December 2003 - cypherpunks-legacy

Re: Crypto CD UpDate
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>Thoughtful comments, so I'll comment on Henry's comments: >At 6:10 PM 3/27/96, Henry Huang wrote: > >>I'd argue that having a slightly out-of-date CD-ROM is better than nothing, >>because: >> >>- It gives you an idea of what sorts of crypto applications are out there, > >True, but your later point about who the intended market is makes the point >I was making: the likeliest users pretty much know what they want and snarf >the most recent (and debugged) version off the Net. (I have little >interest, speaking as a user, in the zillions of variants of CryptDisk and >SmartCrypt and whatnot that get mentioned here....I really only want >"MacPGP" in its latest version, at this time, and for this the Web is >certainly fast enough for me.) > >And I suspect I am not that unusual. The faster access to a CD-ROM is not >too useful to most, as the time to install, learn, use, etc. a new crypto >program is many orders of magnitude greater than getting it by even a 14.4 >modem. > What I see most useful in the CDs I burned last fall for personal use is not just having access to the latest executables, but to have access to trusted source code. Just as it is nice to have Appl. Crypt. disk, it is -for me- to have sources for many interesting things around. I can then study any of them, pick a piece, get whatever at any moment without having to surf the net. Hey, I just got Appl. Crypt. 2nd Ed. yesterday. Meanwhile with the 1st Ed. and the code I had in my CDs I could very well manage with most things, protocols, algorithms... Of course, the version of Crypto++ I have there is outdated now, but the algorithms are still valid, and I still have much more algorithms there than the current version has, and I can always plug in or adapt a new one should I need to. Yes, I can always go to the Net for the latest sources when I need them, but when I don't, it's easier for me to go to my CD (but I have it always at hand over my desk). Still, the main problem I see is that users should have to trust the authors of such CD. Of course I trust myself and I had already reviewed most of the code I stored -or verified it somehow- and so my CD is good for me. But a good crypto "aficionado" should seriously consider whether to trust any executables (hell, any net-aficionado should think the same about Java applets, but that's another story). That reduces the interest of the CD to those who want source code to work with or to analyze. Or at least those savvy enough to use a compiler and possibly study source code. Unless someone stands behind the CD to assert its truthfulness. I may -or not- trust the people at unimi, but would I also trust a lot of intermediate people putting up together a CD-ROM? For that sake, and considering the costs of storage and removable storage media, I'd bet many people would find more useful to download their copies from the net (even once a year only) as I did. It's a nice idea though. If well put together and done, it could help raise concern and access to cryptography to the average user. In this case, many crypto programs, shells and so would be bundled with samples and say, exercises, for average people to play with. Well done, many teens would play with it, and possibly many serious users. A good documentation set explaining in plain terms what each package does, its good and bad points, and comparing it with similar packages both for the savvy and the merely curious would round up the bundle. I'd like to imagine such a CD distributed with a popular magazine (PCworld for example)and many kids playing "spy vs. spy" with their friends, trying simple algorithms and corresponding cracking programs, discovering which are best and which ar not... And possibly serious adults studying the reports and playing too, cracking their WP files, discovering how good PKZIP crypto is, and moving on to PGP and other systems... Descriptive plays for mimicking simple protocols and attacks with real world roll games and then with the computer. All guided by a nice tutorial with references to more technical reports for the interested. Maybe with several levels of explanations up to real crypto stuff and source code. But you won't find all that on any current archive. And writing all the additional stuff, together with compiling for several platforms, and rearranging information for a rational organization (not just a mirror) is quite a *lot* of work. That could pretty well be Applied Cryptography Nth Online Edition. Oh well, I don't lose anything by dreaming. jr

1 0

Re: Anonymous Cpunk Bashing
by jim bell 17 Dec '03

17 Dec '03

At 01:29 AM 3/30/96 -0500, Ted Garrett wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 01:06 PM 3/29/96 -0800, you wrote: >>The implication is that the people who oppose this "list of shame" are doing >>so primarily for PERSONALITY reasons, rather than on the issues. I would >>feel better about the whole thing if the people who volunteered for the list >>had engaged in some sort of serious effort to show that the placement of the >>other people on that list was unjustified. Lacking even the most >>rudimentary effort along these lines, I really wonder who (and what) these >>people think they're supporting. > >I think that sometimes, one's cumulative reputation must count for something. >Most of the people who are included in this 'list of shame' have contributed >enormously to the furtherance of the crypto field in general. Whether I conscribe >to their viewpoints or not on a given subject, it is rather easy for me to think >of something they have written which I use as a rather concrete reference. Thusly, >given a track record of open and noteworthy thought on the field, I find it difficult >to denounce, as an example, Bruce Schneier. Especially IF it's only a matter of >sharing a difference of opinion on a given bill or set of bills before our lawmakers. > >Considering the fact that I've not seen Mr. Schneier come out on either side of the >Leahy Bill or, He's one of the people I haven't seen respond to the Leahy bill, as well. However, I don't regularly read SCI.CRYPT or much else that he may put his comments on, and I don't recall if he commented here. That's one of the reasons to be suspicious of the motivations behind the "list of shame," however there's good reason to be even more suspicious of those who have rushed to debunk it by "standing behind" all those listed, with no distinction. I think it is obvious that at least a few people listed should have been listed, but the majority I simply don't know about. I wouldn't be surprised if at least one of those anonymous messages deliberately loaded up the list with unworthy targets simply to disguise the ones who ought to be listed. > for that matter, many of the other bills currently before the congress, >it's hard for me to support mail-bombing him or many of the others on the list

