because you carry, like everyone else, carrying God's banners does not mean God is on your side, or the side with the heaviest artillery. God is on the side of those who have faith and charity-- nothing else required. the heaviest artillery is nothing more than man's pride, not his humility; pride will not bring you to the celestial kingdom, nor will you inherit the earth. -- Overseeing first-rate programmers is a managerial challenge roughly comparable to herding cats. cc: Cypherpunks <cypherpunks(a)toad.com>

1 0