December 2003 - cypherpunks-legacy

Re: remailer-in-a-box
by Jay Haines 17 Dec '03

17 Dec '03

Reply to: RE>>remailer-in-a-box >>No one answered me. >>What's the best remailer-in-a-box. >>I'd like to run one. I would think people would be falling >>over eachother to tell me. >The reason for the quiet may be twofold. First, I and many others delete >unread list messages with out subjects. Second, remailer-in-a-box does not >.really exist. Mixmaster, and most of the other remailers are fairly easy to. >set up for anyone with UNIX experience. I run Mixmaster + Ghio + reorder >scripts. > -Lance Does one exist for the MAC? If not, would anyone be interested enough to see one developed?

2 1

Re: PGP, Inc.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 7:46 5/7/96, Raph Levien wrote: [...] > The S/MIME spec indicates the use of X.509v3 certificates, which, in >turn, are explicitly allowed to contain trust roots originating in the >client's local configuration. In other words, yes, the spec allows for a >Web of trust. > The big question, of course, is how easy the key management will be >in such a case. Everything I've seen points to key management being >super-easy if you use VeriSign certs, and probably just as bad as PGP >otherwise. Unlike PGP, most e-mail clients will probably not come >configured with the capablity to sign other keys - in the X.500 world, >e-mail clients and "certification authorities" are two separate >applications. Since VeriSign is going to issue certs for nyms for free, the only requirement being uniqueness, using their certs might not prove much of a problem. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: misunderstandings of PICS
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 5:31 PM 5/7/96, Joseph M. Reagle Jr. wrote (in part): >>my fear is that the supposed "failure" of self-ratings could be twisted >>by its opponents as evidence that it is inadequate to deal with the >>real problem. > > I think your fears are a little too paranoid here, but maybe they >aren't. The question is how much of this hoopola stems from fundamentalist >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better >educated and feeling pretty secure their kids won't get their hands on >naughty material. And then if self labeling had some failures, that's an >incentive for others to provide third party services (as others have >argued). PICS had to sell itself to the net as much as to the masses. >Self-labeling appeals to the net, it may appeal to the masses, but there are >other things in there to sweeten the deal for them if not. I disagree - paranoia is warranted here. One problem with our legislative process is that is is vulnerable to emotional issues. It is very easy to bring up issues that sound horrible (child porn, terrorist info, flag burning), then create legislation controlling them. Being opposed to this legislation for whatever reason brands you as "anti-family" or "soft on crime". It is clear to me that improperly labeled material will be paraded before congress and the media as justification for stricter control over this material. Congressmen, not wanting to face attack ads claiming that they support pornography (or terrorism, or whatever), will pass silly laws such as the CDA. It has happened before, it is naive to think that it will not happen again. There are only three solutions: 1) Vote in congressmen that support the first amendment. 2) Hope that judges protect our rights. 3) Deploy technological solutions that make any laws passed ineffectual. The first solution is improbable and the second is risky. Only the third solution actually provides a method where we can really have an impact. I think PICS is a great idea, and I think it may have an impact on judicial decisions. It should be implemented because it puts the control over information where it belongs, in the hands of the end-user. I would hope that it is a good-enough solution to avoid further control over the internet, but I have my doubts. Remember, if congress can try and legislate against something as innocuous as flag burning, what else would they be willing to do to curb our right to free speech? Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

Mandatory Voluntary Self-Ratings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:31 PM 5/7/96, Joseph M. Reagle Jr. wrote: >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better Regarding this "(which I see few cases in which it wouldn't)" point, I have a different view. Should "voluntary self-criticism" become widespread, I expect to rate all of my posts as suitable for children of all ages, suitable for hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. Regardless of whether I'm advocating post-birth abortions or forced encheferation of Muslim girls. Then we'll see what happens. (This is an old debate, here and on the Cyberia-l list, to wit, what happens when people/perverts/libertarians choose to subvert the voluntary ratings by deliberately mis-rating their stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters should be exposed to certain things?) I believe the whole debate about PICs-type ratings and other "voluntary self-labeling" has taken us astray. I don't see calls for authors to voluntarily self-rate their print works, nor do I see calls for newspapers to have articles rated. Nor speech in general. However, the drumbeat of "V-Chip" advocacy is now spilling over into cyberspace. I say it's a waste of our time to even be thinking or worrying about how to implement an infrastructure for ratings. In fact, building such an infrastructure could make later imposition of "mandatory voluntary ratings" (Orwell would be unsurprised) a greater likelihood. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

