December 2003 - cypherpunks-legacy

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 02:51 PM 4/12/96 -0700, Alan Olsen wrote: >At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: >> >>On Apr 12 at 8:07 >>jim bell wrote: >>> >>>Are you sure they're not referring to 8 bits of data and a parity bit? In >>>any case, please give the address to the list so that it can be checked out. >> >>Come on, give it up already and admit you were wrong. At least 8 different >>people have cited examples of machines that supported non 8bit bytes. Your >>pride is getting the best of you. > >Jim is unwilling to admit his errors, even in things he has little or no >training in. (I remember him claiming at one point that he was not a >programmer or did any coding for that matter. Why he continues to persist >in such things I will not speculate on...) What I meant was the most honest answer I could give: I am not a professional programmer. I have programmed, in APL, Fortran, Algol, PL/1, Pascal, and I can read BASIC's well enough, but not recently.

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 12:00 AM 4/10/96 -0700, Bill Stewart wrote: >At 09:33 PM 4/8/96 -0400, Jack Mott wrote: >>This may be a bit of a no brainer, but everything I have read sorta >>skips over this point. a bit is 1 or 0. 8 bits make up a byte (0-255). > >Be careful writing code - sometimes a byte is -128 to 127 instead of 0 to 255. >Also, there are machines (mostly old kinky ones) that use bytes of sizes >other than 8 bits. No, Bill, a "byte" has ALWAYS been 8-bits. One of the main reasons the term "byte" was invented was because the term "word" (as in, "word length") varied for different computers, especially in the 1960's. (In fact, many computers of that era used word lengths other than 8, 16, 32, 64 bits, as surprising as this may sound to the current crop of PC and Mac afficionados.) This made it inconvenient to talk about memory capacities unless you were referring to the same machine. The solution was to invent a new term, "byte," which conviently had about the same size as an ASCII character and was always 8 bits.

7 6

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: washington post notices archives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:39 PM 4/11/96, Andrew K. Bressen wrote: >we here at HKS.net have today received a cease and desist >letter from the washington post regarding editorial copy >of theirs that was evidently posted to c'punks and then >abosrbed into our c'punk archives. > >Once the archives are restored (RSN) we'll probably manually edit out >the messages from the archive. We're trying to get the post to give us Several relevant points for lists like ours: 1. Expect more and more of these sorts of copyright "cease and desist" (or, as I like to say, "decease and cyst") orders, as newspapers and magazines use search engines to find their stuff. Expect some "automated searches" to be done routinely, even offered as services by third parties. ("Find infringing copies...make $1000 a week in your spare time.") 2. What does removal of infringing articles mean for follow-ups? If I reference a WSJ or NYT article that someone has quoted or forwarded, is my follow-up expunged also? 3. And what of the "Cypherpunks Archives on CD-ROM"? Too late to simply remove a single article...does the entire production run go into the landfill? (I haven't heard much about the "enthusiasm du jour" of the "Cypherpunks CD-ROM," but this always been a concern, that legal issues would have to be resolved, including the getting of releases from several hundred or more parties.) 4. Suppose the HKS archives were actually offshore, in the Cayman Islands or in some place that doesn't recognize copyright law in the same way most Western or Berne Convention countries do? 5. Suppose access to such archives is done via Web remailers, and the location is not easily determinable? (To be sure, lots of hits means traffic analysis will reveal the location....the same general problem with "reply-blocks," of course.) It sounds like the Washington Post is discovering the brave new world. Expect an article or two on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PEP Announcement (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This showed up in my mailbox: --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information ---------- Forwarded message ---------- Date: Wed, 10 Apr 1996 00:03:29 -0400 From: Amos Elberg <aelberg(a)wesleyan.edu> To: unicorn(a)schloss.li Subject: PEP Announcement Uni, can you forward this to the c-punks for me? --------- PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate Eudora and MacPGP are now available in the latest Button Circle release at: <ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch96… .hqx> PEP is designed to provide features similar to the UNiX premail program on the Macintosh. It handles encryption, decryption, signing, verifying, anon.penet.fi remailing and cypherpunk remailing. PEP uses OneClick to place a button bar in Eudora, from which the user can select privacy functions. Buttons pop-up menus of encryption targets, signature keys and cypherpunk remailers. Q: What do I do about the rest of MacPGP's interface? A: PEP is not designed to replace MacPGP, just to provide easier access to it from within Eudora. For a full featured MacPGP GUI replacement with added features, try Raif Naffah's MacPGPControl application. Q: Isn't the name 'PEP' pretentious and derivative? A: Yes, I think so too. I couldn't think of a better one. Suggestions are welcome. Q: I have a lot more questions. Where are the answers? A: In the documentation. If you have any more questions, please direct them to <mailto:aelberg@wesleyan.edu> ------------------------------------------------------------------------------ Amos B. Elberg | #include disclaimer.h Amos will code for Wesleyan University | food. E-mail me for a resumé. Please. 341 S. Main St. Apt. 3N |---------------------------------------- Middletown, CT 06459 | Help keep the net safe from the Will Code for Food! | aesthetically challenged. Please, Public keys available from the usual | oppose ASCII art. keyservers, or by request. |---------------------------------------- PGP fingerprint = 08 B8 87 04 6B 21 08 5D B0 62 F7 94 7B 42 0F 10 --- end forwarded text

