December 2003 - cypherpunks-legacy

Free speech debate on MSN Encarta
by Raph Levien 17 Dec '03

17 Dec '03

First, a heads-up on the free speech debate on MSN Encarta this month. I found out about it because it was featured (sans URL, of course) on the NBC Nightly News. Here's the URL they missed: http://www.msn.com/encarta/otr/mar/otthis.htm One of the major axes of debate is whether programs like SurfWatch are sufficient to keep pornography out of the hands of children. One concern that was raised more than once is that children tend to be more technically sophisticated ("computer-literate") than parents. I think there is a point there. My dad just got Internet access this afternoon. Basically, all he needed was to install a PPP dialer and Netscape on his Mac, but it was a bit too much for him, so he had a friend come over and help him out. I had tried to guide him over the phone, but that just didn't work out (among other things, Netscape really needs to change their "DNS failure on the following hosts" error message to "you don't have a connection to the Internet, dummy"). Adding SurfWatch or something similar might not have been possible at all. So here's a random idea: have an ISP that essentially firewalls the Internet connection to the house, so that it is very difficult to get unwanted stuff over the wire at all. The ISP can maintain and update the latest high-tech tools, including filtering by URL, filtering by keyword, and other stuff like detecting proxies. While they're at it, they can filter out junk email. Just a random thought. Raph (whose son, Alan Mathison, was born Sunday morning at 5:01 am)

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 1:24 AM 03/20/96, IPG Sales wrote: >Perhaps a battle has been lost, maybe even probably? But the war is not >over, not by a long shot - with minor modifications this system is >absolutely secure as events will prove. However, be assured that we >will not sell our product to anyone until that can be definitively >established. We greatly appreciate the contribution of some of those on You used to claim "our system is absolutely safe, we're sure of it, but we can't tell you the algorithm cause it's secret." People said that was stupid, so you finally agreed to show people the algorithm (apparently sending it to them unsolicited, and then expecting them to be bound to some sort of non-disclosure agreement? You might want to hire a lawyer to familiarize you with how trade secrets work legally, cause they don't work like you think they work). The people you showed the algorithm to pointed out flaws in it. Now you say "Yeah, okay so there were flaws, but we'll fix them and then it will be perfect, except you can't see the code or algorithm cause it's secret." Sounds like we're back where we started, eh? No one was willing to trust the algorithm before without it being reviewed publically. No one will be willing to trust it now either, _especially_ after the previous concerns that the algorithm wasn't secure were _confirmed_. The cypherpunks list doesn't have to provide free cryptanalysis to you. I doubt anyone will want to waste their time looking at future iterations of your algorithm, if you deign to show it to them. The fact that people on the cypherpunks list don't want to waste their time doing free cryptanalysis for you doesn't mean that your code is secure, or endorsed by anyone. It means that even those who may have thought it possible that your algorithm was secure after all have given up on that thought, or at least decided that it's unlikely enough not to be worth much further consideration, at least until you start behaving reasonably.

1 0

[NOISE] Re: Ecash API about to be released
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

9:34 AM 3/22/96, jim bell: > For obvious reasons, I am interested in ecash with full payee, as well as > payer, anonymity. Last I heard, Digicash didn't provide this. Any updates? Finally setting up shop, eh? I can see your shingle already: ------------------------------------ | | | JIM "Yeah, THOSE Daltons" BELL | | | | Anonymous Assassination Broker | | | | "redefining | | random violence | | since 1996" | ------------------------------------

1 0

Re: NT's C2 rating
by Mike Tighe 17 Dec '03

17 Dec '03

>> Basically, I'm now questioning the C2 rating of Windows NT. The >> entire security layer is modular to the Kernel. As a modular >> driver, it can be removed, rewritten, and replaced. Has the product actually been evaluated and put on the EPL? Or is Microsoft just claiming it meets the C2 requirements? Mike Tighe tighe(a)spectrum.titan.com http://www.tcst.com/~tighe/

1 0

Re: NT's C2 rating
by Mike Tighe 17 Dec '03

17 Dec '03

>At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>>The fine print says its insecure as soon as its connected to a network. >>Ain't nothing fine about that print. An operating system or piece of >>hardware may be C2 certifiable. But only a complete system in a specific >>configuration can be certified as C2 compliant. The way I read the orange >>book, no system with a network connection can ever be C2. To address that problem, they wrote the Trusted Network Interpretation a few years after the Orange Book Mike Tighe tighe(a)spectrum.titan.com http://www.tcst.com/~tighe/

1 0

Maybe not (was "PC: Using BIOS Wait function as a source of entr
by Deranged Mutant 17 Dec '03