3 2

FBI probes CompuServe adult programming
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

COLUMBUS, Ohio, May 8 (UPI) -- The FBI, acting on a complaint from a Christian morals watchdog group, Wednesday sought to determine whether CompuServe Inc. has violated a new law against indecency. FBI agents said they were attempting to determine whether CompuServe's Entertainment Drive, which contains some adult material, violates the Communications Decency Act. The law prohibits offering pornography to on-line users, especially minors. CompuServe, headquartered in Upper Arlington, noted parents can now block their children from reaching any adult-oriented content. Users must use a password to reach certain restricted areas. ``At this time we are not doing anything,'' CompuServe spokeswoman Daphne Kent told the Columbus Dispatch. ``We cooperate fully with any law enforcement agency, but we have not had talks with (the FBI) at this time.'' The FBI started the investigation after the Justice Department determined a complaint from the American Family Association had merit. A spokesman said American Family made CompuServe a target because the on-line service is one of the world's largest such businesses and offers sexually oriented content. American Family, based in Tupelo, Miss., also objects to CompuServe's MacGlamour Forum, which contains adult pictures and movies.

1 0

Re: self-ratings
by rick hoselton 17 Dec '03

17 Dec '03

Timothy C. May writes: >Should "voluntary self-criticism" become widespread, I expect to rate all >of my posts as suitable for children of all ages, suitable for >hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. >Regardless of whether I'm advocating post-birth abortions or forced >encheferation of Muslim girls. Not me. If someone doesn't want to be offended, then I would rather they never read anything from me, ever. I share family, race, culture, and backround with my father, and there have been times when I offended him unintentionally. One person liked me enough to marry me, but I occasionally offended her, too. Imagine how easily I might offend a stranger. Better to take no chances at all. If somebody wants a rating system, then they should just consider everything I have to say as "X-rated" in EVERY category, just to be safe. And that's a policy that everyone on the net should follow. If this self rating system becomes mandatory, I think the cypherpunks should cooperate fully, by notifying ALL sites that are not self-X-rated if they can find ANYTHING that ANYONE might EVER find offensive. Better safe than sorry. Nobody will be prosecuted for saying they have an offensive site, even if they don't. Imagine a prosecutor trying to prove that NOBODY could POSSIBLY be offended by my newsgroup postings! But many people will be prosecuted for not identifying their sites as offensive. Now, if everyone follows my advice, the net may become very boring for those who have their filters set on, but congress will NEVER make "being boring" against the law. If mandatory-self-rating ever becomes the law, cypherpunks can definitely promote true justice by strictly interpreting it and supporting it completely.

