December 2003 - cypherpunks-legacy

HP & Export of DCE
by Adam Shostack 17 Dec '03

17 Dec '03

Well, if Leahy passes, DCE is exportable. Anyone know if the 'SecureRPC' in DCE is the one BAL broke years back? I asked a few DCE supporters this, and never got an answer, so I suspect they're still shipping bogus crypto. Adam ----- Forwarded message from Anonymous ----- As I sit, somewhere not in North America, I can see a CD-Rom from Hewlett-Packard, which I've had since last year. Recently I received the following letter. I've attempted to retype its contents accurately. ---------8<--------8<--------8<--------8<--------8<--------8<--------8< [HP Logo] Hewlett-Packard Company Software and Information Delivery Operation, SST 690 East Middlefield Road Mountain View, California 94043 415/968-9200 Dear HP-UX Support Customer, Hewlett-Packard has uncovered a bundling problem in the DCE-Core fileset that is on the October HP-UX Application Release 10.0 s700/800 Application CDs. These products were bundled such that they are not compliant with U.S. Government export regulations. The part numbers for the affected CDs and products are listed below.

7 11

Re: So, what crypto legislation (if any) is necessary? (Was List O' , shame)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:32 PM 3/25/96 -0500, Black Unicorn wrote: >All it would take is one anti-trust case with encryption as a concealing >method and people would be busting down doors at night looking for PGP. Back in the dark ages, IBM built an audio messaging system. It was quite popular in "cave of the winds" (IBM headquarters) because it allowed busy executives to leave audio memos for each other without needing a secretary to type them. Since storage was limited, and old messages were purged from the system it also had the effect that anti-trust discovery would have nothing to discover. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Sun patch pulled
by Mark 17 Dec '03

17 Dec '03

>I noticed that Sun's latest libc patch (101759-04) is empty. Previous >versions contained the complete U.S. version of libc, including the >tres-dangerous DES and crypt functions. In the current rev only the >README remains, presumably because: > EXPORT INFORMATION: This patch includes code which performs > cryptographic functions, which are subject to U.S. export > control, and must not be exported outside the U.S. without > prior approval of the U.S. government. Prior export approval > must be obtained by the user of this patch. The 101759-?? patch is missing from the Feb 1996 SunSolve Patches CD. However if one pops in the November 1995 Patches CD there is a nice little copy of the 101759-03 patch which also comes with the above warning and the DES enabled libraries. The Patches CD's are openly sent around the world by Sun Support, one CD for all the world. Cheers, Mark

2 1

Re: Why Americans feel no compulsion to learn foreign languages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:13 AM 3/27/96 -0800, Timothy C. May wrote: >There is not a single foreign language I can think of it that would help me >in my goals or help anyone I know. This is the reality of a world dominated >by English-speaking persons and in which all technical people learn >English. I would agree with you, except I started International Caving. When in Hungery, I heard, "Peter will guide you thru the rest of the cave. Don't worry, he speaks good German." Fortunatly, my German was good enough. While in China as a normal tourist, a travel agency in Yichang tried to extort $600 from our group. My wife's (very poor) knowledge of Manderin probably scared the preps enough to get them to lay off. BTW - There are also French speakers on the US border. They don't want to speak english either. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: unsubscrive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:20 PM 3/27/96, David K. Merriman wrote: >Well, at least this one is *vaguely* forgiveable - the 'b' and 'v' keys >*are* next to each other on a keyboard.... A nice theory, but he uses the misspelling in the thread title ("unsubscrive") and in his body message of "unsubscrive cypherpunks." If he mistyped, it happened twice in the same way. (And I try to always check my spelling carefully when I am sending commands to a majordomo-type automatic processor!) "Measure twice, cut once." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:05 PM 3/27/96, Rich Graves wrote: >Undeniably true. I think Tim's point was more, "Who cares? Everyone *I* >want to talk to speaks English." > >One may quibble with the wisdom or morality of such a statement, but if >the second statement is true in your case, then there is no reason you >should have to learn another language. Most upper-income Americans have no >need for esoteric languages. Almost all upper-income Americans have a need >for English. Yes, this is mostly my point. And it is not just me I'm talking about--I don't see a compelling need for 95% of Americans to learn a second language...in fact, I'd rather they learned to speak and read English properly. (All of the America-bashers who were chiming in earlier today with their anti-American jokes...well, here's one for you: "What do you call someone who knows how to speak and write English properly? A European.") I don't deny that Alan Bostick needs to take a class in Yoruba so he can communicate with his neighbor, nor do I deny Michael Helm's point that by not studying Talegu we are denying ourselves access to the world's culture. In my next 25 lifetimes, with the advent of Nanocryonic Revitalization, I certainly will try to learn several of these obscure languages. Father Guido Sarducci has a nice routine in which he describes what happens to our high school Spanish in the several years after taking it. After the fourth or fifth year, all we remember is "Como esta?" (I took German, not Spanish, so my spelling is phonetic, from his dialog.) The point being that very few Americans have any _continuing_ way to use the languages we learn. Which is a major reason they are being dropped by many schools. Even in areas with lots of Mexicans and other Latinos, few opportunities. (Your mileage may vary, but I think this is generally so.) My sister lives near Miami and finds no need to brush up on her Spanish. The educated Cubans and ohter Latinos all speak English fluently, and the uneducated Mexicans and the like she has no need to communicate with. (No doubt some of the politically correct will once again denounce me as a racist. This is not racism, just reality. And to some, the truth hurts.) There is an "information theory" interpretation of learning foreign languages. Where I live, the issue is not that there are not native speakers of foreign languages...the issue is that no single foreign language stands out as being desirable to learn, except for one's personal edification or circumstances. So what languages should schools offer? French and German are not common in California, or the U.S. in general, and the languages of the immigrant communities (Spanish, Vietnamese, Tagalog, Laotian, Korean, etc.) have little use except in communicating with these communities. And they are all busy learning English.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: NSA/ITAR
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:43 PM 3/25/96, Vladimir Z. Nuri wrote: >TCM: > >>* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. >>companies, but is not _per se_ an issue I worry about. So long as I have >>strong crypto, I don't really care too much about export. It would be nice >>to get the ITARs modified, but not at the risk of adding language (such as >>Leahy did) making use of encryption a possible crime (we've debated this, >>so I won't elaborate here). Besides, I think the best way to overturn the >>ITARs is through a court challenge; as I have noted, even the NSA's lawyers >>felt that the ITARs would not withstand court scrutiny. > >hmmmm, I don't recall you saying that. would love to hear more about >"NSA's lawyers feeling the ITAR cannot withstand court scrutiny". My most recent mention of this was a few days ago, where I cited Carl Nicolai, inventor of the suppressed "PhasorPhone," as my source. He and his lawyer got access to papers inside the NSA building, though they could not make copies. They found memos from NSA staffers saying that the ITARs had never been tested in court and would not likely survive a full Consitutional test and that it would thus be best if court cases were avoided. I passed this information along to the Lee Tien, representing Gilmore in various cases, and to Phil Karn. --Medusa

