December 2003 - cypherpunks-legacy

mocking paranoia
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Earlier, someone mocked someone else for being paranoid. Sorry, but this is a mistake. By definition, you have a non-empty threat model when you set out to encrypt; therefore you must be paranoid to use encryption. Or else they really *could* be out to get you, but sometimes it's not possible to tell, and you have to assume that they are. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Open letter to the NSA
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

You screwed up, guys. If, instead of restricting the export of strong crypto systems, you had instead encouraged it, you would have prevented the development of foreign crypto expertise. Look at South Africa: we banned them armaments, so they created their own arms industry. Now they're a serious arms exporter. You won in the short-term and lost in the long-term. Where is the wisdom needed to admit your mistake? Missing, I'd say. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Re: rsync and md4
by jim bell 17 Dec '03

17 Dec '03

At 01:50 PM 6/29/96 +1000, Andrew Tridgell wrote: >Why md4? I chose md4 because it seemed to be the fastest of the >reputedly strong, publicly available checksum algorithms. Whatever you do, PLEASE stop using the term "checksum" when what you really mean is CRC, hash or something else. A "checksum" is a bad error checker, only somewhat better than none at all. If you use the term "checksum" some neophyte might actually misinterpret what you're doing and implement a real, honest-to-goodness checksum in his next program. Jim Bell jimbell(a)pacifier.com

1 0

Re: RFD: Developing Nations and crypto (based on excertp from Edupag
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:48 AM 6/26/96 -0700, Timothy C. May wrote: > Sadly, most developing countries (Third World, LDCs, whatever) have > repressive governments of various stripes...few are libertarian. Several > have embraced computer technology, but primarily as an instrument of social > control. This is true, but basically back to front. Certain common forms of repressive economic policy cause poverty. From time to time political convulsions change this policy for a long period. If the period is several decades, development follows. In the past, popular support for these repressive policies was vast and overwhelming, and once in place they could only be changed by fairly murderous dictatorships, for example South Korea and Chile. Popular support for these policies is still substantial, but has steadily diminished. In my opinion this diminishing support is largely the result of improved international communications. When people in poor countries discover that their social order is radically different from that in similar rich countries, they are apt to vote for institutions similar to those in the rich country -- the JR Ewing affect. In short, the third world it has become considerably easier to create liberty without the need to massacre real, suspected, and imaginary communists. >Singapore is an example of a country that jumped from former colonial >status, surrounded by relatively poor (GNP) countries, to the "Information >Age." And what is the result? What our own Sandy Sandfort dubbed >"Disneyland with a Death Penalty." No spitting, no cursing, no long hair, >no "Wall Street Journal," no pornography, no Internet free access, no >dissension. And smartcards track the movements of all Citizen-Units. Not an >encouraging example. > >As for the comment that "they aren't bogged down in older ways of doing >business, communicating, etc." Well, some of these "older ways" include: > >- concepts about the ownership of property and transfers of title > >- contracts, and the ability to make and enforce them > >- understanding of the Uniform Commercial Code (the descendent of the "Law >Merchant" which Western societies have embraced for centuries) > >- a stable middle class, solid educational facilities, and a tradition of >business and technical achievement > >(These are all things which are missing in many Third World countries, for >whatever reasons. Even in many Second World countries, such as the former >U.S.S.R., and these lacks are making the development of modern economic >systems problematic.) > >Certainly some small nations--perhaps island nations--can essentially jump >directly to an "information based economy." The Cayman Islands and several >other examples come to mind. > >I find it harder to believe that a _large_ nation is likely to make such a >transition. > >--Tim May > >Boycott "Big Brother Inside" software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Licensed Ontologist | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

fbi botches intel "ecspionage" case
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

"economic espionage" (ecspionage?) is in full swing as being promoted as the new bogeyman to justify spending billions of dollars to our intelligence agencies, both military and the FBI. we already have a very good example where this has backfired. I was watching Nightline on Tues night or so in which there was info about how the FBI helped get an informant into Intel in a *very* sensitive position, where he was able to film the pentium chip plans. he said he sold them, as I recall, to iraq, syria, china, etc. at the end of the show, the reporter stated that the FBI was seeking stronger laws against theft of "intellectual property" in congress that might solve the problem. there was much lamentation over the fact the criminal in question only got about 33 months of prison time or something. the FBI emerged with great egg on their face. I would say if anyone wants to ridicule them for getting into covering "ecspionage" cases, this is a prime candidate case. is this what they are aiming for? heh, heh. == somehow we have missed a good public debate about ecspionage in the country. there were a few NYT editorials, but it is clearly being used as a very major aspect of promoting the new post-cold-war spy and intelligence strategy without almost any notice by major analyists. I was thinking about all the objections I had to the FBI ecspionage treatment that were never raised on the program: 1. there was an implicit assumption that merely having the plans to the chip would allow other countries to somehow slaughter us in economic competition. but INTEL has spent billions of dollars on physical infrastructure without which the plans are virtually useless. it would take other countries years to get the kind of equipment necessary to produce the pentium, by which it might actually be yesterday's technology that no one cares about any more. 2. we have a tradition of separation of church and state in this country, and also separation of the public government and private industry. suddenly we have the FBI saying they want to infiltrate companies to deal with economic espionage. well, these companies have their own policy, and what do they gain by having a government agency working inside them? in the above case I note, it led to exactly the *opposite* of what was intended: the theft of *highly*sensitive* plans by an FBI mole. 3. hence, one wonders if the FBI could do a better job of combating ecspionage than companies are already doing, or if they are just going to botch it as has already been spectacularly proven in this case. 4. we could have companies that are run like the NSA to prevent "theft of information" (in quotes because I wonder if this will be considered a crime in future decades, just as heresy and blasphemy were once considered crimes a long time ago but no longer are today). however, we have the old "openess vs. security" catch-22. we can't have technological development without some degree of openess. 5. what is "intellectual property"? I think a very good case can be made that there isn't really any such thing, that the term itself may be thought in the future as something like an oxymoron. there is a big red flag going up here: why do we need all kinds of laws to combat this? is it really a problem? can anyone actually point to a very sinister situation in which massive amounts of cash were lost by a company due to ecspionage? as the steve jackson games incident proved, companies are liable to vastly exaggerate their losses to the point of fantasy. they have a tendency to think that "their information" is worth hundreds of thousands of dollars when it may actually be freely legally obtainable. if someone else can give more info on this case (apparently a book is coming out about it or something) including the guy's name, I'd appreciate it, I didn't take any notes so this is a bit fuzzy.