17 Dec '03

I did some more tests with the variation when sampling the timer before and after a call to the BIOS Wait function on my PC. Set the delay to 977ms, which is allegedly the counter's resolution and collected samples at even intervals (various ones) and found recurring patterms. For instance, sampling every timer tick (about 55ms) produced a repeating pattern where every 16th sample had a delta well over 1200 while all the others were under 900, usually under 800. Every so often the 16th sample delta was very low instead (between 400 and 600). Plotting the samples in a noise sphere showed very definite streaks with a few spots in isolated areas. So this is NOT a good method to use after all. I'm still curious as to what causes the variation. Maybe has to do with the CPU cache or port interfaces with the CMOS timer? Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Please criticize PGP-based robomoderator
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Fri Mar 22 21:25:47 CST 1996 To: cypherpunks(a)toad.com Subject: Please criticize PGP-based robomoderator Hello, Today UVV's announced that a new group, soc.culture.russian.moderated, was voted into existence. If all goes well, it should be newgrouped soon. For this group, I wrote a robomoderator program that does the following: 1) Enforces posting style required by the charter 2) Checks PGP signatures on incoming messages and prevents some types of forgeries 3) Implement secure (PGP-based) exchange between robomoderator program and human moderators, for messages requiring their approval 4) Black lists, white lists, and lists of suspicious words (Cypherpunks may imagine that ``medusa'' would be a suspicious word for this list) 5) Signs (with Greg Rose's PMApp) approved articles to prevent posting articles with forged approval 6) supports appeals, moderators' mailing list, and more. A specification for the robomoderator is on my home page at http://www.algebra.com/~ichudov/usenet/scrm/robomod/robomod.html and your criticisms and suggestions are more than welcome. For security reasons, we cannot post the code yet. We'll do it after I systematically proofread it to make sure that it is secure. Robomoderator is written in perl and sh, with some C code. It is working, but there are sopme minor things to do (they are listed in the TODO list on my WWW Page). Thanks to Dr. Dimitri Vulis for several good suggestions that I implemented. - Igor. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVNx8sJFmFyXKPzRAQEgVwP+Il58rOpbWtlC0MW4tPrYEnuF9JC5OJET VhaWud9lYzMDo9sdiBBmmgPqs5n3/lPpvxuNX4oCNbooP/U7SE8iqqOlcEdRDI3d KCSS8jol+T+VQGyVg8GkNrjSzSrfBrnka/CYMCXzKPGCFKcj5QiO1ufuBlhcxNsa glTt8xf5BrY= =xUgQ -----END PGP SIGNATURE-----

1 0

Conference of Interest
by Black Unicorn 17 Dec '03

17 Dec '03

Interested Cypherpunks might wish to review the following: The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 While at first glance not crypto related, in past this conference has brought together a fascinating combination of spooks, private sector types, TLA's and academics. The amount of access to otherwise secretive and shadowy officials and "big name" types is significant. I have found in past that everyone at the conference is fairly approachable. The networking and back room, off topic discussions are so numerous that in some ways the title of the conference is a misnomer. Though the fees are hefty, I encourage c'punks who will be in the area to consider attending. Additional information is available at (202) 739-9180. The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 on Monday, April 1, 1996 at The Four Seasons Hotel Corcoran Ballroom 2800 Pennsylvania Avenue, NW Washington, DC 20006 Preliminary Agenda 8:00-9:00 am Registration 9:00-9:15 am Welcoming Remarks - Eugene K. Lawson, President, U.S.-Russia Business Council Introductory Remarks - Ambassador Robert S. Strauss Chairman, U.S.-Russia Business Council 9:15-9:45 am The Honorable Anthony Lake Assistant to the President for National Security Affairs 9:45-10:15 am H.E. Yuli Vorontsov Ambassador of the Russian Federation 10:15-10:30 am Break 10:30-11:00 am The Honorable Jan Kalicki Counselor to the Department of Commerce and U.S. Ombudsman for Energy and Commercial Affairs to the NIS 11:00-11:30 am Eugene K. Lawson - Financing Update 1996 11:30-12:00 am The Honorable John M. Deutch Director of Central Intelligence 12:00-12:30 pm Reception 12:30-2:00 pm Luncheon Luncheon Speaker - The Honorable Michel Camdessus Managing Director of the International Monetary Fund 2:00-2:30 pm The Honorable Lawrence H. Summers Deputy Secretary of the Treasury 2:30-3:30 pm Panel Discussion - "View from the Trenches" 3:30-5:00 pm Panel Discussion - "Russian Presidental Election and Beyond" 5:00-6:00 pm Cocktail Reception --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: Digital Signature Inititiative
by Alan Olsen 17 Dec '03

