December 2003 - cypherpunks-legacy

Re: Cell Kill 2
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

It's all just an elaborate plot to help discourage cell-phone cloning. Ryan

1 0

Re: trusting the processor chip
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:13 AM 4/27/96 -0800, Norman Hardy wrote: >At 9:53 AM 4/25/96, Jeffrey C. Flynn wrote: >.... >> >>It looks like I may have no other option than to give some processor some >>degree of trust. Which processor I should choose, and why that one? >.... >In the days of microcode this was my best (worst?) scenario. Setting up for >fast divide has been an art long before Pentium divide fame. In microcode >you don't spend time testing for cases that you can prove won't happen. >Some obscure cases can arise only with a rare combinations of two 48 bit >operands. The microcode flaw would be to put the processor into privileged >mode even while getting the right answer. There would plausible deniability >even if the flaw were discovered. (Gosh, I didn't test for this fall thru >case because here is the proof that it can't happen.) Of course there is a >bug in the proof but no one reads proofs. This can now be exploited by >anyone that knows what division leaves the machine in privileged state. > >This is an attack on those systems that are rated to run untrusted machine >code, using privileged mode code to limit the operation of the untrusted >code. > >Only one person is necessary to pull this off. He must be trusted to >produce microcode and the implementer of the divide algorithm. Test code >will not find the transition to privileged code just because you can't test >the whole machine state after every tested instruction. Normally the bogus >privileged state of the machine will quickly expire (on the next interrupt) >and will cause no permanent state change even in those few cases where a >magic division occurs naturally. There are some limits to the extent of this kind of problem. If the hardware/OS you are using provides a completely disjoint memory map based on the privileged mode state, it may be hard to exploit the ability to switch to privileged mode. With maps which allow access to the user's address space while in privileged mode (e.g. Solaris), it may be possible to just keep running, and so complete a successful attack. On the other hand, with most systems I have seen, setting yourself into privileged state will persist thru the next interrupt. The system Norm and I worked on would detect it later. (It checked every 5 minutes or so.) The IBM operating systems I have used would not detect, or correct this change. The ray of hope in this area is that there are so many other easier attacks on modern systems. People will have a tendency to use them first. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

[Pointer] fight-censorship-discuss
by Rich Graves 17 Dec '03

17 Dec '03

FYI. -rich "Have you no decency, sir?" To: majordomo(a)c2.org Subject: ignored info fight-censorship-discuss

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"I am sorry if you misunderstood my previous email. We are ex-Stanford grad, not current students! The WhoWhere? database is collected through a combination of technolofy, partnerships, and self-registrations by end-users. Our content is from publicly available sources." http://ergos-home.stanford.edu/whowhere.logo.gif name: Doremieux, Francois Yves Jean e-mail: 96francoid@Gsb department: Business year: Graduate phone: (415) 497-4334

1 0

Re: [DETWEILING?] Re: The Iron Mountain Report
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 25, 1996 00:17:25, 'Rich Graves <llurch(a)networking.stanford.edu>' wrote: >On second thought, this is so *obviously* a troll that it *must* be >intended to be obvious. Of course there are a lot of really stooooopid >Nazis out there, but this last round is too much. Did you see the one >about Smart Cards being the Mark of the Beast? Follow the URL that message >gave -- it's even loonier than it looks. > The sense I have is that the highest liklihood is that it springs from a standard run-of-the-mill loon on the conservative side of the spectrum. The net nazis are busy with far more creative trolls and the leftists have no record of picking up on this particular report (since, if nothing else, it was designed as a semi-humor piece when originally published in hardcover.) It more reminds me of the space-alien kidnapping piece on "Penelope Kuntz" from one of the fake newspapers that the _National Lampoon_ ran a few years ago. It was picked up and reposted by some of the paranoids. >Only nobody(a)replay.com knows... > >Possibilities: > >1. Some anti-Nazi (such as Tallpaul -- note this is *not* an accusation!) >trying to make the Nazis look bad. > I didn't take it as an accusation. There's nothing wrong with running through a complete(ish) list of hypotheses when working on a problem. However, this hypothesis is not likely since: 1) I don't think it came from nazis; 2) I (modestly) think I can make the nazis "look bad" by quoting them, not inventing trolls; 3) I don't troll political issues for political reasons. (OK, the BABYLON-5 troll was sort of political but I thought the reference for people to "bite my third secondary grasping tentacle" made it obvious but a couple of left-wing dufuses still took it seriously). 4) I am a generalist, without the detailed technical knowledge for really good trolls. Similar arguments against your other hypotheses. >2. Some really, really stupid Nazi who doesn't realize that he looks bad >(if you don't believe sich people exist, look up just about any Usenet >post from Les Griswold or A HUBER). >3. Some Detweiler tentacle/clone trolling just for kicks. >4. Declan, trying to troll me. >5. Me, trying to troll Declan, or myself. > ><pot-kettle-black=on> > >In any case, the person doing it is an asshole, and there is little call >for substantive replies. Don't feed the animals. > ></pot-kettle-black> > >-rich > >