4 3

Re: mocking paranoia
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 05:58 AM 6/29/96 nelson(a)crynwr.com wrote: >Earlier, someone mocked someone else for being paranoid. Sorry, but >this is a mistake. By definition, you have a non-empty threat model >when you set out to encrypt; therefore you must be paranoid to use >encryption. Or else they really *could* be out to get you, but >sometimes it's not possible to tell, and you have to assume that they >are. heh... "just because you're paranoid doesn't mean they're not after you."

1 0

The End of Science
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Natalie Angier, the sharp-witted science reporter for The New York Times, reviews "The End of Science," by John Horgan, a senior writer at Scientific American, in the June 30 NYT Book Review. She writes: In this intellectually bracing, sweepingly reported, often brilliant and sometimes bullying book, John Horgan makes the powerful case that the best and most exciting scientific discoveries are behind us. He argues that many scientists today, particularly those he interviewed for this book, are "gripped by a profound unease." Part of that malaise results from all the sociopolitical irritants we've heard about: the dwindling financial resources, the vicious competition, the strident antipathy of animal rights activists, religious fundamentalists, technophobes and the like. But a far more important source of despair, Mr. Horgan insists, is that scientists are beginning to sense that "the great era of scientific discovery is over." The big truths, the primordial truths, the pure truths about "the universe and our place in it" have already been mapped out. Science has been so spectacularly successful at describing the principal features of the universe, on a scale from quarks to the superstructure of galaxies, that the entire enterprise may well end up the paradoxical victim of its own prosperity. "Further research may yield no more great revelations or revolutions," he writes, "but only incremental, diminishing returns." While Angier does not agree with his thesis that the major problems of science have been solved, she commends his incisive critique of scientists who cannot give up the dream of omniscience, many of whom he has interviewed for the book -- Stephen Jay Gould, Roger Penrose, Steven Weinberg, Daniel Dennett, Stuart Kauffman, Marvin Minsky, John Wheeler, Frank Tipler and others. She summarizes Horgan's view of detumescent science: Where does that leave contemporary scientists? They can either pursue small, manageable and vaguely boring science (sequencing the complete complement of human DNA may fall into this category), or they can turn to what Mr. Horgan calls "ironic science." Such science is "speculative, postempirical," resembling literary criticism "in that it offers points of view, opinions, which are, at best, interesting." Ironic science is provocative, he says, but it fails to converge on the truth. " It cannot achieve empirically verifiable surprises that force scientists to make substantial revisions in their basic description of reality," he writes. ---------- For those without access to NYT, the full review is available at: http://pwp.usa.pipeline.com/~jya/theend.txt (11 kb) Or, we will E-mail a copy. Send a blank message to <jya(a)pipeline.com> with the subject THE_end

1 0

Open Gates?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

[Please respond via netmail, as I have only limited access to the list.] Does anyone have a _current_ list of open mail-to-news gates? As far as I can tell, the only one is: group.name(a)pubnews.demon.co.uk Thanks for any help. -- : Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: Cookies anyone?
by Yanni 17 Dec '03

17 Dec '03

> Rather than bring down my system by experimenting, I thought I'd ask > the list, "What happens if I delete this file?" you loose any cool stuff that cool sites give you. we are using them (along with searchArgs) for a client to allow a "buddie" to follow you around the site....when you come back, the buddy tells you how long you have been gone, etc...a really cool fun harmless application of cookies that makes the user experience much more fun and personal... > and "What happens if > I delete (edit) the cookies?" if you don't keep the format, navigator will probably remove that line when it starts up. if you keep the format, and have edited the cookie, the site on the other end might not know what to do with the cookie when it gets it again...(depends on how good the error checking, etc is...) > This may have been discussed before, but until now I never checked > for cookies. either way, contrary to popular belief, cookies really aren't a security risk because they don't contain any information that you don't already know. if a site gives you a cookie with your password in it ( especially in clear text ), then they (the cgi programmers) are idiots and should be shot on the spot. regards, -jon Jon (no h) S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key We are hiring! Check out... http://www.clearink.com/clearink/home/job.html

1 0

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

From: Jeffrey A Nimmo <janimmo(a)ionet.net> > On Fri, 28 Jun 1996 ichudov(a)algebra.com wrote: > > Then users of alpha.c2.org will have to install mail filters that > > automatically delete all incoming mail not intended to be read by them > > (they can't read such messages anyway). > > How exactly would this be done? Since messages from alpha.c2.org > are conventionally encrypted, they don't contain key id's. > > Wouldn't that require every recipient to store his/her passphrase > and call pgp for every message to see if it could be decrypted? This in > and of itself would be a more serious security breach, not to mention an > _enormous_ drain on site resources. Since the PGP is run on private computers, and only at mail-reading time, there should be no problem entering the conventional encryption passphrase and checking to see whether the messages decrypt. Actually PGP puts a pattern at the beginning of the encrypted portion, so successful decryption can be checked very quickly, without much of a computational load. Hal

2 1