17 Dec '03

I am glad to see this clarification on the signature policy. (Sorry for the paranoia, but I have reasons to be wary of plans made in Redmond...) The article that I quoted in the first post was quite misleading as to a number of points. (Which is why I should not believe things written in one page articles, but that is another point...) With the author's credentials, I would have expected a wee bit more accuracy (or clarity). I do have a number of comments on what you posted, however... At 04:04 PM 3/22/96 -0800, Stuart Theodore wrote: >Good afternoon, > >I am the program manager at Microsoft responsible for putting the >digital signature program in place. I am sending this mail in response >to a recent mail string sent to these aliases appearing at the bottom. > >To summarize some important points of the program: > >* The program creates a certificate authority infrastructure which >consists of thrid party non-software affiliated companies such as >VeriSign and GTE who will act to grant certificates to allow code to be >signed. The policies defining who can be a certificate authority and >what it means to be a trusted software publisher will be a matter of >public policy(standard). The point being that Microsoft does NOT >control who can/cannot sign code. This is a good thing. (This was clarified after I posted by a developer who had returned from an MS developers conference on Internet Apps.) It is also nice to see that there will be more than one option of signing services. Hopefully the policies will not be such as to shut out the small, independant web designers/developers. >* This approach solves the problem of identity and integrity, and is >viewed by MS as complementary to the sandboxing approach used by Java >scripting, which we view to be incomplete and unsatisfactory by itself. >We believe that Java needs to sign platform dependent Java classes in >addition to their sandboxing scheme. Actually it protects against mallicious code (for the most part), but not against badly designed code. I can see where improperly tested and designed code could cause problems on host machines. I have not seen anything that makes OLE code more secure (or more stable) in the real world environment. (Just lots of paperwork being signed that says "We will not use these powers for Evil".) With Java, there has been alot of work to make the language less subject to abuse. I have not seen anything in that regards involving OLE. >* The W3C is creating a working group in this area to develop standards >around the policies mentioned in the first point, and the formats of the >certificate and signature formats. Microsoft is committed to making >this a open, industry, x-platform standard... This is a good thing. And I hope that they release them to the rest of the world before implementing them and releasing in a bunch of MS products. (This is one of my big beefs with Microsoft. I have seen a number of cases where APIs are released to developers MONTHS after they appear in Microsoft products. Not cool.) >* regarding the mac question - there already is a version of Internet >Explorer for the Macintosh, available for download at >www.microsoft.com/ie. Microsoft is has already announced its committment >to building cross-platform internet products. I am glad to hear it. Before this thread i had not heard of a Mac version. (Maybe it is becuase my friends who use the Mac have dropped using any Microsoft products. Come to think of it, it was because of how Word for the Mac implemented OLE... (Among other things.)) >I would be happy to answer more questions you may have about this >program, inluding proving more information. The part that interests me about the signing of executables is not for distribution over the web. (I beleive that OLE is not abuse proof enough for that yet.) What I would like to see is an API (or internal routines) to allow the app to check the signature opon loading and perform checks to detect tampering within the executable. This I see as a very useful thing, mpore so than the web applications. Is such a thing planned? Also, is there a web page that has additional information/plans about this API? --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

So what? I've gone years without filing a damned tax return because I don't owe anything. And the couple of times I realized they owed me something I filed tax returns a year or two late. They don't give a shit unless they think you owe them money (or technically, if you actually do even if they don't know it). CP-Lite warning: no crypto. CDA Warning: Fuck you too. gjeffers(a)ns.htc.net (Gary Lee Jeffers) scritten: >From STRATEGIC INVESTMENT March 20, 1996 ... > Is the IRS a paper tiger? ... > As the IRS teeters on the brink, a fellow named Eddie Kahn has stepped >forward and may be about to push the whole creaking mess over the edge. >He hasn't got an arrow in his back yet, so he might just succeed. Dis- >dainful of "tax protests" such as 5th Amendment or legal tender arguments >that quickly get their advocates behind bars, Eddie looked into the stru- >ture of federal law. When Congress passes a law, codified as a statute, >it then delegates to a regulatory agency the authority to issue the im- >plementing regulations specifiying to whom and under what circumstances >the statute applies. These regulations must, by law, be published in the >Federal Register. Lacking these implementing regulations, the law cannot >be applied and has no force. Well, it turns out that the implementing re- >gulations for IRS' enforcement statutes-things like the requirement to >file a tax return and the authority to place a lien-cannot be found in >the Federal Register. When queried on this, the General Counsel for the >Office of the Federal Register, Michael White, replied in writing, "Our >records indicate that the Internal Revenue Service has not incorporated >by reference in the Federal Register a requirement to make an income tax >return."

1 0