1 0

Re: NOISE - AARMs (fwd)
by Dave Emery 17 Dec '03

17 Dec '03

> David Lesher writes: > > > But there has been an easy defense against such for decades. > > You run ordinary phone wire from the transmitter + antenna X meters > back to the bunker or whatever. Then you talk from there. > Another division of a company I did some consulting work for makes a box that goes between the transmitter and control head of a current generation tactical UHF satellite terminal (LST-5 TACSAT) of the type used by US military commanders in the field. It connects the control and talking part of the radio with the transmitter and antenna via up to a mile of optical fiber cable with no metal conductors. As you can imagine, it is hard to use RF sniffing techniques to find the command post at the other end of the fiber. Dave Emery die(a)die.com

1 0

DRAFT agenda for DC net-conference in early May
by Declan B. McCullagh 17 Dec '03

17 Dec '03

I recently saw a DRAFT agenda for a day-long Net-conference to be held in early May, hosted by Congressmen Jack Fields and Rick White. Panels include Future of the Internet, Electronic Commerce, Intellectual Property, Law Enforcement and Encryption, and Education on the Net. Highlights include a POSSIBLE luncheon address by The Honorable Newt Gingrich. Thought DC-area cypherpunks might like an advance heads-up. -Declan

1 0

WhoWhere.com v. that stanford.edu loon
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several people asked for an update, so here it is. WhoWhere.com has been provided a dump of the password file that they may never have seen before, and they will be purging all 27,128 addresses therein from its database. Of course, many of those addresses may also be available from other, publicly available sources, and the Stanford community has been made well aware of whowhere.com's service (for user entries), so I expect that thousands of these addresses will return soon. I am confident that the Parsec folks are now acting in good faith, and that they are now sensitive to the relevant privacy and ethical issues. Myself, I'm cognizant of the hypocrisy and foolishness inherent in my position, but hey, we do what we can with what we got. Until the system is fixed, I gotta defend my people the best I can. I'm still reasonably serious about that "Hack Stanford Privacy" thing. If there is an easy way for outsiders to glean our whole kerberos namespace (outside of other major universities interconnected via AFS, and we'll get that fixed Real Soon Now), I want to know about it. - -rich [not on cypherpunks, so please Cc any responses] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYWLdo3DXUbM57SdAQF9fAP+Pw4ra8Q5JfDy/DnmfrDauP5/4x+sH+SY qOwGk+GDgKW1p9yO+31OhuLsatPK5sXDGjTtwseRZXZXizylGmwQtgs2g9gQMxNR feZLyo0WBVnYw600ppms7nfay0uqEjM25nw/z+HDrUZ7VlWuAXZ/yctqLadiO3P8 +vCGbDfSQWA= =dP6F -----END PGP SIGNATURE-----