1 0

Very nice Denise Caruso article in MacWorld
by Rich Graves 17 Dec '03

17 Dec '03

Not that anyone actually reads Mac magazines anymore, but back page of the May 1996 issue of MacWorld (they don't procrastinate) bears an article titled "Civil Rights Activists 'Say, Sniff This!': encryption is one solution to net censorship," wherein Jim Warren, PGP, and other cool things are presented in an unambiguously good light. "On February 8th, President Clinton lifted his pen to sign the scabrous Telecommunications Reform Act of 1996.... The law is just one example of how our personal freedoms are fast eroding as digital technologies make it feasible to monitor electronic communications.... The decision to encrypt personal communication within this country is a political act that we still have the luxury to practice today. It is already illegal in many countries to use encryption for any reason without a license from the government." It should appear on www.macworld.com in about a month. -rich

1 0

Re: Netscape 2.01 fixes server vulnerabilities by breaking the client...
by Steve Gibbons 17 Dec '03

17 Dec '03

(This was previously posted to cypherpunks list, I have expanded the distribution to the firewalls list due to the content.) In Article: <315C8FCB.2781(a)netscape.com>, Tom Weinstein <tomw(a)netscape.com> wrote: # Rich Graves wrote: # > # > Now I suppose they'll want me to fix all the pages where I do a finger # > with a gopher://host:79/0user Any chance this nonfix can be unfixed? # > # > This nonfix was applied to the UNIX and Win32 versions; I haven't # > checked the other platforms. # It may be unpleasant, but it's a fact that there was a real security # hole here. There is a well known buffer overrun bug in finger that a # lot of people inside firewalls haven't fixed. Using gopher: URLs # in IMG tags it was possible to do nasty things. We tried to err on # the side of permissivity, but finger was one port we just couldn't # allow. Yes, it sucks. So does someone reaching through your firewall # and running commands as root. Let's look at this from the perspective of a company with a firewall: Q: Do I want my users dictating what's allowed? A: Probably not. Q: Do I want my software vendors dictating what's allowed? A: Maybe not. Real Q1: When are sun/netscape/browser-vendor-x going to provide standardized, secure, multi-teired configuration options? Real Q2: It seams to me that most of the standard TCP protocols that a gopher client can talk to should have similarly standard protocol-specifiers for the URL. Browser vendors are in a perfect position to say "this lack of synchronization is a real problem" and "It's bitten us already" and to take care of the problem by proposing RFCs. Real Q3: (Somewhat off-topic) when are signed applets going to appear? comprehensive standards coupled with multi-teired configuration options would allow real-world customers and their net-neighbors to sleep a little better at night. -- Steve(a)AZTech.Net

1 0

RE: Why Americans feel no compulsion to learn foreign langua
by Steve Gibbons 17 Dec '03

17 Dec '03

More fuel for the fire: I've noticed that I've been able to follow this entire thread, and my multi-lingual skills are only as extensive as beer-ordering and restroom-finding in a few languages. <Duck>Well, I thought it was an interesting point... :)</Duck> -- Steve(a)AZTech.Net

1 0

PLease ignore this test message
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

TEst TEst TEst

1 0

unsuscribe
by Declan O'Donovan/ITP/IE 17 Dec '03

17 Dec '03

unsuscribe

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:50 PM 3/29/96, Dr. Dimitri Vulis wrote: >Likewise, Tim says there's no value in learning about "traditional" crypto. >I say there is. This is taken completely out of context and is beneath contempt in terms of trying to argue a point. *PLONK* Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 2

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

References: <m0u2tez-0008xlC(a)pacifier.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Sender: New Millennium Communications / Boulder, CO. X-PGP-KeyID-Fprnt: 4AAF00E5 - 30D81F3484E6A83F 6EC8D7F0CAB3D265 X-PGP: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=lsd X-Floppyright: (f)1995 Unlicensed retransmission prohibited. Date: Sat, 30 Mar 1996 14:07:55 -0500 To: Black Unicorn <unicorn(a)schloss.li> From: Dave Del Torto <ddt(a)lsd.com> Subject: Re: The limits of my patience. Cc: jim bell <jimbell(a)pacifier.com>, cypherpunks(a)toad.com At 8:43 am 3/30/96, Black Unicorn wrote: >On Fri, 29 Mar 1996, jim bell wrote: >> >> >Anyone who knows me knows I spend all my days end arounding the >> >U.S. government. >> >> Explains a lot! You _are_ paid for this. In an earlier era, you would >> have gladly run the ovens at Auschwitz if you'd gotten paid for it. > >You're way out of line here. >I expect an apology. > >I've dedicated a lot of time to addressing your issues. You have >repeatedly and preemptively brought the discussion into the realms of >personal attack. I have endured and rebutted thus far, but you have >really crossed the line of decency here. Being called an ass I can >tolerate, the above I cannot. I agree: this sort of ad hominem attack has no place in a civilized, reponsible debate on an important topic. As for Unicorn's end-runs around the govt: I support anyone who challenges his (or any other) government in order to keep it honest, to the extent that they do so constructively. I hope you act responsibly, Uni. Jim, I think you owe Unicorn a public apology, and I think it ought to be now. If I don't see one, I'm going to feel quite OK about filtering you out of my future archives of cpunks. Let's see how civilized you're capable of being: we know you can talk through your "other" orifices. dave

1 0

text of Richey's decision
by Phil Karn 17 Dec '03

17 Dec '03

The text of Judge Richey's decision to grant the government's motion to dismiss my case is now up on my web page as http://www.qualcomm.com/people/pkarn/export/decision.html My attorneys scanned it into HTML format, but neither they nor I have had a chance to thoroughly proofread it yet. An appeal is extremely likely. Phil

1 0