1 0

Re: WSJ on Big Java Flaw
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 11:07 PM 3/26/96, Steve Gibbons wrote: .... >Actually, I suspected and reported the same bug some weeks before the group at >Princeton. <URL: http://www.aztech.net/~steve/java/~>. That said... .... Thanks for the pointer. I found it most interesting. I suppose that I am glad that I am not the only one who doesn't know how DNS works.

1 0

RE: Weapons & Hope
by Eric Anderson 17 Dec '03

17 Dec '03

---------- From: Duncan Frissell[SMTP:frissell@panix.com] Sent: Tuesday, March 26, 1996 8:42 AM To: cypherpunks(a)toad.com Subject: Weapons & Hope While it might be barely possible in the mass production age to control weapons by blocking the flow of these specific products (a Streetsweeper, say) into the marketplace, it will clearly not be possible in the age of custom production. General machines will be available to produce specialized products (often under the direct control of the customer, himself). Some of this custom production will be weapons. I took machine tool operations @ my local community college. suffice it to say, good, high-quality firearms are **EASY** to fabricate (Believe me!) So my point is this: Just as the Gov't CANNOT prevent me from making a gun in my basement, whats to stop some high-school juinor from writing a strong crypto program? I can just see Chuckie Schumer introducing (W/ Sen. Fine-Swine as co-sponor) a bill to ban "Cyberwar Software" i.e. mandatory registration of compilers, mandatory GAK, etc... What an asshole. Take care, Eric

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

The syslog problem is fixed in baseline SunOS 5.5. Sun and HP are apparently doing what the stupid law mandates - and they should do so, whether someone at NSA (or whatever) is on their case or not. :) They should also have someone in their respective legal departments bucking ITAR very hard. "tres-dangerous" must have been typed with a snear, no? ECafe Anonymous Remailer wrote: > > I noticed that Sun's latest libc patch (101759-04) is empty. Previous > versions contained the complete U.S. version of libc, including the > tres-dangerous DES and crypt functions. In the current rev only the > README remains, presumably because: > EXPORT INFORMATION: This patch includes code which performs > cryptographic functions, which are subject to U.S. export > control, and must not be exported outside the U.S. without > prior approval of the U.S. government. Prior export approval > must be obtained by the user of this patch. > > So, you might ask, what fixes is Sun not distributing??? > (Rev 04) > 1190985 gethostbyname() can trash an existing open file descriptor. > 1182835 portmapper silently fails with version mismatch by PC-NFS > client > 1219835 Syslog(3) can be abused to gain root access on 4.X systems. > > Yup, that's right. The syslog hole that was so well publicized by > CERT will remain open indefinitely because the ITAR makes it illegal > for Sun to distribute the fix! > > So did HP and Sun spontaneously, simultaneously develop crypto awareness, > or is some gummint dweeb whispering threats in their ear?

1 0