1 0

Re: Edited Edupage, 4 April 1996
by Michael C. Peponis 17 Dec '03

17 Dec '03

On 12 Apr 96 ,E. ALLEN SMITH wrote: > From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 > >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF > >IBM plans to offer companies "data mining" software and services, allowing > >them to make better use of disparate pieces of information stored in their > >computer systems. The Intelligent Miner software will be available on IBM's > >RS/6000 servers by the fall, and on other platforms by year end. The > >company also plans to develop Intelligent Decision Server software for local > >area network-based information analysis. (Investor's Business Daily 3 Apr > >96 A9) > > Anyone have any _specific_ ideas on how their Intelligent Miner system > works? It would appear to be relevant to the identity-spoofing discussions. > -Allen Not really, it's a tool used in Data Warehousing/Decission Support Systems. Here is what it is in a nut shell. A company creates a Data Warehouse, defining it's data universe in terms of business rules and practices. Data Mining is the process by which users try to make sence of all the data. They call it "intelligent" because it supports natural language queries, ie the end user does not need to know SQL or the table layouts to retrieve the information they want. Very sketchy explination, but there are entire volumes written on the subject, and it's new technology so the exact definition varies depending on who you ask. I have been developing systems like this for the past year, and I still can't give people a cut and dry answer as to what the hell it is. Regards, Michael C. Peponis Public Key Avalible Via Key Servers, or Finger