1 0

Re: Freedom and security
by Scott Schryvers 17 Dec '03

17 Dec '03

At 11:08 PM 4/28/96 -0700, you wrote: > >>No. "Those who sacrifice security for freedom, will have neither" is >>not consistent with Franklin's statement, nor is it true. Security and >>freedom are antithetical, and worse than that, security is always an >>illusion. But you can have your illusion, as long as you keep it out of >>my life. Censor yourself if you wish, but don't censor anything I might >>want to look up. >> >The Internet may once have been one of those small close knit communities, >small enough not to require law enforcement - although even then it had >rules that had to be followed. But that Internet is gone, and it will >never return, because now its the biggest city in the world, and the >history of the change from pastoral communities to urban life, to the >development of nation states and power blocs is also the history of crime. >And as the Internet grows, so will its security problems. > >My position is to seek a balance between the freedom of the individual and >the security of the community. My argument is that when the security of >the community is threatened by the freedom of the individual, the community >will always prioritise its safety. "When the security of the community is threatened by the freedom of the individual?!" >From what socio-political ideology do you run your group? >Good government of course means >maintaining individual freedoms *and* maintaining community security. I >actually disagree that they are antithetical. On the contrary they are a >balance that any society has to find. Where individual freedom takes over >you have the urban jungle where predators consume prey. Where security >takes over you have the totalitarian state. Neither is necessary nor >inevitable. By the way government serves best when it serves least. Remember that. >We are simply concentrating on the problem from two different angles. My >concern is to maximise community safety while protecting individual >freedom. Your angle is to maximise individual freedom while protecting >community safety. There is IMHO very little difference between the two. No there is a major difference, I feel society is served best when each individual has the freedom to defend and protect themselves apposed to what you want us to do in essence you want us to lay down those liberties to an outsied group who are supposed to protect us. The internet is not a city, it is a computer network that spans the globe. What you are asking for in analogy is not a cop walking a city street but fucking U.N. tanks driving through neiborhoods enforcing rights by way of brute force. >From what I have seen of what your group does you are as hypicritical as law enforcement in your techniques and attacks on others. Often unwarranted and justified in the name of some supposed higher ideal. PGP encrypted mail preferred. Scott J. Schryvers <schryver(a)radiks.net> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzFX9usAAAEH/2r2eovPAoYZbxzmfJ1DW7yjjdVnckXjUVKU/zZNAUV/IjzF GDEq040wbAG1rFHDYoBOjjJTOGWMFuZ9apqoAvvI7Q4NAmVrNif0Rp8q/j4jib13 dlAA4Q0nvJZ5YNw4sf4r0iug76+9i0WpIZoP60DEB8BTuyCP55+nsbe7Ii3xLRyq ThZ2fhNqK2hD/rFugXK29Ynyzuc6TuFfu78kVOsYUUbQpplXyaLjhGKN94pZ5jox x7/wvqmBoH9E3rnaIPY9vOwy3kvMmCTlkjhlCzMXZHDn0e3UHWAax2mUTMttRzzi +SUv45h6ua+eSwUkA8uojojn/JiPOKIPwPk3hq0ABRG0KFNjb3R0IEouIFNjaHJ5 dmVycyA8c2Nocnl2ZXJAcmFkaWtzLm5ldD4= =58dK -----END PGP PUBLIC KEY BLOCK-----

1 0

Calling other code in Java applications and applets
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:22 PM 4/29/96, sameer(a)c2.org wrote: >> >> Java applications can't save files to disk or use data files on >> disk. > > Uh, yes they can. It's the applets that can't. And I believe that even applets can read and write data files on disk IF THE APPLET ENVIRONMENT PERMITS this. Netscape and similar environments at this time of course _don't_ let this happen, but this is a choice (as I understand it) made at this time and perhaps for this version of the respective pieces of software. (As I understand it, an explicit decision not to allow file i/o, for some obvious though not necessarily permanent reasons.) Certainly the InputStream and OutputStream classes handle file i/o for Java applications--if not applets in general, and presumably not with Netscape 2.0. I can imagine future developments which will allow browsers or similar environments to have full file i/o capability. (Sure, there are dangers. There are always dangers in running code gotten from others. These are recurring problems. I expect lots of flavors of solutions, from signed classes to "playpen" holding tanks (which allow file i/o, but only within some constrained environment), and so on.) By the way, I had a discussion at a party with several Sun folks and other Java programmers, and they agreed that external code (C, for example) could be called, even by an _applet_, if arranged. For example, various underlying graphics routines in the AWT (Alternative Window Toolkit) package are of course using underlying code written in various other languages, code that has been reasonably optimized for speed. "import java.awt.*" makes this code available to applications, and (I believe) to applets within Netscape-type environments. (I suspect there's a simple chart someplace showing what will run under what constraints.) The interesting thing here is that a crypto package, perhaps with speed-optimized underlying routines in C or even hand-coded machine language, could be released. It might be that patent holders (not that I am endorsing this) could license such packages to users. Thus, import java.bignum.* import.java.entropy.* import java.rsa.* import java.digicash.* ... (Such packages may need approval by Sun, etc., and formal integration, a la AWT. But certainly there is talk of replacing AWT with something else, so changes and additions are clearly possible.) Lastly, I don't believe that discussing the implications of Java justifies the claim that "males are posturing." To me, discussing Java, virtual machines, security issues, and advantages/disadvantages is what the list is about, at least as much as the other topics we so often discuss. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1