2 1

Re: Transitive trust and MLM
by Raph Levien 17 Dec '03

17 Dec '03

I'm really glad to see this thread. I think this is a problem that is well worth thinking about. I think what is really called for is a model of when keys are likely to be bogus, and when signatures, etc., are likely to be correct. Before going into the math, I'll go through some examples. Any key that's "well connected" in the MIT keyring is likely to be good. Specifically, if it's signed by lots of people, and each of those people is reachable from my trust root, then I'm pretty much willing to believe the key is good. Unfortunately, there are a fair number of reasons why a key may be bad. A really _cool_ thing to do with a compromised machine would be to sign a big bunch of bogus keys. Given how easy it is to compromise a machine, this is a very real worry. I don't know if this attack has been realized yet, but it's best to assume it could be and will be. Another weakness is the "clueless user" who signs keys gotten from the Net, or otherwise not properly verified. I don't claim to know all of the vulnerabilities, but I do think it would be a good idea to quantify them before designing a key distribution system. Hal calls into question the value of signed keys. To me, this points to the pressing need for better manual verification of keys, by communicating secure hashes through the phone and on physical channels, including business cards. These channels are more secure than the Net, are more convenient for all but the most hardcore net.heads, and would actually work quite well, I think. But I do think it would be nice to have access to "probably good" keys for casual e-mail. With luck, a densely connected Web of manually obtained keys can serve as a good foundation for the latter. Now for the mathematical model. Signatures can bind keys to e-mail addresses, or act as assertions that the signed public key is trusted to transitively sign other keys. Let's assume that each signature has a certain probability p of being good, and a 1-p probability of being bogus, and that all probabilities are independent. These are probably bad assumptions in the real world, but that's the difference between theory and practice. Now we can actually evaluate the probability of a given key being good. Consider a Monte Carlo process in which each edge in the graph is present with probability 1-p. For each run, we determine whether the recipient's public key (actually the binding between public key and recipient's e-mail address) is reachable from our trust root. The probability over a large number of runs is (given our assumptions) the probability of the key being good. One encouraging consequence of this model is that densely connected subgraphs can result in highly trusted keys even if p itself is quite small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For example, if p is a mere 50%, then in a clique of size 10, each key in the clique is trusted with a probability of 99.9%. This computation is (I think) known as the network reachability problem, and is probably quite hard to evaluate. In practice, you'd probably want to compute upper and lower bounds instead, Let's see if we can come up with a model that preserves this property of giving high trust values to densely connected keys, yet is also highly resistant to (some plausible model) of attacks against the Web of trust. Raph

1 0

RE: self-ratings vs. market ratings
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Vladimir Z. Nuri (in response to Tim May) > >hmmmmmmmm, I seem to recall earlier letters in which you advocated >a market-type rating system in which services could rate things, >in the way that stocks are now rated, doctors/lawyers >could be rated, etc.-- let a thousand ratings services bloom. >(or maybe we were talking about reputations. in my mind, they are >mostly interchangeable--hence my interest in "rating" systems). ..................................................................... In consideration of the difference between "ratings" and "reputation": I think of a rating as something which is attached to something "pre-knowledge", whereas a reputation is something which develops over time & based upon informed knowledge ("after-knowledge"). A rating is applied to something (a service or whatever) by only those few individuals who are acquainted with what they are rating. A reputation is accumulated by the impressions made upon larger numbers of individuals - a general population not necessarily employed to collect these impressions - but who have nevertheless sufficient exposure to and acquaintanceship with the person/service/etc. to make an informed conclusion about it. A rating can make a statement on what something "is" or is expected to be (eg, general in content vs explicitly sexual), where a reputation reflects on past behavior. .. Blanc

3 2

HAVE YOU HAD YOUR (TAX) BREAK TODAY?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, As of 1 May, there is yet another reason to do your offshore business in Liechtenstein. On that date the country's first McDonald's opened in the town of Treisen. Liechtenstein is the 95th country to have a McDonald's. It was not reported whether or not the Princely family was at the VIP party that marked the gala opening, or if mutual recognition would be exchanged with McDonaldland. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by Gary Howland 17 Dec '03

17 Dec '03

CRYPTOGRAPHIC EXTENSIONS FOR JAVA _________________________________________________________________ DESCRIPTION This library contains a suite of cryptographic classes for Java. All of the classes have been implemented in native code for performance reasons, and have been tested on Windows 95, Windows NT and Solaris. Download in source or binary form at http://www.systemics.com/software/ FEATURES All of the following have been implemented using native methods: * BigInteger class (based on code from Eric Young). This class implements arbitrary length integers and some associated mathematical functions. * DES class (based on code from Eric Young) * IDEA class * MD5 class (based on code from RSA Data Security, Inc.) * SHA class (based on code from NIST and Peter C. Gutmann) COPYRIGHT This library includes (or is derived from) software developed by (and owned by) the following: * Peter C. Gutmann * NIST * RSA Data Security, Inc. * Systemics Ltd <http://www.systemics.com/> * Eric Young <eay(a)mincom.oz.au> Also planned for release: * Cryptographic library for Java * PGP library for Java * Cryptographic library for Perl * PGP library for Perl

1 0