1 0

Re: Contempt charges
by Moltar Ramone 17 Dec '03

17 Dec '03

> Message-Id: <199604100152.DAA25396(a)spoof.bart.nl> > To: cypherpunks(a)toad.com > From: anonymous(a)nowhere.goucher.edu (Senator Exon) > Comments: Please report misuse of this automated remailing service to > <remailer-admin(a)remailer.nl.com> Oooh... forged headers... forged to indicate they're coming from _my_ school. I wonder who _this_ could be... perhaps someone who has expressed anger at me on the list? Perhaps just a random choice? Perhaps me? (Not me, that I'll tell you...) > Borrowing inspiration from May, a page from Scheier and some code from > Gutman... Techniques from Detweiller, and lousy law from Jim Bell (I _wonder_ who might have posted this... :-) ) > Hard disk space being cheap now, Bob creates several distinct disk > partitions and uses Peter Gutman's Secure File System, or equivalent, to > encrypt all of them. [ ... ] >Practically, Bob cannot be forced to reveal the pass phrases to any >alleged remaining secret data, since this might not exist. To further >encourage this belief Bob might associate innocous data with a first pass >phrase, mildly embarrasing data with a second, and so on, and then, after >revealing the first, gradually allow himself to be be coaxed into revealing >the second and disclose a third only after the rubber hoses came out. > >Since all of the partitions have similar content, no statistic should >reveal which is which. Bob might have a bit refresher routine >periodically nibble read and rewrite the whole disk so that no >electronic characteristic exists that reveals record age. Sure, this will effectively hide the data; so will a plain old encrypted partition... >No doubt, a judge might whimsically keep Bob in jail for a while, trying >to assure that he has revealed all of the pass phrases, but the judge >can never be certain, even when Bob has disclosed everything. This >situation creates doubt that Bob is in contempt, even when he is, and >makes a prison term relatively pointless, unless for revenge. But that's what a contempt charge is _for_: "You're not treating me with respect, so I'm going to punish you." It might be described as being for a particular reason (ie supressing evidence), but each of those reasons ultimately boils down to lack of respect. In addition, were I handing down (or prosecuting) the contempt charges, I'd claim that the statement (even if it was made in public) that the individual didn't know all the keys in the first place was a lie, and that, by repeating the lie, they were purjuring themself. I am not a lawyer; however, I suspect that neither was the anonymous poster. In fact, I think I have a pretty good idea of who it was: someone on the list who: (1) Has recently been claiming that contempt charges were worthless, and that people should start ISPs, and pool money for insurance. (2) Has (probably) used this technique (at least once) before to create the appearances of support for one of his/her ideas which really has no support. (3) Might _possibly_ be upset with me (due to the headers...) I can't think of _anyone_ who meets THAT description, now can I? ;-) Jon ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:27 PM 4/9/96 -0800, jim bell wrote: >At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >>At 3:21 PM 4/9/96 -0800, jim bell wrote: >>>And the rest of us are tired of seeing those non-responses! >> >>I wish to state that Jim Bell does not speak for me. > >Tell me, what is the most exciting, interesting, and imaginative usage of >"Yadda Yadda Yadda" that _you_ remember, Bill? This will be my last post on this subject. Since Jim Bell ALWAYS has to have the last word on any given subject, he will continue to try to read something into my statement that is not there. I can not get much clearer than: I have not authorized Jim Bell to speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: No matter where you go, there they are.
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 8:53 AM 4/10/96, Hal is rumored to have typed: > Peter - didn't they say that the checking station is also listening > to the satellites? That way they can tell that you are playing back > signals that you taped earlier because they won't match what the > satellites are broadcasting right now. There is going to be processing and network delay involved here (unless Denning et al have figured out some way to communicate faster than the speed of light), so drift between the what you report and what the checking station and repeaters are hearing _at that time_ is inevitable. This is the loophole which allows Peter's attack, a loophole which cannot be closed (because the spoofer can always claim to be on a slower link than she really is and there is nothing the verifiyer can do to prove otherwise.) If I want to pretend to be closer to the receiver than my true location I simulate a slow link which gives me enough time to record what the signals would be at the near location and then quickly resend them to give the appearance of the spoofed location. In fact, I think that this really all boils down to trying to use GPS as a non-interactive proof of location, and the information posted about the system does not address the obvious attacks on such systems which are known from research into ZNPs. > If their authenticated repeaters are used then you have to assume the > checking station has all the satellite signals and again the best you can > do is pretend to be a Mole Man. The authenticated repeaters may collect all signals, _but the receiving station does not get them all at once_ because it will take time for the signals to propogate from the repeater back to the station attempting to determine location. Having all of the signals does not help the checking station other than allowing it to share a set of sats with the person attempting to authenticate. It still does not And perhaps more importantly, do you really want anyone you connect to on the net to know your location to the nearest 10 meters? What is Dennings fascination with building Big Brother? jim

4 7